Edit tour

Windows Analysis Report
dK5DtwHlOm.exe

Overview

General Information

Sample name:	dK5DtwHlOm.exe renamed because original name is a hash value
Original sample name:	11471fefe1cc0d23ed54aa434ea7c0ccbfef0350457235346936822fbcb39f43.exe
Analysis ID:	1554992
MD5:	932b9920b8fdecc6e2fd9c0aa298ffbc
SHA1:	6a058ce158711c8dd50cd914b49e40d55f0377c0
SHA256:	11471fefe1cc0d23ed54aa434ea7c0ccbfef0350457235346936822fbcb39f43
Tags:	ConsolHQLTDexeuser-JAMESWT_MHT
Infos:

Detection

Score:	8
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Compliance

Score:	47
Range:	0 - 100

Signatures

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

dK5DtwHlOm.exe (PID: 6264 cmdline: "C:\Users\user\Desktop\dK5DtwHlOm.exe" MD5: 932B9920B8FDECC6E2FD9C0AA298FFBC)

msiexec.exe (PID: 4208 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\dK5DtwHlOm.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488655 " AI_EUIMSI="" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2536 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 5796 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 9AEE7218D2031C6F2AE76EA651368327 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6936 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding A37C39DFED73779FFC80EA38DF9643CA MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:07:21.552340+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49735	TCP
2024-11-13T10:07:59.695765+0100	2022930	1	A Network Trojan was detected	172.202.163.200	443	192.168.2.4	49743	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Compliance

Uses 32bit PE files

Source: dK5DtwHlOm.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

PE / OLE file has a valid certificate

Source: dK5DtwHlOm.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: dK5DtwHlOm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1711549640.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, shi9909.tmp.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\AICustAct.pdby source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9D2F.tmp.1.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9D2F.tmp.1.dr
Source:	Binary string: D:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: dK5DtwHlOm.exe, decoder.dll.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, Installer.msi.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, Installer.msi.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\Prereq.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, Installer.msi.0.dr
Source:	Binary string: wininet.pdbUGP source: dK5DtwHlOm.exe, 00000000.00000003.1711549640.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, shi9909.tmp.0.dr
Source:	Binary string: D:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: dK5DtwHlOm.exe
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI99D6.tmp.0.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr
Source:	Binary string: D:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: dK5DtwHlOm.exe, decoder.dll.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI99D6.tmp.0.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr

Spreading

Checks for available system drives (often done to infect USB drives)

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B02380 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_00B02380
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009FAB80 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	0_2_009FAB80
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AE4DA0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00AE4DA0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B03220 FindFirstFileW,FindClose,	0_2_00B03220
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AE5370 FindFirstFileW,GetLastError,FindClose,	0_2_00AE5370
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AC8230 FindFirstFileW,FindNextFileW,FindClose,	0_2_00AC8230
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B0C530 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00B0C530
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B208D0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00B208D0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B0C930 FindFirstFileW,FindClose,	0_2_00B0C930
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AE4A10 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	0_2_00AE4A10
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AECF00 FindFirstFileW,FindClose,FindClose,	0_2_00AECF00
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AFF260 FindFirstFileW,FindClose,	0_2_00AFF260
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B0F8A0 FindFirstFileW,FindClose,	0_2_00B0F8A0

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B0B500 _wcschr,_wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_00B0B500

Networking

Suricata IDS alerts with low severity for network traffic

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49735
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 172.202.163.200:443 -> 192.168.2.4:49743

Source: dK5DtwHlOm.exe	String found in binary or memory: RShlwapi.dllShell32.dllmsiexec.exeSoftware\JavaSoft\Java Development Kit\binSoftware\JavaSoft\Java Runtime Environment\JavaHomeFlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmpGETattachment.partfilenamecharset= "POSTutf-8DLD123US-ASCIIAdvancedInstallerutf-16ISO-8859-1/HTTP/1.0Local Network ServerFTP ServerContent-Type: application/x-www-form-urlencoded; charset=utf-8 equals www.yahoo.com (Yahoo)
Source: dK5DtwHlOm.exe, 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmp, dK5DtwHlOm.exe, 00000000.00000000.1675013179.0000000000BF9000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Shlwapi.dllShell32.dllmsiexec.exeSoftware\JavaSoft\Java Development Kit\binSoftware\JavaSoft\Java Runtime Environment\JavaHomeFlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmpGETattachment.partfilenamecharset= "POSTutf-8DLD123US-ASCIIAdvancedInstallerutf-16ISO-8859-1/HTTP/1.0Local Network ServerFTP ServerContent-Type: application/x-www-form-urlencoded; charset=utf-8 equals www.yahoo.com (Yahoo)

Source: shi9909.tmp.0.dr	String found in binary or memory: http://.css
Source: shi9909.tmp.0.dr	String found in binary or memory: http://.jpg
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shi9909.tmp.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://t2.symcb.com0
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://tl.symcd.com0&
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1789737539.0000000004333000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	String found in binary or memory: https://www.thawte.com/repository0W

System Summary

Contains functionality to call native functions

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B22390 NtdllDefWindowProc_W,	0_2_00B22390
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AA2620 GetSystemDirectoryW,_wcschr,LoadLibraryExW,NtdllDefWindowProc_W,	0_2_00AA2620
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A88100 NtdllDefWindowProc_W,	0_2_00A88100
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A40110 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00A40110
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F2330 NtdllDefWindowProc_W,	0_2_009F2330
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009FC750 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_009FC750
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F8840 NtdllDefWindowProc_W,	0_2_009F8840
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F89B0 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_009F89B0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009EEBF0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_009EEBF0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A40C9E GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00A40C9E
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A40C28 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00A40C28
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A40D5D GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00A40D5D
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009EF1A0 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	0_2_009EF1A0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009EF7D0 NtdllDefWindowProc_W,	0_2_009EF7D0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A0D760 NtdllDefWindowProc_W,	0_2_00A0D760
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F1740 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_009F1740
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A018D0 NtdllDefWindowProc_W,	0_2_00A018D0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F1D70 NtdllDefWindowProc_W,	0_2_009F1D70

Creates files inside the system directory

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5b9aaf.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D2F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9DCC.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E0C.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E2C.tmp	Jump to behavior

Deletes files inside the Windows folder

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI9D2F.tmp

Jump to behavior

Detected potential crypto function

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B1C120	0_2_00B1C120
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009FAB80	0_2_009FAB80
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AF8C40	0_2_00AF8C40
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B215C0	0_2_00B215C0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00ABC150	0_2_00ABC150
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A062B0	0_2_00A062B0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A044A0	0_2_00A044A0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009FE540	0_2_009FE540
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B867E0	0_2_00B867E0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F8DF0	0_2_009F8DF0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B8EF3A	0_2_00B8EF3A
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009E3010	0_2_009E3010
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AC3460	0_2_00AC3460
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A15680	0_2_00A15680
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B7F7DC	0_2_00B7F7DC
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A03890	0_2_00A03890
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B919A0	0_2_00B919A0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A079D0	0_2_00A079D0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A3FAD0	0_2_00A3FAD0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B99D65	0_2_00B99D65
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009E3E25	0_2_009E3E25

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 009E9120 appears 38 times
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 009E87D0 appears 404 times
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 00ADF720 appears 61 times
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 009E70D0 appears 36 times
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 009E7160 appears 50 times
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 00A13BA0 appears 90 times
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: String function: 009E9990 appears 60 times

Sample file is different than original file name gathered from version info

Source: dK5DtwHlOm.exe, 00000000.00000000.1675223362.0000000000C88000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameInstaller.exe6 vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe, 00000000.00000003.1677250230.000000000120F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDecoder.dllF vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe, 00000000.00000003.1711549640.00000000058F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe	Binary or memory string: OriginalFileNameInstaller.exe6 vs dK5DtwHlOm.exe
Source: dK5DtwHlOm.exe	Binary or memory string: OriginalFilenameDecoder.dllF vs dK5DtwHlOm.exe

Uses 32bit PE files

Source: dK5DtwHlOm.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: shi9909.tmp.0.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: clean8.winEXE@8/13@0/0

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00AE3200 FormatMessageW,GetLastError,

0_2_00AE3200

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B0DAE0 GetDiskFreeSpaceExW,

0_2_00B0DAE0

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B27B10 CoCreateInstance,

0_2_00B27B10

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00A7AD00 FindResourceW,LoadResource,LockResource,SizeofResource,

0_2_00A7AD00

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

File created: C:\Users\user\AppData\Roaming\Restricted editor savers

Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

File created: C:\Users\user\AppData\Local\Temp\shi9909.tmp

Jump to behavior

Source: dK5DtwHlOm.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

File read: C:\Users\user\Desktop\dK5DtwHlOm.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\dK5DtwHlOm.exe "C:\Users\user\Desktop\dK5DtwHlOm.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9AEE7218D2031C6F2AE76EA651368327 C
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\dK5DtwHlOm.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488655 " AI_EUIMSI=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A37C39DFED73779FFC80EA38DF9643CA
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\dK5DtwHlOm.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488655 " AI_EUIMSI=""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 9AEE7218D2031C6F2AE76EA651368327 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding A37C39DFED73779FFC80EA38DF9643CA	Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

PE / OLE file has a valid certificate

Source: dK5DtwHlOm.exe

Static PE information: certificate valid

PE file has a big code size

Source: dK5DtwHlOm.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: dK5DtwHlOm.exe

Static file information: File size 51730672 > 1048576

PE file has a big raw section

Source: dK5DtwHlOm.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x217a00

PE file contains a mix of data directories often seen in goodware

Source: dK5DtwHlOm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dK5DtwHlOm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dK5DtwHlOm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dK5DtwHlOm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dK5DtwHlOm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dK5DtwHlOm.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: dK5DtwHlOm.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

PE file contains a debug data directory

Source: dK5DtwHlOm.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: wininet.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1711549640.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, shi9909.tmp.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\AICustAct.pdby source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9D2F.tmp.1.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9D2F.tmp.1.dr
Source:	Binary string: D:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: dK5DtwHlOm.exe, decoder.dll.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, Installer.msi.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, Installer.msi.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\Prereq.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, Installer.msi.0.dr
Source:	Binary string: wininet.pdbUGP source: dK5DtwHlOm.exe, 00000000.00000003.1711549640.00000000058F1000.00000004.00000020.00020000.00000000.sdmp, shi9909.tmp.0.dr
Source:	Binary string: D:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: dK5DtwHlOm.exe
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI99D6.tmp.0.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr
Source:	Binary string: D:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: dK5DtwHlOm.exe, decoder.dll.0.dr
Source:	Binary string: D:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI99D6.tmp.0.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr

PE file contains a valid data directory to section mapping

Source: dK5DtwHlOm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dK5DtwHlOm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dK5DtwHlOm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dK5DtwHlOm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dK5DtwHlOm.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: shi9909.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B20560 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B20560

PE file contains sections with non-standard names

Source: shi9909.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shi9909.tmp.0.dr	Static PE information: section name: .didat

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_011DBF88 push ds; retf 0009h	0_3_011DBF8A
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_011CC9A2 pushad ; iretd	0_3_011CCEA9
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_011D31C6 push esp; iretd	0_3_011D321C
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_011D32BB push edx; retf	0_3_011D32BC
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_011D12A8 push eax; iretd	0_3_011D12A9
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_0120E16B push es; ret	0_3_0120E16E
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_01206351 push es; ret	0_3_01206772
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_0120D1A8 push eax; iretd	0_3_0120D1B5
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_01206785 push es; retf	0_3_01206786
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_01206787 push es; iretd	0_3_01206792
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_0120CDE0 push eax; iretd	0_3_0120CDE1
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_3_0120DEDC push es; retf	0_3_0120DFC6
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A860EB push ecx; mov dword ptr [esp], 3F800000h	0_2_00A862BE
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B7771E push ecx; ret	0_2_00B77731
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F3B2B push esi; ret	0_2_009F3B2D
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009F5CB0 push ecx; mov dword ptr [esp], ecx	0_2_009F5CB1
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AC3D60 push ecx; mov dword ptr [esp], 3F800000h	0_2_00AC3E96

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File created: C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E0C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File created: C:\Users\user\AppData\Local\Temp\MSI99D6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9DCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E2C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File created: C:\Users\user\AppData\Local\Temp\MSI9977.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File created: C:\Users\user\AppData\Local\Temp\shi9909.tmp	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E0C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9DCC.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9D2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI9E2C.tmp	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\decoder.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9E0C.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9DCC.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI99D6.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9D2F.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI9E2C.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI9977.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi9909.tmp	Jump to dropped file

Found evasive API chain checking for process token information

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-65912

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File Volume queried: C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File Volume queried: C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B02380 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_00B02380
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_009FAB80 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,_wcsrchr,_wcsrchr,PathIsUNCW,	0_2_009FAB80
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AE4DA0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00AE4DA0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B03220 FindFirstFileW,FindClose,	0_2_00B03220
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AE5370 FindFirstFileW,GetLastError,FindClose,	0_2_00AE5370
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AC8230 FindFirstFileW,FindNextFileW,FindClose,	0_2_00AC8230
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B0C530 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00B0C530
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B208D0 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00B208D0
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B0C930 FindFirstFileW,FindClose,	0_2_00B0C930
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AE4A10 _wcsrchr,FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,_wcsrchr,	0_2_00AE4A10
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AECF00 FindFirstFileW,FindClose,FindClose,	0_2_00AECF00
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00AFF260 FindFirstFileW,FindClose,	0_2_00AFF260
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B0F8A0 FindFirstFileW,FindClose,	0_2_00B0F8A0

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B0B500 _wcschr,_wcsrchr,_wcsrchr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_00B0B500

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B7411D VirtualQuery,GetSystemInfo,

0_2_00B7411D

Source: MSI9E2C.tmp.1.dr

Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B76437 IsDebuggerPresent,OutputDebugStringW,

0_2_00B76437

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B20560 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B20560

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B7674C mov esi, dword ptr fs:[00000030h]	0_2_00B7674C
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B98A0E mov eax, dword ptr fs:[00000030h]	0_2_00B98A0E
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B8D840 mov ecx, dword ptr fs:[00000030h]	0_2_00B8D840

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B767B8 GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00B767B8

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00A12530 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00A12530
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B771E8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00B771E8
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: 0_2_00B7BEA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00B7BEA3

HIPS / PFW / Operating System Protection Evasion

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\restricted editor savers\editpro ai 1.131.2\install\9629e8b\installer.msi" ai_setupexepath=c:\users\user\desktop\dk5dtwhlom.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488655 " ai_euimsi=""
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\restricted editor savers\editpro ai 1.131.2\install\9629e8b\installer.msi" ai_setupexepath=c:\users\user\desktop\dk5dtwhlom.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488655 " ai_euimsi=""			Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B0FD20 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

0_2_00B0FD20

Language, Device and Operating System Detection

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,MsgWaitForMultipleObjectsEx,MsgWaitForMultipleObjectsEx,PeekMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,TranslateMessage,DispatchMessageW,MsgWaitForMultipleObjectsEx,	0_2_00B04F10
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: EnumSystemLocalesW,	0_2_00B90DD9
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00B94D50
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: EnumSystemLocalesW,	0_2_00B94FF2
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,	0_2_00B94F4B
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: EnumSystemLocalesW,	0_2_00B950D8
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: EnumSystemLocalesW,	0_2_00B9503D
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B95163
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,	0_2_00B953B6
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,	0_2_00B91356
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00B954DF
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetLocaleInfoW,	0_2_00B955E5
Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00B956B4

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B1C8F0 CreateNamedPipeW,CreateFileW,

0_2_00B1C8F0

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B763AD GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

0_2_00B763AD

Source: C:\Users\user\Desktop\dK5DtwHlOm.exe

Code function: 0_2_00B1B490 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,

0_2_00B1B490

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	11 Peripheral Device Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	25 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dK5DtwHlOm.exe	0%	ReversingLabs
dK5DtwHlOm.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\MSI9977.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI9977.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI99D6.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi9909.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\decoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSI9D2F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9DCC.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9E0C.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI9E2C.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://html4/loose.dtd	shi9909.tmp.0.dr	false	high
https://www.advancedinstaller.com	dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	false	high
https://www.thawte.com/cps0/	dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	false	high
http://.css	shi9909.tmp.0.dr	false	high
http://.jpg	shi9909.tmp.0.dr	false	high
https://www.thawte.com/repository0W	dK5DtwHlOm.exe, 00000000.00000003.1790227644.0000000004323000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791229425.000000000432C000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004597000.00000004.00001000.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000002.1793499977.0000000004331000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1791696038.0000000004330000.00000004.00000020.00020000.00000000.sdmp, dK5DtwHlOm.exe, 00000000.00000003.1706551117.0000000004400000.00000004.00001000.00020000.00000000.sdmp, 5b9aaf.msi.1.dr, MSI9977.tmp.0.dr, MSI99D6.tmp.0.dr, MSI9DCC.tmp.1.dr, MSI9E0C.tmp.1.dr, Installer.msi.0.dr, MSI9E2C.tmp.1.dr, MSI9D2F.tmp.1.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554992
Start date and time:	2024-11-13 10:06:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	dK5DtwHlOm.exe renamed because original name is a hash value
Original Sample Name:	11471fefe1cc0d23ed54aa434ea7c0ccbfef0350457235346936822fbcb39f43.exe
Detection:	CLEAN
Classification:	clean8.winEXE@8/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 56% Number of executed functions: 69 Number of non-executed functions: 177
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ocsps.ssl.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MSI9977.tmp	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	0n25lfPJxD.exe	Get hash	malicious	AsyncRAT, DcRat, Quasar, XWorm	Browse
	SecuriteInfo.com.BackDoor.Siggen2.4873.19832.17135.msi	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.BackDoor.Siggen2.4873.19471.19549.msi	Get hash	malicious	Unknown	Browse
	zoQOIWTCDJ.msi	Get hash	malicious	Unknown	Browse
	EjhVO5YaYI.msi	Get hash	malicious	Unknown	Browse
	QuickBooks JAWANI.msi	Get hash	malicious	Unknown	Browse
	QuickBooks Setup.msi	Get hash	malicious	Unknown	Browse
	QuickBooks Setup.msi.zip	Get hash	malicious	Unknown	Browse
	Honeygain_install.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSI9977.tmp

Download File

Process:	C:\Users\user\Desktop\dK5DtwHlOm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507360
Entropy (8bit):	6.416174396827717
Encrypted:	false
SSDEEP:	6144:3SGhsSlnJc5xR+yGjNUaPkp8u84XLyJ+8zLCAONOmXNfnZRAF3U+Hj1:3SGXc5Seas8uDELCeGNPZh+Hj1
MD5:	CFAB78AC0D042A1D8AD7085A94328EF6
SHA1:	B3070CC847BA2739450DC9BD05040DF83E7D85D2
SHA-256:	17B10DF05B4B92735B673914FE2BF0C0D7BBDA5B4A8F9A7FC81A0EFAA4380168
SHA-512:	647B909F1E833DD08D99AAA29A3404E64C58356DFA0A3ABEB788768D74ABB0948D2B612A6DA62F2617270CD85110E8AA2B26E5E4558AF0D0B84F920C40533438
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: 0n25lfPJxD.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.BackDoor.Siggen2.4873.19832.17135.msi, Detection: malicious, Browse Filename: SecuriteInfo.com.BackDoor.Siggen2.4873.19471.19549.msi, Detection: malicious, Browse Filename: zoQOIWTCDJ.msi, Detection: malicious, Browse Filename: EjhVO5YaYI.msi, Detection: malicious, Browse Filename: QuickBooks JAWANI.msi, Detection: malicious, Browse Filename: QuickBooks Setup.msi, Detection: malicious, Browse Filename: QuickBooks Setup.msi.zip, Detection: malicious, Browse Filename: Honeygain_install.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......alV_%.8.%.8.%.8...;.(.8...=...8.Gu<.4.8.Gu;.=.8.Gu=.l.8...<.<.8...>.$.8...9...8.%.9...8..t1.x.8..t8.$.8..t..$.8.%...$.8..t:.$.8.Rich%.8.................PE..L.....8b.........."!.....0..........Uv.......@...........................................@..................................!.......p..........................$V..8...p...........................x...@............@...............................text...F........0.................. ..`.rdata.......@.......4..............@..@.data...d"...@.......0..............@....rsrc........p.......D..............@..@.reloc..$V.......X...L..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI99D6.tmp

Download File

Process:	C:\Users\user\Desktop\dK5DtwHlOm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	934880
Entropy (8bit):	6.463468533833365
Encrypted:	false
SSDEEP:	24576:FmCzCf7c4yQ8xtgIZROly4aNXVW+hv+Ahi:8Rc4yQ8xtoly4aNXVW+hv+Ahi
MD5:	B15DBF4B35CD1460BA283795E24878C8
SHA1:	327812BE4BFDCE7A87CB00FAB432ECC0D8C38C1E
SHA-256:	0AC07DB6140408E9586D46727EB32AF8F8048CAD535ECA9052B6EF1149E63147
SHA-512:	95EDC60C9658E0E8631604459969A406414902F297B7A14F2BE6D3BC18878636167D202530D4EE3B4D7AF189A9139A2183929250920196C48C08EDA3D6DFDCA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:bu.[.&.[.&.[.&7).'.[.&7).'Q[.&.#.'.[.&.#.'.[.&.#.'.[.&7).'.[.&7).'.[.&.[.&.Z.&d".'.[.&d".'.[.&d".&.[.&.[.&.[.&d".'.[.&Rich.[.&................PE..L....8b.........."!................ ........................................p......$.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text............................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIb9e58.LOG

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.4343194815230804
Encrypted:	false
SSDEEP:	6:Qg6RvA9cOYrsfc/okjxaaOEqQbr62avKpnKBlv2K84UlUlFFKCH:QbAYsc/7aFEVbr62aInKT86FKw
MD5:	FDEDAD9E70B40F84D24BD8E5DCFFAC42
SHA1:	1DD871626F2A52BF153C179689D8A181538096FC
SHA-256:	1FA3CC4619B7BF7E8D6320B6000F822F17141A76375743C2637FEA3BD85B7AF9
SHA-512:	8D6756B21A098C027AAD4D57F85E56D15F7510FD030C0C977D06C1AF7E59D7062FA43A6AE74ACA797959C88A3EDC2CE54F1A1D62FCF625B40E84B62CD04623E3
Malicious:	false
Reputation:	low
Preview:	..E.d.i.t.P.r.o. .A.i. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .s.y.s.t.e.m.s. .w.i.t.h. .s.c.r.e.e.n. .r.e.s.o.l.u.t.i.o.n. .s.m.a.l.l.e.r. .t.h.a.n. .1.3.6.0. .x. .7.6.8.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.1.1./.2.0.2.4. . .0.4.:.0.7.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\shi9909.tmp

Download File

Process:	C:\Users\user\Desktop\dK5DtwHlOm.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B\Installer.msi

Download File

Process:	C:\Users\user\Desktop\dK5DtwHlOm.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {A14A8F8E-54FE-43B0-84DE-DDD8EBDB97D1}, Number of Words: 0, Subject: EditPro Ai, Author: Restricted editor savers, Name of Creating Application: EditPro Ai, Template: ;1033, Comments: This installer database contains the logic and data required to install EditPro Ai., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2493440
Entropy (8bit):	6.592310443965914
Encrypted:	false
SSDEEP:	49152:EHiYW67SAZhAjMApRc4yQ8xtoly4aNXVW+hv+AhilHovZ2V9SH+0Js0NX:RYWsVAEtoTo
MD5:	B7B992FF846E5ED1BBF631C29976B617
SHA1:	30D40ED73D4E231CA8BF963396C33DF547C4912A
SHA-256:	C44780DC3FD4DDF8E8B88C2BCB768B793B3EA2D2D38E57935DEA736B947C62F5
SHA-512:	291B75510254D4F87057D8DF52CFBE4BE6ADC36F28F624F947BD20843923C4521CCB3CDB5A18AD75FA664503B0A7DCE467020C259633AD9EB9B68B9809AD3707
Malicious:	false
Preview:	......................>...................'...................................N.......{.......4...5...6...7...8...9...:...;..."...#...$...%...&...'...(...)......+...,...-......./...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................................................................................................................................................................................................h...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C...9...E...M...G...H...I...J...K...L...E...P.......P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\decoder.dll

Download File

Process:	C:\Users\user\Desktop\dK5DtwHlOm.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	211456
Entropy (8bit):	6.450220092257771
Encrypted:	false
SSDEEP:	3072:iltFwoJxZQ4fK70l5DqKtRnBBjGd4uM4h0lntiEnc2xMe4fyyERt:iaU87+3nHy6n0NF5ERt
MD5:	899944FB96CCC34CFBD2CCB9134367C5
SHA1:	7C46AA3F84BA5DA95CEFF39CD49185672F963538
SHA-256:	780D10EDA2B9A0A10BF844A7C8B6B350AA541C5BBD24022FF34F99201F9E9259
SHA-512:	2C41181F9AF540B4637F418FC148D41D7C38202FB691B56650085FE5A9BDBA068275FF07E002E1044760754876C62D7B4FC856452AF80A02C5F5A9A7DC75B5E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......+(..oI..oI..oI..;..eI..;...I...1..JI...1...I...1..yI..;..zI..;..hI..oI...I...0..3I...0..nI...0..nI..oIe.nI...0..nI..RichoI..................PE..L.....8b.........."!.....f................................................................@.................................\...<....... .......................@ ......p...............................@...............t............................text....d.......f.................. ..`.rdata...............j..............@..@.data...dV... ......................@....rsrc... ...........................@..@.reloc..@ ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\dK5DtwHlOm.exe
File Type:	data
Category:	dropped
Size (bytes):	162294897
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	52CCD73381770B6FA1E0E33B65F6ED65
SHA1:	027C58D8C3CCCCE2BE80841F4383AB1C66253006
SHA-256:	8632EB84E2DCFE49FEDA48252BA8DB0AEEEC46CDD31DC4B28829A6D49C57D1CA
SHA-512:	BDDBEA4786FA1D4BBAD47446C5D9577E00251ABF0CA882BDA5166178C248BD223645235FB95C6114A560DC45DD3D8FCCE0355C4DA459E94DC367A074C6EFA1B4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\5b9aaf.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {A14A8F8E-54FE-43B0-84DE-DDD8EBDB97D1}, Number of Words: 0, Subject: EditPro Ai, Author: Restricted editor savers, Name of Creating Application: EditPro Ai, Template: ;1033, Comments: This installer database contains the logic and data required to install EditPro Ai., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2493440
Entropy (8bit):	6.592310443965914
Encrypted:	false
SSDEEP:
MD5:	B7B992FF846E5ED1BBF631C29976B617
SHA1:	30D40ED73D4E231CA8BF963396C33DF547C4912A
SHA-256:	C44780DC3FD4DDF8E8B88C2BCB768B793B3EA2D2D38E57935DEA736B947C62F5
SHA-512:	291B75510254D4F87057D8DF52CFBE4BE6ADC36F28F624F947BD20843923C4521CCB3CDB5A18AD75FA664503B0A7DCE467020C259633AD9EB9B68B9809AD3707
Malicious:	false
Preview:	......................>...................'...................................N.......{.......4...5...6...7...8...9...:...;..."...#...$...%...&...'...(...)......+...,...-......./...R...S...T...U...V...W...X...Y...Z...[...............................................................................................................................................................................................................................................................................................................h...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C...9...E...M...G...H...I...J...K...L...E...P.......P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI9D2F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507360
Entropy (8bit):	6.416174396827717
Encrypted:	false
SSDEEP:
MD5:	CFAB78AC0D042A1D8AD7085A94328EF6
SHA1:	B3070CC847BA2739450DC9BD05040DF83E7D85D2
SHA-256:	17B10DF05B4B92735B673914FE2BF0C0D7BBDA5B4A8F9A7FC81A0EFAA4380168
SHA-512:	647B909F1E833DD08D99AAA29A3404E64C58356DFA0A3ABEB788768D74ABB0948D2B612A6DA62F2617270CD85110E8AA2B26E5E4558AF0D0B84F920C40533438
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......alV_%.8.%.8.%.8...;.(.8...=...8.Gu<.4.8.Gu;.=.8.Gu=.l.8...<.<.8...>.$.8...9...8.%.9...8..t1.x.8..t8.$.8..t..$.8.%...$.8..t:.$.8.Rich%.8.................PE..L.....8b.........."!.....0..........Uv.......@...........................................@..................................!.......p..........................$V..8...p...........................x...@............@...............................text...F........0.................. ..`.rdata.......@.......4..............@..@.data...d"...@.......0..............@....rsrc........p.......D..............@..@.reloc..$V.......X...L..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9DCC.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507360
Entropy (8bit):	6.416174396827717
Encrypted:	false
SSDEEP:
MD5:	CFAB78AC0D042A1D8AD7085A94328EF6
SHA1:	B3070CC847BA2739450DC9BD05040DF83E7D85D2
SHA-256:	17B10DF05B4B92735B673914FE2BF0C0D7BBDA5B4A8F9A7FC81A0EFAA4380168
SHA-512:	647B909F1E833DD08D99AAA29A3404E64C58356DFA0A3ABEB788768D74ABB0948D2B612A6DA62F2617270CD85110E8AA2B26E5E4558AF0D0B84F920C40533438
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......alV_%.8.%.8.%.8...;.(.8...=...8.Gu<.4.8.Gu;.=.8.Gu=.l.8...<.<.8...>.$.8...9...8.%.9...8..t1.x.8..t8.$.8..t..$.8.%...$.8..t:.$.8.Rich%.8.................PE..L.....8b.........."!.....0..........Uv.......@...........................................@..................................!.......p..........................$V..8...p...........................x...@............@...............................text...F........0.................. ..`.rdata.......@.......4..............@..@.data...d"...@.......0..............@....rsrc........p.......D..............@..@.reloc..$V.......X...L..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9E0C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	507360
Entropy (8bit):	6.416174396827717
Encrypted:	false
SSDEEP:
MD5:	CFAB78AC0D042A1D8AD7085A94328EF6
SHA1:	B3070CC847BA2739450DC9BD05040DF83E7D85D2
SHA-256:	17B10DF05B4B92735B673914FE2BF0C0D7BBDA5B4A8F9A7FC81A0EFAA4380168
SHA-512:	647B909F1E833DD08D99AAA29A3404E64C58356DFA0A3ABEB788768D74ABB0948D2B612A6DA62F2617270CD85110E8AA2B26E5E4558AF0D0B84F920C40533438
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......alV_%.8.%.8.%.8...;.(.8...=...8.Gu<.4.8.Gu;.=.8.Gu=.l.8...<.<.8...>.$.8...9...8.%.9...8..t1.x.8..t8.$.8..t..$.8.%...$.8..t:.$.8.Rich%.8.................PE..L.....8b.........."!.....0..........Uv.......@...........................................@..................................!.......p..........................$V..8...p...........................x...@............@...............................text...F........0.................. ..`.rdata.......@.......4..............@..@.data...d"...@.......0..............@....rsrc........p.......D..............@..@.reloc..$V.......X...L..............@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI9E2C.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	934880
Entropy (8bit):	6.463468533833365
Encrypted:	false
SSDEEP:
MD5:	B15DBF4B35CD1460BA283795E24878C8
SHA1:	327812BE4BFDCE7A87CB00FAB432ECC0D8C38C1E
SHA-256:	0AC07DB6140408E9586D46727EB32AF8F8048CAD535ECA9052B6EF1149E63147
SHA-512:	95EDC60C9658E0E8631604459969A406414902F297B7A14F2BE6D3BC18878636167D202530D4EE3B4D7AF189A9139A2183929250920196C48C08EDA3D6DFDCA4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:bu.[.&.[.&.[.&7).'.[.&7).'Q[.&.#.'.[.&.#.'.[.&.#.'.[.&7).'.[.&7).'.[.&.[.&.Z.&d".'.[.&d".'.[.&d".&.[.&.[.&.[.&d".'.[.&Rich.[.&................PE..L....8b.........."!................ ........................................p......$.....@.........................0\|..t....\|.......`...............*.......p.......,..p...................@-.......+..@............................................text............................... ..`.rdata..T...........................@..@.data...T............x..............@....rsrc........`.......,..............@..@.reloc.......p.......2..............@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	432221
Entropy (8bit):	5.37516953282471
Encrypted:	false
SSDEEP:
MD5:	62957DF3A39FDF5C66BEF6C79B0D89E8
SHA1:	2A7B6C37203F6A96A0F57C78F6D27DCC4417884F
SHA-256:	104FC51191054254824201A08681994399C834CC24F680CAE2C8144B3391CB30
SHA-512:	B57FD74DA392FC8E9D0E4B5F1AA4020919A208BE7345DE264857C1095F6EA0339E6B452C52D0F1471959BF606F3529E2951DABB8B4AE083A7DA4ED51B086A091
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.977838958843423
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	dK5DtwHlOm.exe
File size:	51'730'672 bytes
MD5:	932b9920b8fdecc6e2fd9c0aa298ffbc
SHA1:	6a058ce158711c8dd50cd914b49e40d55f0377c0
SHA256:	11471fefe1cc0d23ed54aa434ea7c0ccbfef0350457235346936822fbcb39f43
SHA512:	31ea884412faa2f107a1f31e61b04a045e22ff6732e933f2ca8af22872ba5913157cadd5227a8537404a5abc7c466bc915795fbff252723c9908a8fe6df69f0d
SSDEEP:	786432:5tTniVhO792ZWUvUky35+ZM4nUo3oxYRx98JH0McUy6JtvVrnIJw0dKN3AlKBeUo:3wg2ZFUkHPUo3198JH0MTt8A3AlKB3yN
TLSH:	32B72330364DC52BDA6605B0293D9A9F55197E650FB298C7B3CC3D7E1AB48C21732E2B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......j.....t...t...t...w.#.t...q...t...r./.t.L.p.=.t.L.w.6.t.L.q.M.t...p.4.t...u.-.t...s./.t...u...t...}.c.t...../.t...../.t...v./.t

File Icon


Icon Hash:	ffb7c95954e6bdff

Static PE Info

General

Entrypoint:	0x597714
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6238823F [Mon Mar 21 13:48:47 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	836688c7d21e39394af41ce9a8c2d728

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, S=Texas, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	30/08/2024 13:25:00 30/08/2025 13:25:00
Subject Chain	OID.1.3.6.1.4.1.311.60.2.1.3=GB, OID.2.5.4.15=Private Organization, CN=ConsolHQ LTD, SERIALNUMBER=12800651, O=ConsolHQ LTD, L=Erith, C=GB
Version:	3
Thumbprint MD5:	E4ED28FFAC43E82D3DB5467DE244B770
Thumbprint SHA-1:	787863161875446360E7486D3CF5E34E15DC8009
Thumbprint SHA-256:	CA814262219EF4B9EF1CC76050E02D41B34F87AEF05D34FA378DAE913F4C784C
Serial:	740833F89CC52CAE8CEA1984A66DBB66

Entrypoint Preview

Instruction
call 00007F0EA123E59Fh
jmp 00007F0EA123DDDFh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F0EA123D433h
jmp 00007F0EA123DF42h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069F01Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069F01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069F01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29de24	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a8000	0x4b6f8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x31538d8	0x2018
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2f4000	0x257cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x247848	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x2478c0	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x21af38	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x219000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x29b218	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x21791f	0x217a00	c49c101070a1945156e31ccb8b4c699f	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x219000	0x85e1c	0x86000	0bc20f46e2242997255f9f9e7ecca899	False	0.31188236065764924	data	4.604766709480219	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29f000	0x89f0	0x6a00	718c6ac2ba6bcb374d818e1d67c3a166	False	0.1418410966981132	DOS executable (block device driver \340kY)	2.877738466626911	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2a8000	0x4b6f8	0x4b800	a75cda4571179e3232c364eb85e81d7b	False	0.18434719060430463	data	5.801481286866672	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2f4000	0x257cc	0x25800	341590d742eebeddce717893413cf78e	False	0.44703125	data	6.513825531591639	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x2a8cb0	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
IMAGE_FILE	0x2a8cb8	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
RTF_FILE	0x2a8cc0	0x2e9	Rich Text Format data, version 1, ANSI, code page 1252	English	United States	0.5503355704697986
RTF_FILE	0x2a8fac	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	English	United States	0.906832298136646
RT_BITMAP	0x2a9050	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x2a9190	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x2a99b8	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x2ae260	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x2aeccc	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x2aee20	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x2af648	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 39 x 39 px/m	English	United States	0.7065602836879432
RT_ICON	0x2afab0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304, resolution 39 x 39 px/m	English	United States	0.5618852459016394
RT_ICON	0x2b0438	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 39 x 39 px/m	English	United States	0.3968105065666041
RT_ICON	0x2b14e0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 39 x 39 px/m	English	United States	0.28526970954356845
RT_ICON	0x2b3a88	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 39 x 39 px/m	English	United States	0.2151629664619745
RT_ICON	0x2b7cb0	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 20736, resolution 39 x 39 px/m	English	United States	0.1788354898336414
RT_ICON	0x2bd138	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864, resolution 39 x 39 px/m	English	United States	0.1355371032163128
RT_ICON	0x2c65e0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 39 x 39 px/m	English	United States	0.10163551401869159
RT_ICON	0x2d6e08	0x2d05	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9739696312364425
RT_MENU	0x2d9b10	0x5c	data	English	United States	0.8478260869565217
RT_MENU	0x2d9b6c	0x2a	data	English	United States	1.0714285714285714
RT_DIALOG	0x2d9b98	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x2d9c44	0x2a6	data	English	United States	0.5132743362831859
RT_DIALOG	0x2d9eec	0x3b4	data	English	United States	0.43248945147679324
RT_DIALOG	0x2da2a0	0xbc	data	English	United States	0.7180851063829787
RT_DIALOG	0x2da35c	0x204	data	English	United States	0.560077519379845
RT_DIALOG	0x2da560	0x282	data	English	United States	0.48598130841121495
RT_DIALOG	0x2da7e4	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x2da8b0	0x146	data	English	United States	0.5736196319018405
RT_DIALOG	0x2da9f8	0x226	data	English	United States	0.4690909090909091
RT_DIALOG	0x2dac20	0x388	data	English	United States	0.45464601769911506
RT_DIALOG	0x2dafa8	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x2db15c	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x2db294	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x2db2e0	0x45c	data	English	United States	0.3844086021505376
RT_STRING	0x2db73c	0x344	data	English	United States	0.37320574162679426
RT_STRING	0x2dba80	0x2f8	data	English	United States	0.4039473684210526
RT_STRING	0x2dbd78	0x598	data	English	United States	0.2807262569832402
RT_STRING	0x2dc310	0x3aa	StarOffice Gallery theme i, 1627418368 objects, 1st n	English	United States	0.4211087420042644
RT_STRING	0x2dc6bc	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x2dcc7c	0x568	data	English	United States	0.32875722543352603
RT_STRING	0x2dd1e4	0x164	data	English	United States	0.5421348314606742
RT_STRING	0x2dd348	0x520	data	English	United States	0.39176829268292684
RT_STRING	0x2dd868	0x1a0	data	English	United States	0.45913461538461536
RT_STRING	0x2dda08	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x2ddb94	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x2dddac	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x2de3d0	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x2dea30	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x2ded14	0x84	data	English	United States	0.7196969696969697
RT_VERSION	0x2ded98	0x314	data	English	United States	0.43781725888324874
RT_HTML	0x2df0ac	0x37c8	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08291316526610644
RT_HTML	0x2e2874	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x2e3b8c	0x4fa	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3626373626373626
RT_HTML	0x2e4088	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x2eab58	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x2eb1fc	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x2ec248	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x2ed7fc	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x2ef858	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x2f2ee8	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, RemoveDirectoryW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, MoveFileW, GetLastError, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, SetEvent, InitializeCriticalSection, lstrcpynW, CreateThread, WaitForSingleObject, GetProcAddress, LoadLibraryExW, Sleep, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetModuleHandleW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SystemTimeToFileTime, MultiByteToWideChar, WideCharToMultiByte, GetCurrentProcess, GetSystemInfo, WaitForMultipleObjects, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, SetUnhandledExceptionFilter, FormatMessageW, FileTimeToSystemTime, GetEnvironmentVariableW, GetEnvironmentStringsW, LocalFree, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, CreateProcessW, GetExitCodeProcess, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetLocaleInfoW, GetSystemDefaultLangID, GetUserDefaultLangID, GetWindowsDirectoryW, GetSystemTime, GetDateFormatW, GetTimeFormatW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, GetLocalTime, CreateNamedPipeW, ConnectNamedPipe, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, TerminateThread, LocalAlloc, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, GetSystemTimeAsFileTime, CompareStringEx, GetCPInfo, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, WaitForSingleObjectEx, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetFileType, GetTimeZoneInformation, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetConsoleMode, IsValidCodePage, GetACP, GetOEMCP, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:07:02
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\dK5DtwHlOm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\dK5DtwHlOm.exe"
Imagebase:	0x9e0000
File size:	51'730'672 bytes
MD5 hash:	932B9920B8FDECC6E2FD9C0AA298FFBC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:07:05
Start date:	13/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7b9520000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	04:07:06
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 9AEE7218D2031C6F2AE76EA651368327 C
Imagebase:	0xf00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:07:06
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\dK5DtwHlOm.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488655 " AI_EUIMSI=""
Imagebase:	0xf00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:07:07
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding A37C39DFED73779FFC80EA38DF9643CA
Imagebase:	0xf00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	73

Executed Functions

Function 00AF8C40 Relevance: 24.5, APIs: 2, Strings: 11, Instructions: 1753COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

Part of subcall function 009E9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,009F6AC0,-00000010,?,00B21897,00000008,C310823C), ref: 009E9143

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 00AF8E37
SetEvent.KERNEL32(?), ref: 00AF8E95

Part of subcall function 00B03960: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,C310823C), ref: 00B0398B

Strings

Code returned to Windows by setup:, xrefs: 00AF8FF1
AI_BOOTSTRAPPERLANGS, xrefs: 00AF9D09, 00AF9D1B, 00AF9D25
%hu, xrefs: 00AF91B1
A valid language was received from commnad line. This is:, xrefs: 00AF9185
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00AF9314
Software\Caphyon\Advanced Installer\, xrefs: 00AF9300
Language selected programatically for UI:, xrefs: 00AF9432
Language of a related product is:, xrefs: 00AF937C
Advinst_Extract_, xrefs: 00AF8C95, 00AF8CA7, 00AF8CB1
Languages of setup:, xrefs: 00AF9F5D
Language used for UI:, xrefs: 00AF94AE

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: EventInit_thread_footer$DeleteFileFindHeapProcessResource
String ID: %hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\
API String ID: 4144826820-297406034
Opcode ID: 648464a8a0c3c09f84ab87c84328266d86e12c696fb9e32a45cfe4a584d484b8
Instruction ID: 86cc4023e2dbe3c017b8b3e128d52d6f9fdb014aa3449f29218b73298a00ab95
Opcode Fuzzy Hash: 648464a8a0c3c09f84ab87c84328266d86e12c696fb9e32a45cfe4a584d484b8
Instruction Fuzzy Hash: F2E2BE70900649DFDB01DFA8C849BAEFBB5EF45314F1482A8F515EB292EB349D05CBA1

Function 009FAB80 Relevance: 23.6, APIs: 10, Strings: 3, Instructions: 895fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 009FACA2
PathIsUNCW.SHLWAPI(?,*.*), ref: 009FAD03
FindFirstFileW.KERNEL32(?,00000000,*.*), ref: 009FAF4E
GetFullPathNameW.KERNEL32(?,00000000,00000000,00000000), ref: 009FAF68
GetFullPathNameW.KERNEL32(?,00000000,?,00000000), ref: 009FAF9B
FindClose.KERNEL32(00000000), ref: 009FB00C
SetLastError.KERNEL32(0000007B), ref: 009FB016
_wcsrchr.LIBVCRUNTIME ref: 009FB06C
_wcsrchr.LIBVCRUNTIME ref: 009FB08C
PathIsUNCW.SHLWAPI(?,?,C310823C,?,00000000), ref: 009FB24B

Strings

*.*, xrefs: 009FACCF, 009FACD7
\\?\UNC\, xrefs: 009FAD23, 009FAE3F, 009FB26B, 009FB377
\\?\, xrefs: 009FAE5A, 009FAF12, 009FB392, 009FB44B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Path$Find$CloseFullName_wcsrchr$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 1241272779-1700010636
Opcode ID: 504af139f6190335d4f81bc54e1a6ae136b55a9b0daca8a0541feb24cb288cb5
Instruction ID: 015c2ca5d2bb98ed3b2888d1608087a124a7d1f61622e6be8f5b4cd0ca970ee0
Opcode Fuzzy Hash: 504af139f6190335d4f81bc54e1a6ae136b55a9b0daca8a0541feb24cb288cb5
Instruction Fuzzy Hash: E362E571A006099FDB14DF68C889BBEB7F9FF84314F148668E915DB2A5DB31AD04CB90

Function 00B1C120 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 550
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PackageCode, xrefs: 00B1C46B
SELECT `Value` FROM `Property` WHERE `Property` = '%s', xrefs: 00B1C18E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: PackageCode$SELECT `Value` FROM `Property` WHERE `Property` = '%s'
API String ID: 0-2409377028
Opcode ID: 55106606ae14e90daea8be731fb010a2d23afc53a3670f6f19cec91fa23537bf
Instruction ID: d5b17a0d75c768eae080f9d11d9b289755dcfe597f4d996dbda001be74e2c2d1
Opcode Fuzzy Hash: 55106606ae14e90daea8be731fb010a2d23afc53a3670f6f19cec91fa23537bf
Instruction Fuzzy Hash: 6B12BF71A40205AFDB10DFA8DC49BEEBBE8EF44310F5481A9F805EB2A1DB759D40CB94

Function 00B0FD20 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00B0FD68
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00B0FD75
GetLastError.KERNEL32 ref: 00B0FD7F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00B0FDA9
GetLastError.KERNEL32 ref: 00B0FDAF
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,?,?,?), ref: 00B0FDD5
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00B0FE08
EqualSid.ADVAPI32(00000000,?), ref: 00B0FE17
FreeSid.ADVAPI32(?), ref: 00B0FE26
CloseHandle.KERNEL32(00000000), ref: 00B0FE60

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: 105074c73070102d8deb308ff6c9f007daeededfda2f650b7f25f37839389256
Instruction ID: 0f7a2ebeec077b1382588649c881f210871a9b4adf79ce482850958b7bca9db9
Opcode Fuzzy Hash: 105074c73070102d8deb308ff6c9f007daeededfda2f650b7f25f37839389256
Instruction Fuzzy Hash: D9411871A0021AEBDF209FA4CD49BEEBBF8FF08714F104165E511B72A1DB759A04CB64

Function 00B20560 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000000,00B026CB,?,?,?,?,?), ref: 00B20575

Strings

ExtractAllFiles, xrefs: 00B205C7
GetTotalFilesSize, xrefs: 00B205B5
InitExtraction, xrefs: 00B205AD
EndExtraction, xrefs: 00B205D9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: LibraryLoad
String ID: EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-3462492388
Opcode ID: b47a4be3da4d6544d3241a1bafdc5d8177e0f9db0f4825e88f8f689a29b4a5a1
Instruction ID: 7bc84e176b1042d1366ef7539ba94adf137bfb6bfc30a0c56f729fdc9bb9e56e
Opcode Fuzzy Hash: b47a4be3da4d6544d3241a1bafdc5d8177e0f9db0f4825e88f8f689a29b4a5a1
Instruction Fuzzy Hash: 5F014879A40321ABCB54AB60BC18B5E7BA1F798311F20446BFA1663222CA359815DF98

Function 00B02380 Relevance: 15.7, APIs: 10, Instructions: 744COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 209a557928cfc01dd566998f27ff4a85640617ccb1ce98424c446766431bf457
Instruction ID: 0e7fbbde1423b65ca28a24ed85e82345f501673a2fb4c0bfb848005247ab734d
Opcode Fuzzy Hash: 209a557928cfc01dd566998f27ff4a85640617ccb1ce98424c446766431bf457
Instruction Fuzzy Hash: 3E62AE70900649DFDB14DFA8C988BAEBBF4FF45314F1482A9E415AB2D1DB70AD49CB90

Function 00B04F10 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

GetLocaleInfoW.KERNEL32(?,00000002,00C0438C,00000000), ref: 00B04F81
GetLocaleInfoW.KERNEL32(?,00000002,000000FF,-00000001,00000078,-00000001), ref: 00B04FBD
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 00B05041
PeekMessageW.USER32(?,00000000), ref: 00B05087
TranslateMessage.USER32(00000000), ref: 00B05092
DispatchMessageW.USER32(00000000), ref: 00B05099
MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 00B050AB

Strings

%d-%s, xrefs: 00B04FC7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Message$InfoInit_thread_footerLocaleMultipleObjectsWait$DispatchHeapPeekProcessTranslate
String ID: %d-%s
API String ID: 445213441-1781338863
Opcode ID: 5fc0d1a3e6113551fc526b24015d182f805f3533a0d73df5ec38b2805b7f1a93
Instruction ID: af340122214bc191b1820a1a24cc0cc51934d7891196ed0d22f14f1ead001c73
Opcode Fuzzy Hash: 5fc0d1a3e6113551fc526b24015d182f805f3533a0d73df5ec38b2805b7f1a93
Instruction Fuzzy Hash: 0651FF71A40209ABE710DBA9CC45FAFBBE8EF44724F104269F614A72D1EB719944CBA0

Function 00B1B490 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 161
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00B1B51E
GetLastError.KERNEL32 ref: 00B1B524
GetUserNameW.ADVAPI32(00000000,?), ref: 00B1B56C
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00B1B5A2
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00B1B5EC

Strings

UserDomain, xrefs: 00B1B59D, 00B1B5E7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: EnvironmentNameUserVariable$ErrorLast
String ID: UserDomain
API String ID: 3567734997-2275544873
Opcode ID: a3b79b17be1a14dab7920a7180818d62d85e28979328c9fcbdf84f53b8b44c5c
Instruction ID: 24f177de304b42816a43707a3c89e51498103050a89061e8c8edac6218e3d751
Opcode Fuzzy Hash: a3b79b17be1a14dab7920a7180818d62d85e28979328c9fcbdf84f53b8b44c5c
Instruction Fuzzy Hash: 21611671A00209DBDF14DFA8C969BEEBBF5FF58704F50412DE401A7280DB75AA45CBA1

Function 00B215C0 Relevance: 9.3, APIs: 6, Instructions: 329synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,C310823C,?,?,00000000,?,?,?,?,00BE804D,000000FF,?,00B02B4E), ref: 00B21600
CreateThread.KERNEL32(00000000,00000000,00B21980,?,00000000,?), ref: 00B21636
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00B2173F
GetExitCodeThread.KERNEL32(00000000,?), ref: 00B2174A
CloseHandle.KERNEL32(00000000), ref: 00B2176A

Part of subcall function 009F2A50: RaiseException.KERNEL32(C310823C,C310823C,00000000,00000000,00B2197B,C000008C,00000001,C310823C), ref: 009F2A5C

WaitForSingleObject.KERNEL32(?,000000FF,C310823C,00000000,?,?,00000001), ref: 00B217D4

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CreateObjectSingleThreadWait$CloseCodeEventExceptionExitHandleRaise
String ID:
API String ID: 4001640722-0
Opcode ID: 0e8a30b1ee779a79a737210660b874dddfa37fbd8be4d71558cc290f3414c794
Instruction ID: e6b98f23d99f7ae090a49dcb71fdff8e80538eaacf4644c731cdb000fac4eade
Opcode Fuzzy Hash: 0e8a30b1ee779a79a737210660b874dddfa37fbd8be4d71558cc290f3414c794
Instruction Fuzzy Hash: D1D17C75A006159FCB14CF68D884BAAB7F5FF58310F158699E91AEB3A1DB30EC41CB90

Function 00AA2620 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00AA2661

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

_wcschr.LIBVCRUNTIME ref: 00AA271F

Part of subcall function 009E9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,009F6AC0,-00000010,?,00B21897,00000008,C310823C), ref: 009E9143

LoadLibraryExW.KERNEL32(?,00000000,00000000,-00000010), ref: 00AA2734

Strings

Kernel32.dll, xrefs: 00AA263C, 00AA270F, 00AA2710, 00AA27A4

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem_wcschr
String ID: Kernel32.dll
API String ID: 1122257418-1926710522
Opcode ID: 1a246b36ff1b27e1ca928d68d7ec01b50533ee06504632ae96374e22d7047731
Instruction ID: eaf311276e71c5ba57b995b3750b888222091565fb423b4dc0bfa06ffaf82668
Opcode Fuzzy Hash: 1a246b36ff1b27e1ca928d68d7ec01b50533ee06504632ae96374e22d7047731
Instruction Fuzzy Hash: E0A17AB0501645EFEB14CF68C818BAABBF0FF05318F10865DD4299B6C1D7BAA619CF91

Function 00B0DAE0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00B0DBBA

Strings

\, xrefs: 00B0DB3C
\, xrefs: 00B0DB34
\, xrefs: 00B0DB5E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: c902b09875fe8388551d8defeecd13b7c93085962b57f2593ad0478c53a3f311
Instruction ID: 2d854e1f641aa2e588cf1bea99273282a12dbbb68d3e981d035427942650e7a4
Opcode Fuzzy Hash: c902b09875fe8388551d8defeecd13b7c93085962b57f2593ad0478c53a3f311
Instruction Fuzzy Hash: 6C41B662E1425186CB30DFA48441ABBBBF5FF95354F168AAEE8D8D71C0F76089858386

Function 00B767B8 Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,009F0E77,?,?,009F0C24,?), ref: 00B767BD
HeapAlloc.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B767C4
GetProcessHeap.KERNEL32(00000000,00000000,?,?,009F0C24,?), ref: 00B7680A
HeapFree.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B76811

Part of subcall function 00B76656: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00B76800,00000000,?,?,009F0C24,?), ref: 00B7667A
Part of subcall function 00B76656: HeapAlloc.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B76681

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 6b6d46cb738df21f46bc152c886fe5b0a82daf848443cbc301f3178403ebff10
Instruction ID: ee9962e4701ca820fef721146471e3a01f971c1ea4e37343d12f497947b29ad1
Opcode Fuzzy Hash: 6b6d46cb738df21f46bc152c886fe5b0a82daf848443cbc301f3178403ebff10
Instruction Fuzzy Hash: 72F0B436644F2157CB252BB8BC09A6B3BE5AF84B9571184A9F46AC7644DF30CC01DB61

Function 00AE5370 Relevance: 4.6, APIs: 3, Instructions: 93fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,00000000), ref: 00AE540D
FindClose.KERNEL32(00000000), ref: 00AE546C

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: 33a4ea131b9ba6a5e2e7e460957869bbaf60711c5e115ef8e3ca8abe739e394c
Instruction ID: 67d5b3507af5fcbff61c06bdebdaa4f9ca0071f80c220795db7e7c92c76937a6
Opcode Fuzzy Hash: 33a4ea131b9ba6a5e2e7e460957869bbaf60711c5e115ef8e3ca8abe739e394c
Instruction Fuzzy Hash: 4B31D571D04A54DFDB24DF66D848BAAB7B5EF44318F208199E81A973C0EB709D84CF81

Function 00B03220 Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 4a6040e55299599862685e20557e670589125387e80cc689339748aafec19d07
Instruction ID: ac9d97daedba35c1d12d9b8877d4c2d30dfe26b945f9262d585a6c7497aa86f5
Opcode Fuzzy Hash: 4a6040e55299599862685e20557e670589125387e80cc689339748aafec19d07
Instruction Fuzzy Hash: 4EE16170A00649DFDB14DFA9C888BAEBBF4FF44314F1482A9E415AB3D1DB75AA05CB50

Function 00AE4DA0 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31e04df9dae9fa454c8410db955571b404a50555ded2edcd476c1a3b7a689c2d
Instruction ID: a3bf6bc84c125a5d4c19366c264d239a642ead3e7b4d8206160a73db8841e312
Opcode Fuzzy Hash: 31e04df9dae9fa454c8410db955571b404a50555ded2edcd476c1a3b7a689c2d
Instruction Fuzzy Hash: 80419B30901689DFDB24DF69C998BEDB3A8FF48720F508269E819972D1EB709E04CB50

Function 00B1C8F0 Relevance: 3.1, APIs: 2, Instructions: 86filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,C310823C,C310823C,?,?,?,?,00000000), ref: 00B1C979
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,C310823C,C310823C,?,?,?,?,00000000,00B9EE85), ref: 00B1C99A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: d714de9b605fec83143f8c7ccf6732efd7768cddca8ee88c00bf6bfe82635fc1
Instruction ID: a04715cfbcceee24031bb1d792451748dcff803609f9ef6104fdc89d8c8fb4bc
Opcode Fuzzy Hash: d714de9b605fec83143f8c7ccf6732efd7768cddca8ee88c00bf6bfe82635fc1
Instruction Fuzzy Hash: 42310331A84745AFE731CF24CC01B99BFE4EB01B20F10826EF9A99B6D0DB71A940CB44

Function 00A12530 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00A12548
SetUnhandledExceptionFilter.KERNEL32(00AE17A0), ref: 00A1255E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: d493021ae522eed53dc80a28dcc81565cc4d2fdaa042c6c1dd15b0ea5dd353c6
Instruction ID: 8e3b2cd3ea5a5cabda96ee0999fadfa1d066f39b185280768edfb6c52808ffbd
Opcode Fuzzy Hash: d493021ae522eed53dc80a28dcc81565cc4d2fdaa042c6c1dd15b0ea5dd353c6
Instruction Fuzzy Hash: 6DE07D32A042503EC30093619C0EF0E3F50FB96B10F048459F30C23151C770A841C772

Function 00B27B10 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE3860: __Init_thread_footer.LIBCMT ref: 00AE3940

CoCreateInstance.COMBASE(00C041E8,00000000,00000001,00C20588,000000B0), ref: 00B27B8E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: 26eb32404a96ad38c2b8c1f2e9cbf7ec2eb4763b5f54d6f91eef20bc968dca07
Instruction ID: 7a06e25655fae69bd8fe0da6a7d07660396397230d11f131bf387adba2b3222f
Opcode Fuzzy Hash: 26eb32404a96ad38c2b8c1f2e9cbf7ec2eb4763b5f54d6f91eef20bc968dca07
Instruction Fuzzy Hash: D211ADB1644745EBD720CF59D804B4ABBF8EB05B10F1046AEE8259B7D0D7BAA504CB90

Function 00B22390 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$CreateHeapInstanceProcess
String ID:
API String ID: 3807588171-0
Opcode ID: ae354cdcdec3a84a3383de68d3739542eed3c0a0cf90f5c1cd7824153dfad69a
Instruction ID: a2c0431331be52173ff5b276abcb4d620e0cbd6d2e0614890a9ae2afc0a7ada8
Opcode Fuzzy Hash: ae354cdcdec3a84a3383de68d3739542eed3c0a0cf90f5c1cd7824153dfad69a
Instruction Fuzzy Hash: 2B6168B0500745DFEB21CF65C15839ABBE0FF48318F208A9DD58A9B792D7B5E509CB90

Function 00AE3B70 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00AE3BDE
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00AE3C25
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00AE3C44
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00AE3C73
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00AE3CE8
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 00AE3D51
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00AE3DB4
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00AE3E06
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00AE3EA3
GetProcAddress.KERNEL32(00000000), ref: 00AE3EAA
__Init_thread_footer.LIBCMT ref: 00AE3EBE
GetCurrentProcess.KERNEL32(?), ref: 00AE3EE1
IsWow64Process.KERNEL32(00000000), ref: 00AE3EE8
RegCloseKey.ADVAPI32(00000000), ref: 00AE3F22

Strings

CurrentVersion, xrefs: 00AE3C68
CurrentBuildNumber, xrefs: 00AE3CDD
rs_prerelease, xrefs: 00AE3D71
IsWow64Process, xrefs: 00AE3E99
kernel32, xrefs: 00AE3E9E
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00AE3BD4
BuildBranch, xrefs: 00AE3D46
co_release, xrefs: 00AE3D59
CurrentMinorVersionNumber, xrefs: 00AE3C39
CSDVersion, xrefs: 00AE3DFB
ReleaseId, xrefs: 00AE3DA9
CurrentMajorVersionNumber, xrefs: 00AE3C1A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 1906320730-525127412
Opcode ID: 972dcbabf25ff320abaca1935fd74d821568137bfe45c5a1db7795337310593f
Instruction ID: e67ed06027e12adcd20f404ee91ac85d21567d0b37b5167cd4a82e607d22d917
Opcode Fuzzy Hash: 972dcbabf25ff320abaca1935fd74d821568137bfe45c5a1db7795337310593f
Instruction Fuzzy Hash: 0AA14D71900658EADF20DF21CD49BAEB7F4FB04705F1481EAE549A7190EB74AA84CF94

Function 00AE3F50 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00AE3FC0
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 00AE3FFB
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 00AE4076
RegCloseKey.KERNEL32(00000000), ref: 00AE424E

Strings

SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00AE3FB6
Embedded(Restricted), xrefs: 00AE41A7
ProductSuite, xrefs: 00AE406B
Storage Server, xrefs: 00AE41D5
CommunicationServer, xrefs: 00AE40FB
Small Business, xrefs: 00AE40B0
DataCenter, xrefs: 00AE415F
Blade, xrefs: 00AE4190
ProductType, xrefs: 00AE3FF0
Enterprise, xrefs: 00AE40C9
WinNT, xrefs: 00AE4001
BackOffice, xrefs: 00AE40E2
Security Appliance, xrefs: 00AE41BE
Compute Server, xrefs: 00AE41EC
Personal, xrefs: 00AE4179
EmbeddedNT, xrefs: 00AE4146
Terminal Server, xrefs: 00AE4114
Small Business(Restricted), xrefs: 00AE412D
ServerNT, xrefs: 00AE4024

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 0353f0f231cb82feb97c2438e4ab7a6841b3a895dc3cce3e274effd45a85f7ff
Instruction ID: c87e682d88e707e28819e9ea51f8abe8bfa7276c1959ece523eccf8f8a5bda25
Opcode Fuzzy Hash: 0353f0f231cb82feb97c2438e4ab7a6841b3a895dc3cce3e274effd45a85f7ff
Instruction Fuzzy Hash: 607102B07003889ADF209B66CD50BEE76B8EB59354F104178EA16EB695FB34DD899B00

Function 00B05820 Relevance: 37.0, APIs: 2, Strings: 19, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 00B0589C

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Part of subcall function 009F2A50: RaiseException.KERNEL32(C310823C,C310823C,00000000,00000000,00B2197B,C000008C,00000001,C310823C), ref: 009F2A5C

__Init_thread_footer.LIBCMT ref: 00B058EC

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

Strings

SystemFolder, xrefs: 00B06FEF, 00B07004, 00B0700E
ProgramFiles, xrefs: 00B07810, 00B07825, 00B0782D
ProgramFiles64Folder, xrefs: 00B06EB8
Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86, xrefs: 00B059C3
AppDataFolder, xrefs: 00B07878, 00B078B5
SETUPEXEDIR, xrefs: 00B073FC
Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64, xrefs: 00B05924
SHGetFolderPathW, xrefs: 00B075B7
ProgramFilesFolder, xrefs: 00B07797
WindowsFolder, xrefs: 00B071F4, 00B07209, 00B07213
ProgramW6432, xrefs: 00B06F14
System32Folder, xrefs: 00B0710D, 00B07122, 00B0712C
TempFolder, xrefs: 00B0736F
Shlwapi.dll, xrefs: 00B07727
WindowsVolume, xrefs: 00B072D4, 00B072E9, 00B072F3
PROGRAMFILES, xrefs: 00B078ED
shfolder.dll, xrefs: 00B07586
APPDATA, xrefs: 00B07907, 00B0790F
Shell32.dll, xrefs: 00B07753

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AllocateConditionExceptionHeapRaiseVariableWake
String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFiles64Folder$ProgramFilesFolder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$Shell32.dll$Shlwapi.dll$System32Folder$SystemFolder$TempFolder$Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86$Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 2519272855-3044903971
Opcode ID: 5fc1737ce458d58f0360c6d2a0ed80782dc234054a1d0bff759f2762bb84072e
Instruction ID: c371a11b7b8ed3545d26b64c1ed6bb594fc7cea335aa99b72c5887e46d1b31f2
Opcode Fuzzy Hash: 5fc1737ce458d58f0360c6d2a0ed80782dc234054a1d0bff759f2762bb84072e
Instruction Fuzzy Hash: 1571E671A04A46CBDF20EB68C846BAFBBE0EF10324F1486E9E416976D2E731DD05CB51

Function 00AF7360 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 509
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

GetTickCount.KERNEL32 ref: 00AF73E4
__Xtime_get_ticks.LIBCPMT ref: 00AF73EC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF7436
__Init_thread_footer.LIBCMT ref: 00AF7631
GetCurrentProcess.KERNEL32 ref: 00AF79D3
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00AF79E3
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00AF7A0F
CloseHandle.KERNEL32(00000000), ref: 00AF7A50

Strings

\/:*?"<>|, xrefs: 00AF75F3

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footerProcess$Token$CloseCountCurrentHandleHeapInformationOpenTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 3363527671-3830478854
Opcode ID: e376ecf78c7202dd37188acca49c8fb437f6ed59c25cf2e09509a62b2a7a3ad9
Instruction ID: 0e353e1344568520c8d6a0239f0f705e4f6fc3b2f82632e135588d485b88a4df
Opcode Fuzzy Hash: e376ecf78c7202dd37188acca49c8fb437f6ed59c25cf2e09509a62b2a7a3ad9
Instruction Fuzzy Hash: 0A22BE70904259DFDB10DFA8CC85BAEBBB4FF45304F1481A9E509AB292EB749E44CF91

Function 00AE4FA0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 324
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RemoveDirectoryW.KERNEL32(?,00000000,?,\\?\,00000004,?,00AE5A23), ref: 00AE5043

Part of subcall function 009E9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,009F6AC0,-00000010,?,00B21897,00000008,C310823C), ref: 009E9143

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

RemoveDirectoryW.KERNEL32(00000008,C310823C,00000008,00000000,00000008,00000000,00BDB90D,000000FF,?,00AE5A23), ref: 00AE5072
GetLastError.KERNEL32(?,00AE5A23,?,?,?,?,?,?,?,?,?,?,?,?,00BE8085,000000FF), ref: 00AE5082
DeleteFileW.KERNEL32(?,00000000,?,\\?\,00000004,?,00000000,00BDB90D,000000FF,?,80004005,C310823C,00000008,00000000,00000008,00000000), ref: 00AE5153
GetLastError.KERNEL32(?,C310823C,00000008,00000000,?,00000000,00BDB90D,000000FF,?,80004005,C310823C,00000008,00000000,00000008,00000000,00BDB90D), ref: 00AE5192

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

DeleteFileW.KERNEL32(?,C310823C,00000008,00000000,?,00000000,00BDB90D,000000FF,?,80004005,C310823C,00000008,00000000,00000008,00000000,00BDB90D), ref: 00AE5182
_wcsrchr.LIBVCRUNTIME ref: 00AE5281

Strings

\\?\, xrefs: 00AE5004, 00AE5016, 00AE5020, 00AE5114, 00AE5126, 00AE5130

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: DeleteDirectoryErrorFileHeapInit_thread_footerLastRemove$AllocateFindProcessResource_wcsrchr
String ID: \\?\
API String ID: 3513978327-4282027825
Opcode ID: 5e00e57e03fec2dea082df07b6ea76c056e4e4493af77d018802aedafb4eaf8e
Instruction ID: 66a2df8d91985309e7c848568ee06eac80cb15ed953cffcf25dc2d5274c54b8a
Opcode Fuzzy Hash: 5e00e57e03fec2dea082df07b6ea76c056e4e4493af77d018802aedafb4eaf8e
Instruction Fuzzy Hash: CCA1CE71A01A89DFDB10DBB9D858BAEB7B4EF04325F148669F921D72D1DB319D00CB90

Function 00B7654A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(C310823C,?,?,00B76890,00C85C90,?,?,?,00B22657,00000000,C310823C,?,00B22792), ref: 00B7655C
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,C310823C,?,?,00B76890,00C85C90,?,?,?,00B22657,00000000,C310823C,?,00B22792), ref: 00B76571
DecodePointer.KERNEL32(C310823C,?,?,?,?,?,?,?,?,?,00000000,C310823C,?,00B22792), ref: 00B765ED

Strings

AtlThunk_FreeData, xrefs: 00B765C7
AtlThunk_DataToCode, xrefs: 00B765B0
atlthunk.dll, xrefs: 00B7656C
AtlThunk_AllocateData, xrefs: 00B76582
AtlThunk_InitData, xrefs: 00B76599

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: d793f89fed03a0631b20a62fac50f31407676c80842e96df8601bf74bcf21612
Instruction ID: f64445c8072693fceac66f71ba306b414ff83346780616d9303c627d93710630
Opcode Fuzzy Hash: d793f89fed03a0631b20a62fac50f31407676c80842e96df8601bf74bcf21612
Instruction Fuzzy Hash: 7C01DB71541B18BBCB0567249C07FDA3BD99B21708F0480F0BC1EB72A9DE919A08D696

Function 00B21990 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00AE39A0: __Init_thread_footer.LIBCMT ref: 00AE3A72

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,C310823C,00000000,00000000), ref: 00B219E4
GetTempPathW.KERNEL32(00000104,?), ref: 00B21A79
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00B21AAA
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00B21ADD
CopyFileW.KERNEL32(?,?,00000000), ref: 00B21AFF
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00B21B2E

Strings

shim_clone, xrefs: 00B21A9E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderInit_thread_footerNameRevert
String ID: shim_clone
API String ID: 4264308349-3944563459
Opcode ID: 7e0607ef98c3c6a41d1f5e517450228e806c038e0fe61f2b4cc9ee02c8928ac5
Instruction ID: a4ce4af5bd55610045184bacd5f0d87c4f94233799689e59d5d17b3425654acc
Opcode Fuzzy Hash: 7e0607ef98c3c6a41d1f5e517450228e806c038e0fe61f2b4cc9ee02c8928ac5
Instruction Fuzzy Hash: 5251F970A00228AADB24DF28DC59BAEB7F9EF64700F1444E9E509A71C1DB759F44CB90

Function 00B036B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00B03876
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 00B038D5
SetEndOfFile.KERNEL32(?), ref: 00B038DE
CloseHandle.KERNEL32(?), ref: 00B038F7

Strings

Not enough disk space to extract file:, xrefs: 00B0377A
%sholder%d.aiph, xrefs: 00B03852

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:
API String ID: 22866420-929304071
Opcode ID: e70279e8c3af04ee18692641744e6512224d928073c9140ff902069cfe712f28
Instruction ID: ca071d61c5377b8ce320da7d8c85fb44ca2461d4fb06d1dcd719e76acb49564d
Opcode Fuzzy Hash: e70279e8c3af04ee18692641744e6512224d928073c9140ff902069cfe712f28
Instruction Fuzzy Hash: DD8190B5A002499BDB10DF68CC49BAEBBE8FF44720F148699F915A72D1DB71DE00CB90

Function 00B200C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(00BE7C6D,-00000400,?,00000002,00000400,C310823C,?,?,?), ref: 00B20166
GetLastError.KERNEL32(?,?), ref: 00B20174
ReadFile.KERNEL32(00BE7C6D,00000000,00000400,?,00000000,?,?), ref: 00B2018F

Strings

ADVINSTSFX, xrefs: 00B201C3, 00B2027E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: f9394dd0e1cc1252a112e74373bc0f421b59e8bffbfc65aaddd251c5865c92af
Instruction ID: 7a36f38dd2762103498e99c87d039208a351041b522a1962966e9d205e24be02
Opcode Fuzzy Hash: f9394dd0e1cc1252a112e74373bc0f421b59e8bffbfc65aaddd251c5865c92af
Instruction Fuzzy Hash: 13619071A10229DBDB10DFA4D889BBEBBF6FB55310F2446A9E419B7382D7309D41CB60

Function 00ACEBE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,C310823C,?,?,?,00000000,?,Function_001BEE20,000000FF), ref: 00ACEC23
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00ACEC4C
RegCreateKeyExW.KERNEL32(?,009F7319,00000000,00000000,00000000,?,00000000,00000000,?,C310823C,?,?,?,00000000,?,Function_001BEE20), ref: 00ACEC99
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,?,Function_001BEE20,000000FF), ref: 00ACECAC

Strings

RegCreateKeyTransactedW, xrefs: 00ACEC46
Advapi32.dll, xrefs: 00ACEC1E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-2994018265
Opcode ID: 4a637951fd225c8c3d048a1d499f4e6e5b60df69ee6857288e9ecedf09ecb9a5
Instruction ID: d28224512dbfa033794207141541472f5a89e1b4768b411c0f797ec1b7cd9e39
Opcode Fuzzy Hash: 4a637951fd225c8c3d048a1d499f4e6e5b60df69ee6857288e9ecedf09ecb9a5
Instruction Fuzzy Hash: AB317C72608205EBEB24CF55DC45FAABBA8EB08750F10812AF91597290EB71A850CB94

Function 00AAE0C0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,C310823C,?,?,?,?,?,Function_001BEE20,000000FF,?,00ADFE9C,?,?,000000FF), ref: 00AAE103
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00AAE12C
RegOpenKeyExW.KERNEL32(?,C310823C,00000000,?,00000000,C310823C,?,?,?,?,?,Function_001BEE20,000000FF,?,00ADFE9C,?), ref: 00AAE165
RegCloseKey.ADVAPI32(00000000,?,?,?,Function_001BEE20,000000FF,?,00ADFE9C,?,?,000000FF), ref: 00AAE178

Strings

RegOpenKeyTransactedW, xrefs: 00AAE126
Advapi32.dll, xrefs: 00AAE0FE

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: c72f8fca30d19c221138eb2830c8d959a79d3c264f65bca443fc012fd0d3d39f
Instruction ID: 4e68606650c1e2057b1159d222a591a5e0c2e8896b8738892cf6b40a525f5e16
Opcode Fuzzy Hash: c72f8fca30d19c221138eb2830c8d959a79d3c264f65bca443fc012fd0d3d39f
Instruction Fuzzy Hash: F1218B72604619EFEB25CF55DC44BAABBA8EB59750F00863AF915D7290D771A800CBA0

Function 00AFE0D0 Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 00AFE0F0
GetWindowRect.USER32(00000000,?), ref: 00AFE106
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00AFDEA7,?,00000000), ref: 00AFE11F
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,00AFDEA7,?), ref: 00AFE12A
GetDlgItem.USER32(?,000003E9), ref: 00AFE13C
GetWindowRect.USER32(00000000,?), ref: 00AFE152
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206), ref: 00AFE195

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: f2d1b0c729ce460bdc9578870064b1e086a2375be9c65fbc9aa455ede3113163
Instruction ID: b89325b8e5ef51b876d05410504be0a56b9d542884b43fc3af3f03e4f59c4128
Opcode Fuzzy Hash: f2d1b0c729ce460bdc9578870064b1e086a2375be9c65fbc9aa455ede3113163
Instruction Fuzzy Hash: 61212A71614700AFD300DF24DC49B6FBBE9EF88705F008659F859D62A1E770E9858B56

Function 00B01EA0 Relevance: 9.4, APIs: 6, Instructions: 354fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,C310823C,?,?,00000002,?,?,?,?,?,?,00000000,00BE1942), ref: 00B01EF7
GetLastError.KERNEL32(?,00000002), ref: 00B02189
GetLastError.KERNEL32(?,00000002), ref: 00B02233
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,00BE1942,000000FF,?,00B00E0A,00000010), ref: 00B01F06

Part of subcall function 00AE3200: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,C310823C,?,00000000), ref: 00AE324B
Part of subcall function 00AE3200: GetLastError.KERNEL32(?,00000000), ref: 00AE3255

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 00B01FC8
ReadFile.KERNEL32(?,C310823C,00000000,00000000,00000000,00000001,?,00000002), ref: 00B02045

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: 4198abf35de6036b6439d1d4fc48caf6c96b13d4d1769dc78d4e410acc0fb978
Instruction ID: 822eee4933626ab6f7dde1c82810f21030ade2961e78b61c4142cc665117f0b3
Opcode Fuzzy Hash: 4198abf35de6036b6439d1d4fc48caf6c96b13d4d1769dc78d4e410acc0fb978
Instruction Fuzzy Hash: 00D16171D00209DFDB00DFA8C889BADBBB5FF54314F1482A9E915AB3D2EB749905CB90

Function 00B21E30 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 208COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,C310823C,C310823C,?,?,?,?,00B0485D,?,C310823C,?,00000000,?,00000000,00BE20E5), ref: 00B21E95
GetFileVersionInfoW.KERNELBASE(?,00000000,00000000,?,00000000,?,?,00B0485D,?,C310823C,?,00000000,?,00000000,00BE20E5), ref: 00B21EE3

Strings

ProductName, xrefs: 00B21F43
\VarFileInfo\Translation, xrefs: 00B21F17
\StringFileInfo\%04x%04x\%s, xrefs: 00B21F4D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: 0334609c4e36b41d435600db7abcd011c230670c69d58b493350d9dd3eb3091b
Instruction ID: 6e7bda29b5ff1fb9bee671d6fd75747133630c010033f899ae70d1aba51ed1aa
Opcode Fuzzy Hash: 0334609c4e36b41d435600db7abcd011c230670c69d58b493350d9dd3eb3091b
Instruction Fuzzy Hash: B771AC719011599BCB10DFACD949BAFBBF8FF55310F1485AAF829A7291DB309D04CBA0

Function 00B21D20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B21990: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,C310823C,00000000,00000000), ref: 00B219E4
Part of subcall function 00B21990: GetTempPathW.KERNEL32(00000104,?), ref: 00B21A79
Part of subcall function 00B21990: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00B21AAA
Part of subcall function 00B21990: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00B21ADD

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,C310823C,00000000,?,?,00000000,00BE8105,000000FF,Shlwapi.dll,00B21CD6,?,?,00000010), ref: 00B21D6D
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,00000010), ref: 00B21D99
GetLastError.KERNEL32(?,00000010), ref: 00B21DDE
DeleteFileW.KERNEL32(?), ref: 00B21DF1

Strings

Shlwapi.dll, xrefs: 00B21D20, 00B21D58

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$InfoPathTempVersionWow64$DeleteDisableErrorFolderLastNameRedirectionSize
String ID: Shlwapi.dll
API String ID: 1841109139-1687636465
Opcode ID: fa7e88afdeb0b0708e5d09843e1350554b787529946f95dcddc8e5e419f38f8f
Instruction ID: 439bb284d8bc1a56185752e9a30bbf155dc531dc026b619b4b6584ac5a5f986e
Opcode Fuzzy Hash: fa7e88afdeb0b0708e5d09843e1350554b787529946f95dcddc8e5e419f38f8f
Instruction Fuzzy Hash: 5231A571A04219EBDB10CFA9DC44BEFFBF8EF19750F1445A9E409A3291DB349901CBA0

Function 00AE3320 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,C310823C,00000000,?,00000000), ref: 00AE335E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00AE3381
FreeLibrary.KERNEL32(00000000), ref: 00AE33FF

Strings

ComCtl32.dll, xrefs: 00AE3352
LoadIconMetric, xrefs: 00AE337B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ComCtl32.dll$LoadIconMetric
API String ID: 145871493-764666640
Opcode ID: 3f1641bf298746883c10496a81e714c5c034f5eb4583aa9deb70cff7983720ef
Instruction ID: 123cc508098dc27a309f58267f4b27574cc9105d99fc18e4076a1b77a1cc66b5
Opcode Fuzzy Hash: 3f1641bf298746883c10496a81e714c5c034f5eb4583aa9deb70cff7983720ef
Instruction Fuzzy Hash: F73164B1A00255ABDF148FA5CC44BAFBFF8EF49754F00412AF915A7380DBB58A00CB90

Function 009F291B Relevance: 7.6, APIs: 5, Instructions: 65COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 009F2930
GetWindowLongW.USER32(?,000000FC), ref: 009F2945
CallWindowProcW.USER32(?,?,00000082,?,?), ref: 009F295B
GetWindowLongW.USER32(?,000000FC), ref: 009F2975
SetWindowLongW.USER32(?,000000FC,?), ref: 009F2985

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$CallProc
String ID:
API String ID: 513923721-0
Opcode ID: a1109a852f1d5f6fafdb6d79a44c4aaba5c4a2e4daa3b015e7d8525e23c8bea2
Instruction ID: 0735a4ca5c0ed4c02a1053753debda17414f470a8b4b3f83dbecdf0502c3adbf
Opcode Fuzzy Hash: a1109a852f1d5f6fafdb6d79a44c4aaba5c4a2e4daa3b015e7d8525e23c8bea2
Instruction Fuzzy Hash: B6214971604B00AFC7209F19DD84A6BFBF5FB88720B504A2DF596836B0D772E9909B50

Function 00AE5560 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

PathIsUNCW.SHLWAPI(?,?), ref: 00AE56F6
_wcschr.LIBVCRUNTIME ref: 00AE5712

Strings

\\?\, xrefs: 00AE56D8, 00AE56DE
\\?\UNC\, xrefs: 00AE55F1, 00AE5669, 00AE566F

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$HeapPathProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 660126660-3019864461
Opcode ID: f1c151c1cb344ef0bda0d2430fb8db57c8e0b05d521d8e44867e603ed56c9202
Instruction ID: 66144b16656356d27a2bab11bc50dab29b5b3c5cff8c40e5d07882752dfdafef
Opcode Fuzzy Hash: f1c151c1cb344ef0bda0d2430fb8db57c8e0b05d521d8e44867e603ed56c9202
Instruction Fuzzy Hash: 72C18E71D00A499FDB00DBA9CC45BAEF7B8FF45324F188269E415EB2D1EB749904CBA0

Function 00AFEB80 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 326COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,C310823C,?,00000010,?), ref: 00AFEE4A

Part of subcall function 00B0FD20: GetCurrentProcess.KERNEL32 ref: 00B0FD68
Part of subcall function 00B0FD20: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00B0FD75
Part of subcall function 00B0FD20: GetLastError.KERNEL32 ref: 00B0FD7F
Part of subcall function 00B0FD20: CloseHandle.KERNEL32(00000000), ref: 00B0FE60

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

Part of subcall function 009E9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,009F6AC0,-00000010,?,00B21897,00000008,C310823C), ref: 009E9143

Strings

[WindowsVolume], xrefs: 00AFEC10, 00AFEC22, 00AFEC2C
\\?\, xrefs: 00AFEE57
Extraction path set to:, xrefs: 00AFEE9D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Process$Init_thread_footer$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$[WindowsVolume]$\\?\
API String ID: 699919280-3538578949
Opcode ID: 140d683265683cdbedc8a5bf6ff0594c0d364d44613b6611df0b1c3692f5d43d
Instruction ID: c701075dd8ab89c3a9a73710de5e70bacf5e6a93de78882b883c5f043afc4590
Opcode Fuzzy Hash: 140d683265683cdbedc8a5bf6ff0594c0d364d44613b6611df0b1c3692f5d43d
Instruction Fuzzy Hash: A5C1C270A016499FDB11DFACC884BAEB7B5AF44324F1482A8F515AB2E2DB70DD41CB91

Function 00B1D010 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 224filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,C310823C,?,000000FF,?,?,00000000,00BE7306,000000FF,?,00B1D22A,000000FF,?,00000001), ref: 00B1D04C
GetLastError.KERNEL32(?,?,00000000,00BE7306,000000FF,?,00B1D22A,000000FF,?,00000001), ref: 00B1D056

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

ReadFile.KERNEL32(?,?,00007F90,00000000,00000000,C310823C,?,000000FF,?,?,00000000,00BE7306,000000FF,?,00B1D22A,000000FF), ref: 00B1D0A3

Strings

\\.\pipe\ToServer, xrefs: 00B1D2B4, 00B1D2C5, 00B1D2CF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: d8484b77135e2c09eab3fd5e5c3f2a15d39240398a33c4a05e06a009343ebe12
Instruction ID: 3edef7d5616805662153158072969b5aac53d9fa2b6d03ff5837d13e0421c00e
Opcode Fuzzy Hash: d8484b77135e2c09eab3fd5e5c3f2a15d39240398a33c4a05e06a009343ebe12
Instruction Fuzzy Hash: 3F71CF71604249AFDB14CF69D804BAEB7E8FF48324F10866DE925DB381DB71A940CB90

Function 00AF7060 Relevance: 6.1, APIs: 4, Instructions: 145fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,C310823C,?,00000010,?,00AFA430,?), ref: 00AF70C6
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 00AF710F
ReadFile.KERNEL32(00000000,C310823C,?,?,00000000,00000078,?), ref: 00AF7151
CloseHandle.KERNEL32(00000000), ref: 00AF71CA

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: 73c14957c41cd7aa63132e3346d7ad731ecef99e7e01e5b6873ca71bb65d9cb4
Instruction ID: 89f11f2c465cab695246bbdb9fe0f421fd976b30870945c2cbd1fd992e7b0d8e
Opcode Fuzzy Hash: 73c14957c41cd7aa63132e3346d7ad731ecef99e7e01e5b6873ca71bb65d9cb4
Instruction Fuzzy Hash: 7651AE70904609ABDB11CBA8CC88BEEFBB8EF44324F148359F510AB2E1D7709D49CB64

Function 00B90112 Relevance: 4.7, APIs: 3, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00B902C1

Part of subcall function 00B8EDE7: RtlAllocateHeap.NTDLL(00000000,00000000,00B8E2B4,?,00B90055,?,00000000,?,00B807B5,00000000,00B8E2B4,?,?,?,?,00B8E0AE), ref: 00B8EE19

__freea.LIBCMT ref: 00B902D6
__freea.LIBCMT ref: 00B902E6

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: bc5f686c49e1adb2af4dbfea96ad893bf01c12fa585733bbea789e6a3eb9065e
Instruction ID: 456e146c589fd6bf7894028788202776f570d65c54afac10ce24c6335bbf52ff
Opcode Fuzzy Hash: bc5f686c49e1adb2af4dbfea96ad893bf01c12fa585733bbea789e6a3eb9065e
Instruction Fuzzy Hash: 4C519372610216AFEF25AF64CC89EBF36E9EF44750B1541B9FD18E6150EB70DC109760

Function 00B019D0 Relevance: 4.7, APIs: 3, Instructions: 191fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,C310823C,?,?), ref: 00B01A37
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00B01B44

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 076641be58891e4b5a5b8a88b439a4a2da24f8af8e46829dd6614db203f28b40
Instruction ID: 8f86f679987617f64bb90077fd30787f94075e43b3e3b2588e909240538489a4
Opcode Fuzzy Hash: 076641be58891e4b5a5b8a88b439a4a2da24f8af8e46829dd6614db203f28b40
Instruction Fuzzy Hash: 56615D71D00649AFDB14CFA9C945B9DFBB4FB49320F10826AE825A73D0DB759A14CB90

Function 00AFEF60 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,C310823C,?,00000000,?,80004005,?,00000000), ref: 00AFEFFE
GetLastError.KERNEL32 ref: 00AFF036
GetLastError.KERNEL32(?), ref: 00AFF0CF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 7dc4f7f61b3d368cc392c136289e7d34d62fc2578e5d7c7f95210630df9a2d96
Instruction ID: ed8b149d989fbf2677d3c035283f97eaa04b27f5463cf5178ca81e653056ec07
Opcode Fuzzy Hash: 7dc4f7f61b3d368cc392c136289e7d34d62fc2578e5d7c7f95210630df9a2d96
Instruction Fuzzy Hash: 8551A171A00609DFDB20DFA9DC45BAAF7B1FF44320F148769E619972E1EB31A905CB90

Function 00AE58E0 Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,C310823C,-00000010,?,?,?,00B218AA,00000000,00000008,C310823C), ref: 00AE592B
CreateDirectoryW.KERNEL32(00000000,00000000,?,?,00C13B4C,00000001,?), ref: 00AE59EA
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00BE8085,000000FF,?,00B21989), ref: 00AE59F8

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: ab799d9cfd0530231d7b2daa8e598a071f76f094816a4d87fa010dd56598ca14
Instruction ID: 574a700b5df855919eb2f67250ccd61f4e13566a5325d830e6770b9f6280f9a6
Opcode Fuzzy Hash: ab799d9cfd0530231d7b2daa8e598a071f76f094816a4d87fa010dd56598ca14
Instruction Fuzzy Hash: FF61E131D006499FDB10DFB9D889BADFBF4EF08364F148269E411A72D1EB709904CB60

Function 00B8D7CC Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00B8D7C6,?,00B7BEA2,?,?,C310823C,00B7BEA2,?), ref: 00B8D7DD
TerminateProcess.KERNEL32(00000000,?,00B8D7C6,?,00B7BEA2,?,?,C310823C,00B7BEA2,?), ref: 00B8D7E4
ExitProcess.KERNEL32 ref: 00B8D7F6

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5bdbea904f05fc419c82690e8c2054db977d3fc5ed772726457f986c1a276055
Instruction ID: 74c6fe212f7054a6b470304a411126277b3b27086883c494ffb041437b407a72
Opcode Fuzzy Hash: 5bdbea904f05fc419c82690e8c2054db977d3fc5ed772726457f986c1a276055
Instruction Fuzzy Hash: 80D09232000108BBCF013F69EC0DAAD3FAAEF84751B0080A2B9095B0B2DF319992DB81

Function 00AFF440 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 403COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00AFF85D

Strings

.msi, xrefs: 00AFF831, 00AFF843, 00AFF84B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: _wcsrchr
String ID: .msi
API String ID: 1752292252-299543723
Opcode ID: 623ee19ccea4e9410e7712a52ce5487de504aa498b966acc863f369a722b5cf6
Instruction ID: 887f94cfeb5064c80a0a784968cafd1db8f247b8ad73da7c2ea554d86ee2c9e4
Opcode Fuzzy Hash: 623ee19ccea4e9410e7712a52ce5487de504aa498b966acc863f369a722b5cf6
Instruction Fuzzy Hash: 7CE1BF71A0024EAFDB10DFA8C984BAEBBF5FF44314F148169FA2197291DB74E954CB90

Function 00AF74F0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 326COMMON

Download Yara Rule

APIs

Part of subcall function 00AF7360: GetTickCount.KERNEL32 ref: 00AF73E4
Part of subcall function 00AF7360: __Xtime_get_ticks.LIBCPMT ref: 00AF73EC
Part of subcall function 00AF7360: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00AF7436

Part of subcall function 00B1B490: GetUserNameW.ADVAPI32(00000000,?), ref: 00B1B51E
Part of subcall function 00B1B490: GetLastError.KERNEL32 ref: 00B1B524
Part of subcall function 00B1B490: GetUserNameW.ADVAPI32(00000000,?), ref: 00B1B56C
Part of subcall function 00B1B490: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00B1B5A2
Part of subcall function 00B1B490: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00B1B5EC

__Init_thread_footer.LIBCMT ref: 00AF7631

Strings

\/:*?"<>|, xrefs: 00AF75F3

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: EnvironmentNameUserVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 2099558200-3830478854
Opcode ID: 177bad358ddb1ff3c410c6b5257fa292d55898d2f1b6e3579664a8742eb73293
Instruction ID: f219e3dcb53872e8f3835f5a7c1b692d9dc9a2888fd1289cbb5df2c19af5f77b
Opcode Fuzzy Hash: 177bad358ddb1ff3c410c6b5257fa292d55898d2f1b6e3579664a8742eb73293
Instruction Fuzzy Hash: 8CE1AB70904258DFDB10DFA8C895BEEFBB0BF55304F144298E509AB292EBB45E44CFA1

Function 00AE5C20 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,C310823C), ref: 00AE5DC0

Part of subcall function 00AE5E80: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 00AE5E8D

Strings

USERPROFILE, xrefs: 00AE5C6E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: fd627641e9fd517f68b58fa054959bc7ed7c509041de2b2785bc13f49e4731e8
Instruction ID: 445f2afcdfccbd6f30af335f3b095c861f58e28c9d2d20f3be9588f1405bce02
Opcode Fuzzy Hash: fd627641e9fd517f68b58fa054959bc7ed7c509041de2b2785bc13f49e4731e8
Instruction Fuzzy Hash: 2E619C71A00A89DFDB14DF69DC99BAEB7E4EF44314F14826DE816DB291DB709E00CB90

Function 00A44CB0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 00A44D81

Strings

$, xrefs: 00A44CED

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: LongWindow
String ID: $
API String ID: 1378638983-3993045852
Opcode ID: cccd0c993a8b1a11365bbb588bebd374429949e064c8d7e4e47a5693255c9f62
Instruction ID: bd31493899f1e0626c4be98696e84c1fa6a5ecc0b215f21b071a44f99b4b4ec0
Opcode Fuzzy Hash: cccd0c993a8b1a11365bbb588bebd374429949e064c8d7e4e47a5693255c9f62
Instruction Fuzzy Hash: 8731967A508380DBDB54DF09C880B1ABBF0BFC9711F088559F9948B2A9D3B2D945CB92

Function 00B9444C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B93F7C: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00B93FA7

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00B94293,?,00000000,?,?,?), ref: 00B944AD
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00B94293,?,00000000,?,?,?), ref: 00B944EF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: 3a7c2e819ffcbd6773fcc934e2ddef7114435aeccf956481285b5d010369ae32
Instruction ID: b8c25a10b476b208cf164696a94ee67ae492e8aea945bdd61221b11bab0b445e
Opcode Fuzzy Hash: 3a7c2e819ffcbd6773fcc934e2ddef7114435aeccf956481285b5d010369ae32
Instruction Fuzzy Hash: C751E071A002459FDF21CFB5C881BAABBF9EF55300F1584BED0968B251EB74D946CB90

Function 00B22690 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00B226E1
EndDialog.USER32(00000000,00000001), ref: 00B226F0

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: 1381fb9246b38150b27b02a379f2270abf83c66928e6cfba3c3f8b9aedc0d91a
Instruction ID: 83a12c0b1e326502a3ec40decc3450e0a39e510647ecb991a568bd1584e9c0d4
Opcode Fuzzy Hash: 1381fb9246b38150b27b02a379f2270abf83c66928e6cfba3c3f8b9aedc0d91a
Instruction Fuzzy Hash: 46516670905A85EFDB11CF68C948B4ABBF4EF49310F1482A9E459DB2A1DB70AE04CB91

Function 00AFDE50 Relevance: 3.1, APIs: 2, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00AFD643,00000000), ref: 00AFDE50
DestroyWindow.USER32(?), ref: 00AFDF07

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID:
API String ID: 1182162058-0
Opcode ID: 439c1005810dc372f0a609c60f228d696e106075030a1d33ffb0477a727a123d
Instruction ID: 31082e9c290798d70be43693dd87acbfe92fe86ad595debf0cb11028806390b6
Opcode Fuzzy Hash: 439c1005810dc372f0a609c60f228d696e106075030a1d33ffb0477a727a123d
Instruction Fuzzy Hash: 9321067261010D9BD7219F58EC01BBA77A5EB55321F004226FD05CB691DBB5EC60CBE5

Function 00B20480 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00B204E5
CloseHandle.KERNEL32(?), ref: 00B20539

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID:
API String ID: 10933145-0
Opcode ID: bf5a3767dd3e874d8d61301dd36c2e5f9823c71193d343a90d866cfcf463436f
Instruction ID: 2ac7c2bc17c7c78c530a8ce20f1f632a4741618d6d36512f9a7c1a621738b80c
Opcode Fuzzy Hash: bf5a3767dd3e874d8d61301dd36c2e5f9823c71193d343a90d866cfcf463436f
Instruction Fuzzy Hash: F2217C70600606AFD714DF69EC58B9ABBF8FB04310F10426AE429D73A1DB799904CF94

Function 00AE1F70 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE3320: LoadLibraryW.KERNEL32(ComCtl32.dll,C310823C,00000000,?,00000000), ref: 00AE335E
Part of subcall function 00AE3320: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00AE3381
Part of subcall function 00AE3320: FreeLibrary.KERNEL32(00000000), ref: 00AE33FF

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00AE1FB4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00AE1FBF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: c59ad7b91fad059a78a8a6cc74e1008010578060ffb6c1771f9b7b29aba22d7d
Instruction ID: 2f1e0c476cb66142c48e33089069b21167928bb6dc7fc6d6339c7fd90540066b
Opcode Fuzzy Hash: c59ad7b91fad059a78a8a6cc74e1008010578060ffb6c1771f9b7b29aba22d7d
Instruction Fuzzy Hash: 5AF0303278121837F660215A5C47F6BB64DD781B64F104266FA98AF2C2ECD67D0403D8

Function 00B914D8 Relevance: 3.0, APIs: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,00B90200,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00B9150C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00B90200,?,?,00000000,?,00000000), ref: 00B9152A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: d0b88dc611b5518563eab9f08e6e8136e3c1c33f4e62082ad953d96fe0933c48
Instruction ID: 235766d909e9c31d8a7d4091f621332d9b56c62f8ccaa5620a152b2c6392d73e
Opcode Fuzzy Hash: d0b88dc611b5518563eab9f08e6e8136e3c1c33f4e62082ad953d96fe0933c48
Instruction Fuzzy Hash: 84F0683200011ABBCF126F94DC05ADE3E66EB587A0F068560BA1966020CB32D972EB90

Function 00B8EDAD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00B933ED,?,00000000,?,?,00B9368E,?,00000007,?,?,00B93CE8,?,?), ref: 00B8EDC3
GetLastError.KERNEL32(?,?,00B933ED,?,00000000,?,?,00B9368E,?,00000007,?,?,00B93CE8,?,?), ref: 00B8EDCE

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 59deedc43b3523c23fcc50312037e1abd423d89b6ed061aaf152ce8a33fc0c0d
Instruction ID: cd01eaa56c6de3034eacfe2585ee5046fa20fa1fdb577a89856a83ff3dea571f
Opcode Fuzzy Hash: 59deedc43b3523c23fcc50312037e1abd423d89b6ed061aaf152ce8a33fc0c0d
Instruction Fuzzy Hash: E7E08C32200214ABCB113FB4AC0DBA93BE9EB00792F1480B8F61C971B1DE34C880CB94

Function 00B78832 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B78850
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 00B7885B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptd
String ID:
API String ID: 1660781231-0
Opcode ID: 4bc3d773b515cef655ad4421e89c65e14629695646fa4303b3159ae10eab5871
Instruction ID: 15d5d38980358720dd3fa8e3fa0205754e8939cb8556d8d9338e97a07ee2e0fd
Opcode Fuzzy Hash: 4bc3d773b515cef655ad4421e89c65e14629695646fa4303b3159ae10eab5871
Instruction Fuzzy Hash: CCD0A922AC4380488D283A76288AA9912D49A127F83E0C2DAE03D8E9C2FF1088402617

Function 00B04D00 Relevance: 1.7, APIs: 1, Instructions: 182COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,00B04EE0,?), ref: 00B04D4B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: c07c95866ad8f687c4c228a8e373ccdc4c520ff70c98f7ab38bc3bef99d40899
Instruction ID: 692e4de0da3e6ef525dc79fe10be9735f1a2bdaded49d21fe3451e68ca86ae8c
Opcode Fuzzy Hash: c07c95866ad8f687c4c228a8e373ccdc4c520ff70c98f7ab38bc3bef99d40899
Instruction Fuzzy Hash: CB51B4B19006069FDB24DF68C885BAFBBF4FF48304F0146A9E615A7691E771ED44CB60

Function 00B217A0 Relevance: 1.7, APIs: 1, Instructions: 177synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,C310823C,00000000,?,?,00000001), ref: 00B217D4

Part of subcall function 009F2A50: RaiseException.KERNEL32(C310823C,C310823C,00000000,00000000,00B2197B,C000008C,00000001,C310823C), ref: 009F2A5C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ExceptionObjectRaiseSingleWait
String ID:
API String ID: 2077088295-0
Opcode ID: 19f52ac2e6c11e0458de5ae824a6eae027519b23fafd3efc3345e41cd2ee03ea
Instruction ID: 35c3dd1d1f9948140fe5789942011bf32251392ab48e5c42a653a9b1be21256b
Opcode Fuzzy Hash: 19f52ac2e6c11e0458de5ae824a6eae027519b23fafd3efc3345e41cd2ee03ea
Instruction Fuzzy Hash: 6B516A35A006159FCB14DF6CD894A6AB7F5FF99310F1586A9E819EB3A1CB30EC41CB90

Function 00B94050 Relevance: 1.6, APIs: 1, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00B9429F,00B94293,00000000), ref: 00B94082

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 8a7ec455ff2dc252db4a2e1d6bd3657d96de3dc3e86e188b0165908957b3a98e
Instruction ID: d40cf24b0f2dd839728282d1f43336a350a1b6e9f31de923e67d96926e8ecc7f
Opcode Fuzzy Hash: 8a7ec455ff2dc252db4a2e1d6bd3657d96de3dc3e86e188b0165908957b3a98e
Instruction Fuzzy Hash: 445128B15042689ADF218B28DC80FE67FF8EB56704F2405F9E59AD7142D3319D86DB20

Function 00B03960 Relevance: 1.6, APIs: 1, Instructions: 136fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,C310823C), ref: 00B0398B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1d35b4c12710f680bbbc6ac3f00ceeb45baf639eae0ec3dc3a683363ca77fc69
Instruction ID: 145bb8685121596e08b3752ffc3bcacc09f9f31fea4f62c73feb3b04b15ac8f6
Opcode Fuzzy Hash: 1d35b4c12710f680bbbc6ac3f00ceeb45baf639eae0ec3dc3a683363ca77fc69
Instruction Fuzzy Hash: 18410631A00615DFDB10DF58C885B9EBBF8FF45B10F1082A9E955AB2D1DB70EA00CBA1

Function 00AE3860 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00AE3AD0: __Init_thread_footer.LIBCMT ref: 00AE3B46

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

__Init_thread_footer.LIBCMT ref: 00AE3940

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: f4849daa7bc5bd8278b54ed56dc0d2485b8ee02d04bfa7121018783e46dbc00b
Instruction ID: 01a91635f67ff701d93b7fdcaccb042c0b1a3874da987b942a94c2aec779efbb
Opcode Fuzzy Hash: f4849daa7bc5bd8278b54ed56dc0d2485b8ee02d04bfa7121018783e46dbc00b
Instruction Fuzzy Hash: 0931CEB2548A80EBDB10EF09ED8AB59B7A0F700B14F304369F465477D1F7B6A940CB58

Function 00B20600 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,00000000,00000000,00B029F8,?,00000000,00000000,?,?), ref: 00B2061D

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Part of subcall function 00B206F0: WaitForSingleObject.KERNEL32(?,000000FF,C310823C,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00B20724

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AllocateCreateFileHeapObjectSingleWait
String ID:
API String ID: 1261966429-0
Opcode ID: 2baff0c7f3ea640523172dc1af9d59ca00c87f3a1d33b3405750197bbeaf5cb1
Instruction ID: 2548e856aada239c949e064fd183c99ddb6409ce904fe163e42b2deb5ddf83a1
Opcode Fuzzy Hash: 2baff0c7f3ea640523172dc1af9d59ca00c87f3a1d33b3405750197bbeaf5cb1
Instruction Fuzzy Hash: FD312874214B109FD325EF28D888B1AB7E0FF88300F20895DE59AEB361D771E991CB55

Function 00AC8DC0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

__Init_thread_footer.LIBCMT ref: 00AC8E32

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID:
API String ID: 2296764815-0
Opcode ID: 90895b740488fe9c98786fe73a8af7118a0a7d7bdf99b331ba12d668b609bbcc
Instruction ID: a9e995265bd06b3c58a501201c947433d4ccb0f5128610776a0bf159b746e79d
Opcode Fuzzy Hash: 90895b740488fe9c98786fe73a8af7118a0a7d7bdf99b331ba12d668b609bbcc
Instruction Fuzzy Hash: 8F0188B1948944DBCB14DB58E986B4D73A0F704714F1047BDE82DC7BD0EB35E9049715

Function 00AE3AD0 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

Part of subcall function 00AE3B70: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00AE3BDE
Part of subcall function 00AE3B70: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00AE3C25
Part of subcall function 00AE3B70: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00AE3C44
Part of subcall function 00AE3B70: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00AE3C73
Part of subcall function 00AE3B70: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00AE3CE8

__Init_thread_footer.LIBCMT ref: 00AE3B46

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 329ca51bb6c8897e944d41cff95497e73ab958f07a925948967af226f2f3579c
Instruction ID: e9f5319c733436705a5e40685ecbd40aaa6bdf587b398c366f8d5b185565fcfe
Opcode Fuzzy Hash: 329ca51bb6c8897e944d41cff95497e73ab958f07a925948967af226f2f3579c
Instruction Fuzzy Hash: 0C01DBB1A48644EBCB10EF58ED46B59F3A4E704B24F2043B9E926977D0FB34EA008759

Function 009E9AE0 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B789AB: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,-00000010,?,00000008,C310823C), ref: 00B78A0B

RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: c85e3264c83532225a52691b82e18b421e6d251dea6c9b50e79088fe2f7bbbed
Instruction ID: 1a8a18737cb38aaac3746cc57b45f6829f4d1543bdb8dc9ce0ea387b4bd1d3db
Opcode Fuzzy Hash: c85e3264c83532225a52691b82e18b421e6d251dea6c9b50e79088fe2f7bbbed
Instruction Fuzzy Hash: F5F0A771648248FFC702CF54DC01F6ABBA8FB44B10F10857DF91983B90DB36A800DA45

Function 00B8EDE7 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00B8E2B4,?,00B90055,?,00000000,?,00B807B5,00000000,00B8E2B4,?,?,?,?,00B8E0AE), ref: 00B8EE19

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 81e3e9450aec295d3ea034f5b9307de02ce4b9b99d85b99228a33b7f4e0bed88
Instruction ID: 56c226bf85d189fd2ffcb8485c3169bc4870e00baf37005db7413a9e28d8e8d5
Opcode Fuzzy Hash: 81e3e9450aec295d3ea034f5b9307de02ce4b9b99d85b99228a33b7f4e0bed88
Instruction Fuzzy Hash: 23E0E53110022656E6613A259C04B5B36D9EB053A2F1501E5FC74964F0DB60DC00C7E5

Function 00B8E21C Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00B8E223

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 35aeecfe271a8e60ccccaaf77ec6e46e3784a79996f8ce5bef3f42f2328f51bb
Instruction ID: 60aeafb8d2856b3fc1753331db1f889c07fabb3d58e7dde912d983873c07bd0f
Opcode Fuzzy Hash: 35aeecfe271a8e60ccccaaf77ec6e46e3784a79996f8ce5bef3f42f2328f51bb
Instruction Fuzzy Hash: 80E09AB2C8020E9EDB00EFD4C452BEFB7FCAB04310F6085A6A255E7141EA7457458BA1

Function 009E8720 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 009E872B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 01c7a006b34601c6b37fca681c465ce41a966baa622a69433d9e609896747f07
Instruction ID: 3e847ec860f59280c52423457d0ff78b953f6a9a5d128adbae50f26172d9a8dd
Opcode Fuzzy Hash: 01c7a006b34601c6b37fca681c465ce41a966baa622a69433d9e609896747f07
Instruction Fuzzy Hash: 10C08C3020121047D7304B28B90874332DC5B04700F004409A409D3200CE70DC008654

Non-executed Functions

Function 009E3010 Relevance: 170.0, Strings: 134, Instructions: 2486COMMON

Download Yara Rule

Strings

Options, xrefs: 009E5B5F, 009E5BE0
AI_AppSearchEx, xrefs: 009E5F76, 009E5F9C
3000, xrefs: 009E3BBF, 009E3EAE, 009E3F34, 009E40C6, 009E43EA, 009E4470, 009E44F6, 009E457C, 009E4602, 009E4688, 009E48A0, 009E4ED6, 009E504D, 009E5471, 009E5574
MsiAssembly, xrefs: 009E5825
IniFile, xrefs: 009E47A7, 009E5169
AI_UninstallAccounts, xrefs: 009E5D82
Component, xrefs: 009E3486, 009E384A, 009E3A2C, 009E3C0E
UnregisterProgIdInfo, xrefs: 009E45EF
AppSearch, xrefs: 009E321B, 009E32A4
RemoveIniFile, xrefs: 009E4721
AI_ProcessTasks, xrefs: 009E60ED
RemoveDuplicateFiles, xrefs: 009E4913
Feature, xrefs: 009E3F47, 009E58A2
AI_InstallPostPrerequisite, xrefs: 009E5B85
RegisterMIMEInfo, xrefs: 009E503A
RegisterTypeLibraries, xrefs: 009E545E
AI_UserAccounts, xrefs: 009E5DA8, 009E6096
2000, xrefs: 009E3255, 009E5D18, 009E5D95, 009E5E12, 009E5E8F, 009E6006, 009E6083, 009E6100
1500000, xrefs: 009E55FA
~, xrefs: 009E5B69
UnregisterMIMEInfo, xrefs: 009E4675
RegisterProgIdInfo, xrefs: 009E4FBD
AI_ChainProductsPseudo, xrefs: 009E6276
AI_UserGroups, xrefs: 009E5E25, 009E6019
File, xrefs: 009E3668, 009E49BF, 009E4C4F
3000000, xrefs: 009E51DC
RemoveFolders, xrefs: 009E4A9C
RegisterComPlus, xrefs: 009E555C
AI_XmlInstall, xrefs: 009E5C0B, 009E5C88
InstallServices, xrefs: 009E55E7
ODBCDataSource, xrefs: 009E41E5, 009E52F2
MIME, xrefs: 009E469B, 009E5060
DuplicateFile, xrefs: 009E4939, 009E4D60
MoveFile, xrefs: 009E4BCE
PublishComponent, xrefs: 009E3EC1, 009E579F
AI_PreRequisite, xrefs: 009E5A19, 009E5A9F, 009E5B25, 009E5BAB
RemoveFiles, xrefs: 009E4999, 009E4A1F
SelfRegModules, xrefs: 009E54E4
12000, xrefs: 009E41D2, 009E4258, 009E42DE, 009E4926, 009E49AC, 009E4A32, 009E4AAF, 009E4B35, 009E4E50, 009E52DF, 009E5365, 009E53EB
WriteRegistryValues, xrefs: 009E50BD
15000, xrefs: 009E3FBA, 009E4040, 009E4BBB, 009E4D4D, 009E4F53, 009E5680, 009E588F
120000, xrefs: 009E481A
InstallFiles, xrefs: 009E4C2E
AI_XmlUninstall, xrefs: 009E616A, 009E61F0
ServiceInstall, xrefs: 009E560D
RemoveEnvironmentStrings, xrefs: 009E488D
WriteIniValues, xrefs: 009E5143
100, xrefs: 009E4CC7, 009E4FD0, 009E5F0C
MoveFiles, xrefs: 009E4BA8
100000, xrefs: 009E5989
Extension, xrefs: 009E458F, 009E4F66
AI_XmlAttribute, xrefs: 009E5CAE, 009E6211
RemoveFile, xrefs: 009E4A45
UnregisterFonts, xrefs: 009E4351
AI_Game, xrefs: 009E5D2B, 009E5F1F
AppId, xrefs: 009E4509, 009E4EE9
8000, xrefs: 009E414C, 009E4364, 009E5262, 009E54F7
200000, xrefs: 009E590C
AI_GxInstall, xrefs: 009E5D05
StartServices, xrefs: 009E56F3
1800, xrefs: 009E5C1E, 009E617D
CostInitialize, xrefs: 009E33FD
20000, xrefs: 009E5706
AI_ExtractPrereq, xrefs: 009E5A79
Font, xrefs: 009E4377, 009E5275
InstallInitialize, xrefs: 009E58F9
RegisterClassInfo, xrefs: 009E4EC3
30000, xrefs: 009E3DA1, 009E5156, 009E5812
RemoveRegistry, xrefs: 009E4483
CreateFolders, xrefs: 009E4B22
ODBCDriver, xrefs: 009E42F1, 009E53FE
UnregisterExtensionInfo, xrefs: 009E4569
AI_InstallPrerequisite, xrefs: 009E5AFF
PatchSize, xrefs: 009E4D14
RemoveExistingProducts, xrefs: 009E3034
Shortcut, xrefs: 009E482D, 009E4E63
500, xrefs: 009E5F89
ODBCTranslator, xrefs: 009E426B, 009E5378
800, xrefs: 009E39DD
Registry, xrefs: 009E43FD, 009E50E3
InstallFinalize, xrefs: 009E5976
AI_XmlElement, xrefs: 009E5C31, 009E6190
CreateFolder, xrefs: 009E4AC2, 009E4B48
AI_DownloadPrereq, xrefs: 009E59F3
UnregisterClassInfo, xrefs: 009E44E3
RemoveIniValues, xrefs: 009E46FB, 009E4781
MsiUnpublishAssemblies, xrefs: 009E3D52
RegisterFonts, xrefs: 009E524F
CreateShortcuts, xrefs: 009E4E3D
AI_CountRowAction, xrefs: 009E62F3
ServiceControl, xrefs: 009E3FCD, 009E4053, 009E5719
5000, xrefs: 009E4DD3
PublishComponents, xrefs: 009E5779
Feature_, xrefs: 009E3DF0, 009E45A2, 009E4F77, 009E5836, 009E5A2C, 009E5AB2, 009E5B38, 009E5BBE
InstallValidate, xrefs: 009E398E
FileCost, xrefs: 009E35E4
InstallODBC, xrefs: 009E52CC, 009E5352, 009E53D8
RegisterExtensionInfo, xrefs: 009E4F40
SelfUnregModules, xrefs: 009E4139
TypeLib, xrefs: 009E5484
RemoveRegistryValues, xrefs: 009E43D7, 009E445D
ProgId, xrefs: 009E4615, 009E4FE3
UnregisterComPlus, xrefs: 009E40B3
AI_ScheduledTasks, xrefs: 009E6113
PatchFiles, xrefs: 009E4CB4
10000, xrefs: 009E578C, 009E6383
AI_ProcessGroups, xrefs: 009E5FF3
1500, xrefs: 009E4709, 009E4794, 009E5C9B, 009E6203
Environment, xrefs: 009E48B3, 009E51EF
Location, xrefs: 009E5A53, 009E5AD9
RemoveODBC, xrefs: 009E41BF, 009E4245, 009E42CB
DuplicateFiles, xrefs: 009E4D3A
FileSize, xrefs: 009E4C8E
CostFinalize, xrefs: 009E37AC
AI_DefaultActionCost, xrefs: 009E6370
Component_, xrefs: 009E3ED4, 009E3FE0, 009E4075, 009E40EC, 009E41F8, 009E427E, 009E4318, 009E4410, 009E4496, 009E4734, 009E47BA, 009E4840, 009E48C6, 009E494C, 009E49D2, 009E4AD5, 009E4B5B, 009E4BE1, 009E4C67, 009E4D73, 009E4E76, 009E50F6, 009E517C, 009E5202, 009E5305, 009E538B, 009E5416, 009E5497, 009E559A, 009E5620, 009E56B5, 009E572C, 009E57B2
BindImage, xrefs: 009E4DC0, 009E4DE6
UnpublishComponents, xrefs: 009E3E9B
PublishFeatures, xrefs: 009E587C
UnpublishFeatures, xrefs: 009E3F1C
AI_ProcessAccounts, xrefs: 009E6070
AI_UninstallTasks, xrefs: 009E5E7C
SelfReg, xrefs: 009E415F, 009E550A
RemoveShortcuts, xrefs: 009E4807
6000, xrefs: 009E50D0
MsiPublishAssemblies, xrefs: 009E57FF
MsiConfigureServices, xrefs: 009E566D, 009E5693
ProcessComponents, xrefs: 009E3B70
WriteEnvironmentStrings, xrefs: 009E51C9
Complus, xrefs: 009E40D9, 009E5587
AI_GxUninstall, xrefs: 009E5EF9
Patch, xrefs: 009E4CDA
AI_UninstallGroups, xrefs: 009E5DFF
StopServices, xrefs: 009E3FA7, 009E402D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: 100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$800$8000$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$~
API String ID: 0-2910470256
Opcode ID: 24e248a66dd8565d696773d84f430a272412539db2fdac15f94d04fc67d8de40
Instruction ID: 96a3df4dad2f856812303a7b9394a1bdcb11d92fc05cffad411aec97173b15d5
Opcode Fuzzy Hash: 24e248a66dd8565d696773d84f430a272412539db2fdac15f94d04fc67d8de40
Instruction Fuzzy Hash: D8332BB06443C8EADB46F7E5981971F6A918BA2708F34626CF1442B6D2CFF50E04D7AD

Function 009E3E25 Relevance: 156.9, Strings: 124, Instructions: 1926COMMON

Download Yara Rule

Strings

Options, xrefs: 009E5B5F, 009E5BE0
AI_AppSearchEx, xrefs: 009E5F76, 009E5F9C
3000, xrefs: 009E3EAE, 009E3F34, 009E40C6, 009E43EA, 009E4470, 009E44F6, 009E457C, 009E4602, 009E4688, 009E48A0, 009E4ED6, 009E504D, 009E5471, 009E5574
MsiAssembly, xrefs: 009E5825
IniFile, xrefs: 009E47A7, 009E5169
AI_UninstallAccounts, xrefs: 009E5D82
UnregisterProgIdInfo, xrefs: 009E45EF
RemoveIniFile, xrefs: 009E4721
AI_ProcessTasks, xrefs: 009E60ED
RemoveDuplicateFiles, xrefs: 009E4913
Feature, xrefs: 009E3F47, 009E58A2
AI_InstallPostPrerequisite, xrefs: 009E5B85
RegisterMIMEInfo, xrefs: 009E503A
RegisterTypeLibraries, xrefs: 009E545E
AI_UserAccounts, xrefs: 009E5DA8, 009E6096
2000, xrefs: 009E5D18, 009E5D95, 009E5E12, 009E5E8F, 009E6006, 009E6083, 009E6100
1500000, xrefs: 009E55FA
~, xrefs: 009E5B69
UnregisterMIMEInfo, xrefs: 009E4675
RegisterProgIdInfo, xrefs: 009E4FBD
AI_ChainProductsPseudo, xrefs: 009E6276
AI_UserGroups, xrefs: 009E5E25, 009E6019
File, xrefs: 009E49BF, 009E4C4F
3000000, xrefs: 009E51DC
RemoveFolders, xrefs: 009E4A9C
RegisterComPlus, xrefs: 009E555C
AI_XmlInstall, xrefs: 009E5C0B, 009E5C88
InstallServices, xrefs: 009E55E7
ODBCDataSource, xrefs: 009E41E5, 009E52F2
MIME, xrefs: 009E469B, 009E5060
DuplicateFile, xrefs: 009E4939, 009E4D60
MoveFile, xrefs: 009E4BCE
PublishComponent, xrefs: 009E3EC1, 009E579F
AI_PreRequisite, xrefs: 009E5A19, 009E5A9F, 009E5B25, 009E5BAB
RemoveFiles, xrefs: 009E4999, 009E4A1F
SelfRegModules, xrefs: 009E54E4
12000, xrefs: 009E41D2, 009E4258, 009E42DE, 009E4926, 009E49AC, 009E4A32, 009E4AAF, 009E4B35, 009E4E50, 009E52DF, 009E5365, 009E53EB
WriteRegistryValues, xrefs: 009E50BD
15000, xrefs: 009E3FBA, 009E4040, 009E4BBB, 009E4D4D, 009E4F53, 009E5680, 009E588F
120000, xrefs: 009E481A
InstallFiles, xrefs: 009E4C2E
AI_XmlUninstall, xrefs: 009E616A, 009E61F0
ServiceInstall, xrefs: 009E560D
RemoveEnvironmentStrings, xrefs: 009E488D
WriteIniValues, xrefs: 009E5143
100, xrefs: 009E4CC7, 009E4FD0, 009E5F0C
MoveFiles, xrefs: 009E4BA8
100000, xrefs: 009E5989
Extension, xrefs: 009E458F, 009E4F66
AI_XmlAttribute, xrefs: 009E5CAE, 009E6211
RemoveFile, xrefs: 009E4A45
UnregisterFonts, xrefs: 009E4351
AI_Game, xrefs: 009E5D2B, 009E5F1F
AppId, xrefs: 009E4509, 009E4EE9
8000, xrefs: 009E414C, 009E4364, 009E5262, 009E54F7
200000, xrefs: 009E590C
AI_GxInstall, xrefs: 009E5D05
StartServices, xrefs: 009E56F3
1800, xrefs: 009E5C1E, 009E617D
20000, xrefs: 009E5706
AI_ExtractPrereq, xrefs: 009E5A79
Font, xrefs: 009E4377, 009E5275
InstallInitialize, xrefs: 009E58F9
RegisterClassInfo, xrefs: 009E4EC3
30000, xrefs: 009E5156, 009E5812
RemoveRegistry, xrefs: 009E4483
CreateFolders, xrefs: 009E4B22
ODBCDriver, xrefs: 009E42F1, 009E53FE
UnregisterExtensionInfo, xrefs: 009E4569
AI_InstallPrerequisite, xrefs: 009E5AFF
PatchSize, xrefs: 009E4D14
Shortcut, xrefs: 009E482D, 009E4E63
500, xrefs: 009E5F89
ODBCTranslator, xrefs: 009E426B, 009E5378
Registry, xrefs: 009E43FD, 009E50E3
InstallFinalize, xrefs: 009E5976
AI_XmlElement, xrefs: 009E5C31, 009E6190
CreateFolder, xrefs: 009E4AC2, 009E4B48
AI_DownloadPrereq, xrefs: 009E59F3
UnregisterClassInfo, xrefs: 009E44E3
RemoveIniValues, xrefs: 009E46FB, 009E4781
RegisterFonts, xrefs: 009E524F
CreateShortcuts, xrefs: 009E4E3D
AI_CountRowAction, xrefs: 009E62F3
ServiceControl, xrefs: 009E3FCD, 009E4053, 009E5719
5000, xrefs: 009E4DD3
PublishComponents, xrefs: 009E5779
Feature_, xrefs: 009E45A2, 009E4F77, 009E5836, 009E5A2C, 009E5AB2, 009E5B38, 009E5BBE
InstallODBC, xrefs: 009E52CC, 009E5352, 009E53D8
RegisterExtensionInfo, xrefs: 009E4F40
SelfUnregModules, xrefs: 009E4139
TypeLib, xrefs: 009E5484
RemoveRegistryValues, xrefs: 009E43D7, 009E445D
ProgId, xrefs: 009E4615, 009E4FE3
UnregisterComPlus, xrefs: 009E40B3
AI_ScheduledTasks, xrefs: 009E6113
PatchFiles, xrefs: 009E4CB4
10000, xrefs: 009E578C, 009E6383
AI_ProcessGroups, xrefs: 009E5FF3
1500, xrefs: 009E4709, 009E4794, 009E5C9B, 009E6203
Environment, xrefs: 009E48B3, 009E51EF
Location, xrefs: 009E5A53, 009E5AD9
RemoveODBC, xrefs: 009E41BF, 009E4245, 009E42CB
DuplicateFiles, xrefs: 009E4D3A
FileSize, xrefs: 009E4C8E
AI_DefaultActionCost, xrefs: 009E6370
Component_, xrefs: 009E3ED4, 009E3FE0, 009E4075, 009E40EC, 009E41F8, 009E427E, 009E4318, 009E4410, 009E4496, 009E4734, 009E47BA, 009E4840, 009E48C6, 009E494C, 009E49D2, 009E4AD5, 009E4B5B, 009E4BE1, 009E4C67, 009E4D73, 009E4E76, 009E50F6, 009E517C, 009E5202, 009E5305, 009E538B, 009E5416, 009E5497, 009E559A, 009E5620, 009E56B5, 009E572C, 009E57B2
BindImage, xrefs: 009E4DC0, 009E4DE6
UnpublishComponents, xrefs: 009E3E9B
PublishFeatures, xrefs: 009E587C
UnpublishFeatures, xrefs: 009E3F1C
AI_ProcessAccounts, xrefs: 009E6070
AI_UninstallTasks, xrefs: 009E5E7C
SelfReg, xrefs: 009E415F, 009E550A
RemoveShortcuts, xrefs: 009E4807
6000, xrefs: 009E50D0
MsiPublishAssemblies, xrefs: 009E57FF
MsiConfigureServices, xrefs: 009E566D, 009E5693
WriteEnvironmentStrings, xrefs: 009E51C9
Complus, xrefs: 009E40D9, 009E5587
AI_GxUninstall, xrefs: 009E5EF9
Patch, xrefs: 009E4CDA
AI_UninstallGroups, xrefs: 009E5DFF
StopServices, xrefs: 009E3FA7, 009E402D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: 100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$8000$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$BindImage$Complus$Component_$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileSize$Font$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Patch$PatchFiles$PatchSize$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$~
API String ID: 0-1959677801
Opcode ID: bc88ea03851f92e0a80c0da018db8df2a86e96a5232db8e4a1baaf482c11772f
Instruction ID: a05a432abf9551a3bbd1cc07797da9f2aee3e4ef222fd4b0f7a8774117c790b9
Opcode Fuzzy Hash: bc88ea03851f92e0a80c0da018db8df2a86e96a5232db8e4a1baaf482c11772f
Instruction Fuzzy Hash: BC034CA46443C8E6CB0AF3F5491A75F59524BB3708F3466ACF2952B6D2CEE10F01937A

Function 00A044A0 Relevance: 48.2, APIs: 16, Strings: 11, Instructions: 937memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A044FA
VariantClear.OLEAUT32(?), ref: 00A0452C
VariantClear.OLEAUT32(?), ref: 00A0464F
VariantClear.OLEAUT32(?), ref: 00A0467E
SysFreeString.OLEAUT32(00000000), ref: 00A04685
SysAllocString.OLEAUT32(00000000), ref: 00A046D8
VariantClear.OLEAUT32(?), ref: 00A04766
VariantClear.OLEAUT32(?), ref: 00A04798
VariantClear.OLEAUT32(?), ref: 00A048F9
VariantClear.OLEAUT32(?), ref: 00A0492C
SysFreeString.OLEAUT32(00000000), ref: 00A04937
SysAllocString.OLEAUT32(00000000), ref: 00A0497A
VariantClear.OLEAUT32(?), ref: 00A04A2F
VariantClear.OLEAUT32(?), ref: 00A04A62
SysFreeString.OLEAUT32(00000000), ref: 00A04A70

Strings

MsiPublishEvents, xrefs: 00A04F64
MsiGetBinaryPathIndirect, xrefs: 00A04E9C
MsiEvaluateCondition, xrefs: 00A04C8C
MsiSetProperty, xrefs: 00A04B20
MsiGetBytesCountText, xrefs: 00A050F4
MsiGetFormattedError, xrefs: 00A051D1
GetFontHeight, xrefs: 00A05284
MsiGetBinaryPath, xrefs: 00A04DDA
MsiGetProperty, xrefs: 00A04BCD
MsiResolveFormatted, xrefs: 00A04D27
MessageBox, xrefs: 00A0502C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ClearVariant$String$Free$Alloc
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 4112810936-3153392536
Opcode ID: d0853ccb90ad08cba45f309ba14ad6893ddfc174614f14753b25d4aad684a9d0
Instruction ID: ec02c17349758af6d82d868959c7b262fea7f9d70105382164dea07f87812b10
Opcode Fuzzy Hash: d0853ccb90ad08cba45f309ba14ad6893ddfc174614f14753b25d4aad684a9d0
Instruction Fuzzy Hash: 7D9259B0D0025CDBDB11DFA4C844BDEBBB4FF48314F104299E519A7281EB74AA95CF95

Function 00A03890 Relevance: 33.7, APIs: 22, Instructions: 727memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A038EA
VariantClear.OLEAUT32(?), ref: 00A0391C
VariantClear.OLEAUT32(?), ref: 00A03A16
VariantClear.OLEAUT32(?), ref: 00A03A45
SysFreeString.OLEAUT32(00000000), ref: 00A03A4C
SysAllocString.OLEAUT32(00000000), ref: 00A03A93
VariantClear.OLEAUT32(?), ref: 00A03B17
VariantClear.OLEAUT32(?), ref: 00A03B49
VariantClear.OLEAUT32(?), ref: 00A03C49
VariantClear.OLEAUT32(?), ref: 00A03C7C
SysFreeString.OLEAUT32(00000000), ref: 00A03C87
SysAllocString.OLEAUT32(00000000), ref: 00A03CCD
VariantClear.OLEAUT32(?), ref: 00A03D4A
VariantClear.OLEAUT32(?), ref: 00A03D7C
VariantClear.OLEAUT32(?), ref: 00A03E9C
VariantClear.OLEAUT32(?), ref: 00A03ECB
SysFreeString.OLEAUT32(00000000), ref: 00A03ED2
SysAllocString.OLEAUT32(00000000), ref: 00A03F25
VariantClear.OLEAUT32(?), ref: 00A03FAA
VariantClear.OLEAUT32(?), ref: 00A03FDC
VariantClear.OLEAUT32(?), ref: 00A040CD
VariantClear.OLEAUT32(?), ref: 00A040FA

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: 3b60c413cb7c8fa7972831067b0e6a220aea9e15e0841418fa3321fdf66f432a
Instruction ID: 58ca4873f3d2226c8b6dd0b1a3950bcd2cab1dfe2d6f703b916f09db7142c6ad
Opcode Fuzzy Hash: 3b60c413cb7c8fa7972831067b0e6a220aea9e15e0841418fa3321fdf66f432a
Instruction Fuzzy Hash: C5427B7190024CDFCB11DFA8D888BEEBBB8FF48314F148269E505E7291E7749A45CBA5

Function 009EF1A0 Relevance: 22.9, APIs: 15, Instructions: 376memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 009EF600: EnterCriticalSection.KERNEL32(00C87250,C310823C,00000000,?,?,?,?,?,?,009EEE60,00BA07AD,000000FF), ref: 009EF63D
Part of subcall function 009EF600: LoadCursorW.USER32(00000000,00007F00), ref: 009EF6B8
Part of subcall function 009EF600: LoadCursorW.USER32(00000000,00007F00), ref: 009EF75E

SysFreeString.OLEAUT32(00000000), ref: 009EF243
SysAllocString.OLEAUT32(00000000), ref: 009EF274
GetWindowLongW.USER32(?,000000EC), ref: 009EF34B
GetWindowLongW.USER32(?,000000EC), ref: 009EF35B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 009EF366
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 009EF374
GetWindowLongW.USER32(?,000000EB), ref: 009EF382
SetWindowTextW.USER32(?,00C0438C), ref: 009EF421
GlobalAlloc.KERNEL32(00000042,00000000), ref: 009EF458
GlobalLock.KERNEL32(00000000), ref: 009EF466
GlobalUnlock.KERNEL32(?), ref: 009EF48A
SetWindowLongW.USER32(?,000000EB,00000000), ref: 009EF515
SysFreeString.OLEAUT32(00000000), ref: 009EF52E
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 009EF575
SysFreeString.OLEAUT32(00000000), ref: 009EF595

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID:
API String ID: 4180125975-0
Opcode ID: 067a18af819a00e74e3e08b6123d00582c88980d85d0cfbca757d1a7b92663b3
Instruction ID: d78f9724676e61ed369e7c413fafef7d7d7979a194da886b38fcd0a6e01641fa
Opcode Fuzzy Hash: 067a18af819a00e74e3e08b6123d00582c88980d85d0cfbca757d1a7b92663b3
Instruction Fuzzy Hash: 6ED1E071900649EFDB12DFA5CC58BAFBBB8EF45310F144169F911A7290DB799E00CBA1

Function 009F8DF0 Relevance: 21.6, APIs: 14, Instructions: 608COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 009F8EA3
ShowWindow.USER32(00000000,?), ref: 009F8EC2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 009F8ED0
GetWindowRect.USER32(00000000,?), ref: 009F8EE7
ShowWindow.USER32(00000000,?), ref: 009F8F08
SetWindowLongW.USER32(?,000000EB,?), ref: 009F8F1F

Part of subcall function 009F2A50: RaiseException.KERNEL32(C310823C,C310823C,00000000,00000000,00B2197B,C000008C,00000001,C310823C), ref: 009F2A5C

ShowWindow.USER32(?,?), ref: 009F905D
GetWindowLongW.USER32(?,000000EB), ref: 009F908C
ShowWindow.USER32(?,?), ref: 009F90A9
GetWindowRect.USER32(?,?), ref: 009F90CE

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$LongShow$Rect$ExceptionRaise
String ID:
API String ID: 777556035-0
Opcode ID: 103bee7f6ef122366f8064b9f47d3b999f15a39250d63e5c55e5d85a055121a6
Instruction ID: 5ccc20e56d441d0bf27a24909cb3434271543ac4032fcff7c1b015c0d90599c3
Opcode Fuzzy Hash: 103bee7f6ef122366f8064b9f47d3b999f15a39250d63e5c55e5d85a055121a6
Instruction Fuzzy Hash: 29423671A046189FCB24CFA8D884BAEBBF5FF88304F14855DE959EB260DB30A945CF51

Function 00AECF00 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 419fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 00AED2A2
FindClose.KERNEL32(00000000), ref: 00AED2D0
FindClose.KERNEL32(00000000), ref: 00AED359

Strings

No acceptable version found. Operating System not supported., xrefs: 00AED73B
No acceptable version found., xrefs: 00AED749
No acceptable version found. It must be downloaded manually from a site., xrefs: 00AED734
No acceptable version found. It must be downloaded., xrefs: 00AED72D
No acceptable version found. It must be installed from package., xrefs: 00AED726
No acceptable version found. It is already downloaded and it will be installed., xrefs: 00AED742
Not selected for install., xrefs: 00AED750
An acceptable version was found., xrefs: 00AED71F

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: c7cefdac7baf08775f86048050c27410291e96f22c6ab033bf05525c6836cf33
Instruction ID: 1bd823df7f471f2ce3eb1b876cd9eba8431d5bd4af3a37c5fc5b18f338bb4f90
Opcode Fuzzy Hash: c7cefdac7baf08775f86048050c27410291e96f22c6ab033bf05525c6836cf33
Instruction Fuzzy Hash: 35F18C70A00646CFDB10DF29C9487AEFBF1EF45310F1482A8D9599B392DB349E45CB91

Function 009EEBF0 Relevance: 16.8, APIs: 11, Instructions: 296nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(80070216,000000EC), ref: 009EECDB
GetWindowLongW.USER32(00000000,000000EC), ref: 009EECEB
SetWindowLongW.USER32(00000000,000000EC,00000000), ref: 009EECF6
NtdllDefWindowProc_W.NTDLL(00000000,?,00000001,80070216,?,00000000,?,?,80070216), ref: 009EED04
GetWindowLongW.USER32(00000000,000000EB), ref: 009EED12
SetWindowTextW.USER32(00000000,00C0438C), ref: 009EEDB1
GlobalAlloc.KERNEL32(00000042,00000000,?,00000000), ref: 009EEDE8
GlobalLock.KERNEL32(00000000), ref: 009EEDF6
GlobalUnlock.KERNEL32(?), ref: 009EEE1A
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009EEE7F
NtdllDefWindowProc_W.NTDLL(00000000,?,C310823C,00000000), ref: 009EEED1

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID:
API String ID: 3555041256-0
Opcode ID: 30e681a1a11c452754a7d5844fb6a96cf7a1ed121d0a41585f99232cfc5921c6
Instruction ID: 266435270df596f8be84f3fff003d7f40bc77c0dec5007601d79714ff5d47f70
Opcode Fuzzy Hash: 30e681a1a11c452754a7d5844fb6a96cf7a1ed121d0a41585f99232cfc5921c6
Instruction Fuzzy Hash: 13A1F271901285EBDB12DFA5CC08BAFBBBDEF84310F240618F916A7291DB759D40CBA1

Function 00A062B0 Relevance: 14.5, APIs: 6, Strings: 2, Instructions: 545windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00A06386

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

__Init_thread_footer.LIBCMT ref: 00A0634F

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

SendMessageW.USER32(?,0000104D,00000000,?), ref: 00A0677F
SendMessageW.USER32(?,0000102B,?,?), ref: 00A067C8
SendMessageW.USER32(?,00001003,00000001,?), ref: 00A0684E

Part of subcall function 00AD7EE0: __cftof.LIBCMT ref: 00AD7F2F

SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 00A06994

Strings

AiFeatIco, xrefs: 00A065B5
Icon, xrefs: 00A06662

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake__cftof
String ID: AiFeatIco$Icon
API String ID: 2303580663-1280411655
Opcode ID: 961f9bc8a46c3b2613b44e37f091a74fa578e6d2919ec3659670a4e208420015
Instruction ID: 97f766fd4766880e93c8b00f8a3902ea34c6bda9bbcf54835810a4350a29bdfb
Opcode Fuzzy Hash: 961f9bc8a46c3b2613b44e37f091a74fa578e6d2919ec3659670a4e208420015
Instruction Fuzzy Hash: 0E32CE70900248DFDF25DFA8D884BDDBBB5FF58304F144169E909AF292DB70AA44CBA1

Function 00B0B500 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 394COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

_wcschr.LIBVCRUNTIME ref: 00B0B5AC
_wcsrchr.LIBVCRUNTIME ref: 00B0B68B
_wcsrchr.LIBVCRUNTIME ref: 00B0B6B5
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 00B0B710
GetDriveTypeW.KERNEL32(?), ref: 00B0B72A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00B0B927
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00B0B9B1

Strings

]%!, xrefs: 00B0B6A7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection_wcsrchr$DisableHeapLogicalProcessRevertStringsType_wcschr
String ID: ]%!
API String ID: 1522321474-1069524040
Opcode ID: d2684cad6e3d5d2d889ca34ed6023d9dfe502ed8af4c11ce5c95f09ef923ca0e
Instruction ID: 64d5cc04e9268200e384fd9650add5e9b417fee955b28a18914963a2ef886c0e
Opcode Fuzzy Hash: d2684cad6e3d5d2d889ca34ed6023d9dfe502ed8af4c11ce5c95f09ef923ca0e
Instruction Fuzzy Hash: A7F19C71900659CBDB25DB68C884FADFBF4EF44310F1582E9E51AAB291DB709E84CF90

Function 00A3FAD0 Relevance: 12.3, APIs: 8, Instructions: 289windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000432,00000000,?), ref: 00A3FD0C
SendMessageW.USER32(00000000,00000439,00000000,?), ref: 00A3FD1C
SendMessageW.USER32(00000000,00000421,?,?), ref: 00A3FD2E
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00A3FD3F
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00A3FD52
GetWindowRect.USER32(?,?), ref: 00A3FD80

Part of subcall function 00A41310: CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A4136F
Part of subcall function 00A41310: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,00A3FEE9,00000000,C310823C,?,?), ref: 00A41388

Part of subcall function 009F0E60: SetWindowLongW.USER32(?,000000FC,00000000), ref: 009F0E96

SendMessageW.USER32(00000000,00000412,00000000), ref: 00A3FDE2
SendMessageW.USER32(00000000,00000411,00000001,?), ref: 00A3FDF2

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID:
API String ID: 1954517558-0
Opcode ID: 9c0a76f70daab1018694a4b514722b472c7adf3dcb64304bf75826b7e4a7d81f
Instruction ID: 704851bbc7c53cd5af1d563a25c0492f82a2015f02a6ccc30c386cf3a07fc70d
Opcode Fuzzy Hash: 9c0a76f70daab1018694a4b514722b472c7adf3dcb64304bf75826b7e4a7d81f
Instruction Fuzzy Hash: 2FB1D8B1A10219AFDB04CF69C985AAE7BF5FB48300F40862AFD19E7291D774E954CB90

Function 00AC3460 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 313windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00AC3690
SendMessageW.USER32(?,00000443,00000000), ref: 00AC36FA
MulDiv.KERNEL32(?,00000000), ref: 00AC3731

Strings

NumberValidationTipTitle, xrefs: 00AC34D4
NumberValidationTipMsg, xrefs: 00AC359B
Segoe UI, xrefs: 00AC3708

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSendWindow
String ID: NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 701072176-2319862951
Opcode ID: 4063491eae3fc9be66b461232bf67d88f12e0a47b41301e5cc9d7a96319657bb
Instruction ID: dc08b82d9cef2c192dab1ac3d85e46832ede62a72df8991bc4c6109370d480ee
Opcode Fuzzy Hash: 4063491eae3fc9be66b461232bf67d88f12e0a47b41301e5cc9d7a96319657bb
Instruction Fuzzy Hash: AFC1AC71A00709AFEB14CF64CC55BEEB7B1EB89300F00829DE556A72D1DB74AA45CB91

Function 00B94D50 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

GetACP.KERNEL32(?,?,?,?,?,?,00B8A53E,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B94E11
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00B8A53E,?,?,?,00000055,?,-00000050,?,?), ref: 00B94E3C
_wcschr.LIBVCRUNTIME ref: 00B94ED0
_wcschr.LIBVCRUNTIME ref: 00B94EDE
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B94F9F

Strings

utf8, xrefs: 00B94F0E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 409c2ae364e872fc3c99f02eacf3080ca4a4a01a6bc6ceffb85096bebfba4a4c
Instruction ID: d996656c9caa2e662b959366ba2105d4a88240ff5433729f7829bde2ead8b947
Opcode Fuzzy Hash: 409c2ae364e872fc3c99f02eacf3080ca4a4a01a6bc6ceffb85096bebfba4a4c
Instruction Fuzzy Hash: C871AF75600606ABDF28AB74CC86FAA73E8EF45740F1484F9F619DB191EB70E942C760

Function 00B99D65 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00B99F49

Strings

1#QNAN, xrefs: 00B99E78
1#INF, xrefs: 00B99E9B
1#IND, xrefs: 00B99E6A
1#SNAN, xrefs: 00B99E71

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9fe0aae7e87b31159c20f1c655e96a7a0a8305d0f45a98bb3055d4c51610a269
Instruction ID: 34fb9582dff71867a8c19c5e42e8c149e4b74ef9f41dfa94a7d4ce85e14fe7e0
Opcode Fuzzy Hash: 9fe0aae7e87b31159c20f1c655e96a7a0a8305d0f45a98bb3055d4c51610a269
Instruction Fuzzy Hash: 07D2F571E086298BDF65CE28DD807EAB7F5EB45305F1441EAD40DE7240EB78AE858F81

Function 00AE4A10 Relevance: 9.3, APIs: 6, Instructions: 321fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00AE4A68

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 00AE4B68
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00000000), ref: 00AE4C05
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00AE4C2B
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00AE4C75
_wcsrchr.LIBVCRUNTIME ref: 00AE4CF9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer_wcsrchr$HeapProcess
String ID:
API String ID: 2593539128-0
Opcode ID: 1d21eb3c4e36fb5075f7e6ba04379bdd5c020bca738ce9a5704c1a4750708a30
Instruction ID: 73ca3d3938f985c447267636720b3ee77bc53645522b3caf60d763387b507ef8
Opcode Fuzzy Hash: 1d21eb3c4e36fb5075f7e6ba04379bdd5c020bca738ce9a5704c1a4750708a30
Instruction Fuzzy Hash: C1A1A371A00249DBDB10DF6ACC45BAEB7F8FF88724F24866DE415D7280EB759904CB50

Function 00B208D0 Relevance: 9.2, APIs: 6, Instructions: 203fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,C310823C,?,00000000,00000000), ref: 00B209A1
FindNextFileW.KERNEL32(?,00000000), ref: 00B209BC

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 3f6f4f0d7bf8ac3804fffe9d83821b1e54094d895c690ba68085f22b848b3ff8
Instruction ID: 14080c03830a440043661382c3a2931993256d367f06d0a5c665106387194034
Opcode Fuzzy Hash: 3f6f4f0d7bf8ac3804fffe9d83821b1e54094d895c690ba68085f22b848b3ff8
Instruction Fuzzy Hash: 13716C71901289DFDB10EFA8D948BEEB7B4FF49314F148169E819A7292DB349E44CB50

Function 00B7674C Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00B76668,00000000,?,00B76800,00000000,?,?,009F0C24,?), ref: 00B7674E
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,009F0C24,?), ref: 00B76775
HeapAlloc.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B7677C
InitializeSListHead.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B76789
GetProcessHeap.KERNEL32(00000000,00000000,?,?,009F0C24,?), ref: 00B7679E
HeapFree.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B767A5

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 63c0f64fc1ca72a6c05d2460672a3d26b7c7419326ceb773dfa8aff2afcb2378
Instruction ID: a4b48a8b65a013ae08f8fe5c948b06c8391020fc5fcb2f383d3a1e24fdbe53a6
Opcode Fuzzy Hash: 63c0f64fc1ca72a6c05d2460672a3d26b7c7419326ceb773dfa8aff2afcb2378
Instruction Fuzzy Hash: F7F04931600A11AFEB259F78AC48B2A77E8FB88B56F044468E95AD3250EF70C801CB60

Function 00B954DF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00B957FD,00000002,00000000,?,?,?,00B957FD,?,00000000), ref: 00B95578
GetLocaleInfoW.KERNEL32(?,20001004,00B957FD,00000002,00000000,?,?,?,00B957FD,?,00000000), ref: 00B955A1
GetACP.KERNEL32(?,?,00B957FD,?,00000000), ref: 00B955B6

Strings

OCP, xrefs: 00B95533
ACP, xrefs: 00B954FD

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 53161fe04469354de74d52bc411d3894e963af8a7f2cb5cf1cca661cd76c6d19
Instruction ID: 6568261a9d189aecf1a08911508a2afc86e55bb51ab7c699186cf7cd779aa0ae
Opcode Fuzzy Hash: 53161fe04469354de74d52bc411d3894e963af8a7f2cb5cf1cca661cd76c6d19
Instruction Fuzzy Hash: 4F21B022681905AADF369B24C904BAB73E7EB64B20B5784B4E94AD7212F732DE40C750

Function 00B956B4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00B957C0
IsValidCodePage.KERNEL32(00000000), ref: 00B95809
IsValidLocale.KERNEL32(?,00000001), ref: 00B95818
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00B95860
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00B9587F

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 0e78f454f96b85ac47d251ab9eb78721798643f9882eaff6f93bb6b3f94aedbd
Instruction ID: 2761cf03803b40d3de3bb09330c8194ee050c95050ef30735874728382d4727c
Opcode Fuzzy Hash: 0e78f454f96b85ac47d251ab9eb78721798643f9882eaff6f93bb6b3f94aedbd
Instruction Fuzzy Hash: 44515E71A40A09EBDF22DFA5CC81ABE77F8EF44700F1444B9A515EB251EB749E04CB61

Function 00B8EF3A Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00B8EFC7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 241f84bb112c11c5fb2f49daa3222531d8b45c597fd7bbd776db9f8d97f6aed0
Instruction ID: 524ca6c2a6a38a02d806e736102a489f43d0b8db4492c9427d1fff958bd56d4e
Opcode Fuzzy Hash: 241f84bb112c11c5fb2f49daa3222531d8b45c597fd7bbd776db9f8d97f6aed0
Instruction Fuzzy Hash: 57B12432904256DFDB11EF68C881BFEBBE5EF59310F1481BAE815AB262D235DD01C7A0

Function 00B0C530 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7349945be5f3985e587b4af136563fe222495924c7d24050417ecc301e301785
Instruction ID: ba14b24c432f9d4222abb7699abf959889489cbeb09f9e4ca44cb6a05612be59
Opcode Fuzzy Hash: 7349945be5f3985e587b4af136563fe222495924c7d24050417ecc301e301785
Instruction Fuzzy Hash: 27817CB09012589FDB50DF68CC89BA9BBF4EF45314F1482D9E419AB292DB709E84CF91

Function 00A7AD00 Relevance: 6.1, APIs: 4, Instructions: 91COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,C310823C,?,?,?,?,?,?,00000000,Function_001C889D,000000FF), ref: 00A7AD49
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C889D,000000FF), ref: 00A7AD58
LockResource.KERNEL32(00000000,?,?,?,?,?,?,00000000,Function_001C889D,000000FF), ref: 00A7AD63
SizeofResource.KERNEL32(00000000,?,?,?,?,?,?,?,00000000,Function_001C889D,000000FF), ref: 00A7AD74

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: bb508e6c5fd92cc7a6183c3f85811b6de1b102c07fec1e5203eab0c6e528282b
Instruction ID: 5bc90d1ed647448363c07be7c8c95843b40aa18953525ca9a7240fe7181e1040
Opcode Fuzzy Hash: bb508e6c5fd92cc7a6183c3f85811b6de1b102c07fec1e5203eab0c6e528282b
Instruction Fuzzy Hash: DE31E371D04704ABD7209F74DC05BBFBBB8EB98710F008229E819E3681EF309904C7A2

Function 00A40D5D Relevance: 6.1, APIs: 4, Instructions: 80nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A40DB5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A40DD3
NtdllDefWindowProc_W.NTDLL(?,00000086,?,00000000), ref: 00A40DE5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A40DF7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: 68199cbb6492f786b6eb368348acbce7c208ff956d09e9708102e67fd72fa891
Instruction ID: 80d85bc8d3d22ebc4577d139dc04a8451cfdb9203f3805d7e857ce4a3436a384
Opcode Fuzzy Hash: 68199cbb6492f786b6eb368348acbce7c208ff956d09e9708102e67fd72fa891
Instruction Fuzzy Hash: 0731BA34908219EFCB11CFA8CC84B5DBBF1FF85320F10429AE411AB2E1CBB5A904CB50

Function 00A40C28 Relevance: 6.0, APIs: 4, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A40C40
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A40C5E
NtdllDefWindowProc_W.NTDLL(?,0000000C,?,?,?,000000F0,00000000,?,000000F0), ref: 00A40C71
SetWindowLongW.USER32(FFFFFFFF,000000F0,00000000), ref: 00A40C89

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: b7561dcc8ac04228bd696873be88f7cee1531030dbb4676e6ea8a75bae5af1fe
Instruction ID: a74f319afcdfa904209767a372d30caeb87c0dcdddd2fd3e029449d7932d84f0
Opcode Fuzzy Hash: b7561dcc8ac04228bd696873be88f7cee1531030dbb4676e6ea8a75bae5af1fe
Instruction Fuzzy Hash: 6B110976A04219EFDB159F98DC45B9DBBB1FB88320F21472AF925A73E0CB7159109B40

Function 00A40C9E Relevance: 6.0, APIs: 4, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A40CB5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A40CD3
NtdllDefWindowProc_W.NTDLL(?,00000080,?,?,?,000000F0,00000000,?,000000F0), ref: 00A40CE9
SetWindowLongW.USER32(FFFFFFFF,000000F0,00000000), ref: 00A40D01

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: a78d9adeb569917d0d43cf5aa3338de0d2ad94c9241f8adf9a75887d409ea02b
Instruction ID: 1ab3983e043ce3bb68cb70e38d786cbc4c1402e49aac213a822ed1b1e371b3d8
Opcode Fuzzy Hash: a78d9adeb569917d0d43cf5aa3338de0d2ad94c9241f8adf9a75887d409ea02b
Instruction Fuzzy Hash: BF115B76A04219EFDB119F98DC45B9DBBB1FB88320F20432AF865A33E0CB725910DB40

Function 00B0C930 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 00B0C9EC
FindClose.KERNEL32(00000000), ref: 00B0CB37

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Strings

%d.%d.%d.%d, xrefs: 00B0CAC9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 1673784098-3491811756
Opcode ID: bc333bd592a0c05fe768c96ff55f8719e884f7a971b860b1fe0ab325c74af174
Instruction ID: c4ea779aa5eb8a901ca63a7aca74102ddd2f9fbc1c9974875b894fd47b61b270
Opcode Fuzzy Hash: bc333bd592a0c05fe768c96ff55f8719e884f7a971b860b1fe0ab325c74af174
Instruction Fuzzy Hash: 546139709052599FDB20DF68C849BADBBB4EF44314F1082D9E819AB291DB369E84CF90

Function 009FE540 Relevance: 5.3, Strings: 4, Instructions: 346COMMON

Download Yara Rule

Strings

AI_CONTROL_VISUAL_STYLE, xrefs: 009FE5A8
AI_NO_BORDER_HOVER, xrefs: 009FE68B
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 009FE868
AI_NO_BORDER_NORMAL, xrefs: 009FE610

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: 810489f05d7c15e9453817b0a68c13233b64276de529584900104397c70951cb
Instruction ID: 59f18b8bdf2fb61ec5adc8691258877aacabd2cb7dd2217f9823873fe99dbaf7
Opcode Fuzzy Hash: 810489f05d7c15e9453817b0a68c13233b64276de529584900104397c70951cb
Instruction Fuzzy Hash: 64D1A170D00258DFDB04DFA9C885BADBBB5FF84304F1081A9E455AB395D778AA09CBA1

Function 00B7411D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

VirtualQuery.KERNEL32(80000000,00B74062,0000001C,00B74257,00000000,?,?,?,?,?,?,?,00B74062,00000004,00C858EC,00B742E7), ref: 00B7412E
GetSystemInfo.KERNEL32(?,?,00000000,?,?,?,?,00B74062,00000004,00C858EC,00B742E7), ref: 00B74149

Strings

D, xrefs: 00B7413D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: InfoQuerySystemVirtual
String ID: D
API String ID: 401686933-2746444292
Opcode ID: 0e370ccd7a91954ab64c444a00a03575c02778fa4c782d1f0123e4f3ca825cca
Instruction ID: 0674cbe6a6d1051565642d4b33acb23be00cde27bbb248a0cf772eb950d100e9
Opcode Fuzzy Hash: 0e370ccd7a91954ab64c444a00a03575c02778fa4c782d1f0123e4f3ca825cca
Instruction Fuzzy Hash: 6801D432600109ABCB14EE29DC05BEE7BEDEFD4335F08C260AD6DE7150DB34D9518680

Function 00B76437 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009F3730: InitializeCriticalSectionAndSpinCount.KERNEL32(00C85C5C,00000000,C310823C,009E0000,Function_001BE9A0,000000FF,?,00B76466,?,?,?,009E6508), ref: 009F3755
Part of subcall function 009F3730: GetLastError.KERNEL32(?,00B76466,?,?,?,009E6508), ref: 009F375F

IsDebuggerPresent.KERNEL32(?,?,?,009E6508), ref: 00B7646A
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009E6508), ref: 00B76479

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00B76474

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 5cf392dacb213f923799892e7d697fb725897867f8be28b400efb06e009f27f0
Instruction ID: 16939e30b28cdc36cefb4862be758988a7820658e38f6189d8427098612fb286
Opcode Fuzzy Hash: 5cf392dacb213f923799892e7d697fb725897867f8be28b400efb06e009f27f0
Instruction Fuzzy Hash: 38E092B0200B528BD3749F74E508362BBE4AF04705F00C8ADE59AD3B50DBF4E548CB92

Function 00B95163 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B951B7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B95201
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B952C7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: c3162396b05887f9d64e66c6586fac8b7feb083875302bcce90ea08d076798a9
Instruction ID: 6809b3db95400db77d0b96b6c298353f899b5abb02ee159c45d7ae4eced3924e
Opcode Fuzzy Hash: c3162396b05887f9d64e66c6586fac8b7feb083875302bcce90ea08d076798a9
Instruction Fuzzy Hash: A1617F71594A079FDF3ADF28CC82BAA77E8EF04340F1441B9E906C6282E774D981CB54

Function 00AC8230 Relevance: 4.7, APIs: 3, Instructions: 193fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,C310823C,?), ref: 00AC82FC
FindNextFileW.KERNEL32(000000FF,00000010,?,C310823C,?), ref: 00AC8455
FindClose.KERNEL32(000000FF,?,?,C310823C,?), ref: 00AC84B4

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: b217cd7d6c68d88ce0a76b9e59635833ec298d7daf4164e4eacef8da20a8185a
Instruction ID: 88d228b067f14240ada6985d8f60c07d1037cb55ff425b30a9f2882aa2b3014e
Opcode Fuzzy Hash: b217cd7d6c68d88ce0a76b9e59635833ec298d7daf4164e4eacef8da20a8185a
Instruction Fuzzy Hash: 38819A70D04249DBDB24DFA8C999BEEB7B8BB14304F508298D419A7291DB74AE85CB90

Function 009F89B0 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 009F89FE
GetWindowLongW.USER32(00000004,000000FC), ref: 009F8A17
SetWindowLongW.USER32(00000004,000000FC,?), ref: 009F8A29

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: c055cfa08e0af48216dd0829b9a6fdc22719c60b03c5acc54a4775661ea29533
Instruction ID: f1baaa922e1e22b8f937f7baa1c97c66fad7cc44ccbd3a3ecd9efb84bfaadc1e
Opcode Fuzzy Hash: c055cfa08e0af48216dd0829b9a6fdc22719c60b03c5acc54a4775661ea29533
Instruction Fuzzy Hash: F24172B0601A46EFDB10DF65C908B5AFBF8FF04314F108269E525D7AA0DBB6E914CB91

Function 009FC750 Relevance: 4.6, APIs: 3, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000003,000000FC), ref: 009FC7A6
SetWindowLongW.USER32(00000003,000000FC,?), ref: 009FC7B8
DeleteCriticalSection.KERNEL32(?,C310823C,?,?,?,?,00BA2AE4,000000FF), ref: 009FC7E3

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: LongWindow$CriticalDeleteSection
String ID:
API String ID: 1978754570-0
Opcode ID: 1c8c853fbcf777681b3a7679b118dcddc9d9405e81d6b115b71df7e963709307
Instruction ID: e43b0dd356b7540b4c1f4408cf1806724304cffc8713515cf632f0407f14d62c
Opcode Fuzzy Hash: 1c8c853fbcf777681b3a7679b118dcddc9d9405e81d6b115b71df7e963709307
Instruction Fuzzy Hash: 3A31AFB190464ABBCB11DF68DD44B5ABBF8FF05320F148269F824A76D1D7B1E914CB90

Function 00B7BEA3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00B7BF9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00B7BFA5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00B7BFB2

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d39383fe998b020af81237914364431d845392614fb6b8d61bd4f0fd65ccaa75
Instruction ID: fd2f02d4d6377a9d23f4b63e73e831e75bc3f8098501c67a36dc0ae298d7e980
Opcode Fuzzy Hash: d39383fe998b020af81237914364431d845392614fb6b8d61bd4f0fd65ccaa75
Instruction Fuzzy Hash: C3319775901219ABCB21DF68DD89B9DB7F8EF08710F5081DAE41CA7291EB709B858F44

Function 009F1740 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000FC), ref: 009F1759
SetWindowLongW.USER32(?,000000FC,?), ref: 009F1767
DestroyWindow.USER32(?,?,?,?,?,?,80004003,?,00000001,?,?,00000001,?,?,00C0484C), ref: 009F1793

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: def1dde2529bb84c55f7570705a1f11126a3da94eb5301597d08dfd44f265598
Instruction ID: e30464418a72b6dfcf75f2fcac6f2573aa22b39ab59dbd9ca49e5128f9092d0b
Opcode Fuzzy Hash: def1dde2529bb84c55f7570705a1f11126a3da94eb5301597d08dfd44f265598
Instruction Fuzzy Hash: EFF03031405B11DBD7606F28ED04B967BE5BF44722F008B1DF4AE825E0C774E884DB44

Function 00B867E0 Relevance: 3.4, APIs: 2, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe00726064c4781be53a5f95343334d0c88b69ae3b43e3ddceb108eab983eed0
Instruction ID: 066e5adbfa01f9a49b75937cb055c7675c9fb0d16d97422be6aa6c138fa77793
Opcode Fuzzy Hash: fe00726064c4781be53a5f95343334d0c88b69ae3b43e3ddceb108eab983eed0
Instruction Fuzzy Hash: 0DF11C71E012199FDF14DF69D980AADB7F1FF88314F1582A9E819AB390D730AD05CB90

Function 00A079D0 Relevance: 3.2, APIs: 2, Instructions: 241windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,?), ref: 00A07ABB
SendMessageW.USER32(?,0000102B,0000009B,-00000002), ref: 00A07CA5

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e2c753641847cd6331e324a84a6c835372b7520fb6dd2461354c0b2b9d782a08
Instruction ID: c86998c45bfad47580e50adb1defe2a53286a910de4c0f69ebbb4595ad0aa96d
Opcode Fuzzy Hash: e2c753641847cd6331e324a84a6c835372b7520fb6dd2461354c0b2b9d782a08
Instruction Fuzzy Hash: 79A1C071A0424AAFDB18DF24D995BADFBB5FF45304F148269E81ADB281D734B940CB90

Function 00AFF260 Relevance: 3.1, APIs: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000003,C310823C,00000000,?,00000000), ref: 00AFF34E
FindClose.KERNEL32(00000000,?,00000000), ref: 00AFF399

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f8fdaa7d458f9e66717c5e4478ad7f7731f823334477c926eabc3e73e48af627
Instruction ID: 1bf9ac2796431c7d85d0a9b9cf65948bd9e5bf4209144c49980a60d3ed0f4568
Opcode Fuzzy Hash: f8fdaa7d458f9e66717c5e4478ad7f7731f823334477c926eabc3e73e48af627
Instruction Fuzzy Hash: F851B370900649DFEB21DFA8C848BAEBBF4FF44314F104269E925AB381D7749A04CF90

Function 00AE3200 Relevance: 3.1, APIs: 2, Instructions: 105windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,C310823C,?,00000000), ref: 00AE324B
GetLastError.KERNEL32(?,00000000), ref: 00AE3255

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 80afa0118e60256fcb979072d80f64b0fb9de30a37a5853f22583b68cd2efcc9
Instruction ID: 8e2812f2e53d5cf724ce830d56f783b34b2c0c7ce67e0d2ae91687d5a2fb1759
Opcode Fuzzy Hash: 80afa0118e60256fcb979072d80f64b0fb9de30a37a5853f22583b68cd2efcc9
Instruction Fuzzy Hash: DB31C372A00249ABDB10DF99DC09BAEBBF8EF44714F10412EE519E73C0DBB59A008B91

Function 00A40110 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 00A4017F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 00A4018D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7d9e1f7955d3870e2f02c894bc8731ac9ca2369e9ba458168764755700135e29
Instruction ID: 5819f40378f3c91f703edf6220ec670a39d3e9e462c718968d94af7b2087ccdd
Opcode Fuzzy Hash: 7d9e1f7955d3870e2f02c894bc8731ac9ca2369e9ba458168764755700135e29
Instruction Fuzzy Hash: B9318771901605EFCB10DF69C984B9EFBF4FB44720F148369E425AB6D1D771AA50CB90

Function 00B0F8A0 Relevance: 3.1, APIs: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,C310823C,?,00000000,00000000,00000000,00BE45DD,000000FF), ref: 00B0F908
FindClose.KERNEL32(00000000,?,C310823C,?,00000000,00000000,00000000,00BE45DD,000000FF), ref: 00B0F952

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: a1e794084643f9ab0197aa63fd8035a23d284c829ddce4403d4ea4a42a16d669
Instruction ID: cf58d1f449fc134102563fca4f58c46541fc24360f7ecfedded4285081fd43d6
Opcode Fuzzy Hash: a1e794084643f9ab0197aa63fd8035a23d284c829ddce4403d4ea4a42a16d669
Instruction Fuzzy Hash: 7921B271900549DFDB20DF68CC49BEEBBB8FF44724F104269E825972D0DB309A08CB90

Function 00B763AD Relevance: 3.0, APIs: 2, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00B75DF9,?,?,?,?,00AF73F1), ref: 00B763C6
GetSystemTimeAsFileTime.KERNEL32(?,00000000,?,00B75DF9,?,?,?,?,00AF73F1), ref: 00B763CA

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Time$FileSystem$Precise
String ID:
API String ID: 743729956-0
Opcode ID: 2671a937df6a8430f9ee23d1a14ced1bf8ac384101b080690d928fddc12d6269
Instruction ID: af75e193296c9064d79c93ae40f510e87f61c44ee137627900ad1f6d47d432cd
Opcode Fuzzy Hash: 2671a937df6a8430f9ee23d1a14ced1bf8ac384101b080690d928fddc12d6269
Instruction Fuzzy Hash: 64D01232541938F78A012F9DEC486FD7B98EB08B617058051F91957160CFA15C51DFD9

Function 00A15680 Relevance: 1.9, Strings: 1, Instructions: 614COMMON

Download Yara Rule

Strings

2, xrefs: 00A15901

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 0437e34b730eec8d2fb3705a567f45550560cd8cf97c07d38687c4c42e26a72c
Instruction ID: 8baff233ef38e53a8d4c0d08e66b8098a301af3cf80205a95981e55267df256f
Opcode Fuzzy Hash: 0437e34b730eec8d2fb3705a567f45550560cd8cf97c07d38687c4c42e26a72c
Instruction Fuzzy Hash: 9A32AFB1A047558BCB14DF66D9815ABB7E6AFD4308F00493EF4CBC7281E635E988C792

Function 00B919A0 Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00B9199B,?,?,00000008,?,?,00B9CAFF,00000000), ref: 00B91BCD

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 2a8c67717f26abe38587455c8387f953ff6fe65428aebd0f677e162c59a5f91d
Instruction ID: caaccf8d69f98935595098d94b804b871e182999fe532777edc3899e58b2e614
Opcode Fuzzy Hash: 2a8c67717f26abe38587455c8387f953ff6fe65428aebd0f677e162c59a5f91d
Instruction Fuzzy Hash: 62B14D3121060A9FDB14CF2CC486B647BE1FF05365F258AA8E899CF2A1C335ED92DB40

Function 00B953B6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00B9540A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: d334256b60c2977a7742442f795f74157c10661a7e51d2c1b5afb942e9f61d18
Instruction ID: 910ba0aa29a723d0d4cb323a5d4b7acd05b33fc49d1d8e1eaa4fd71eb2f464f9
Opcode Fuzzy Hash: d334256b60c2977a7742442f795f74157c10661a7e51d2c1b5afb942e9f61d18
Instruction Fuzzy Hash: 0D21AC32651606ABDF39AB25DC42BBA73ECEB44306B1040BAED06C6355EA34E981CB50

Function 00B9503D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

EnumSystemLocalesW.KERNEL32(00B95163,00000001,00000000,?,-00000050,?,00B95794,00000000,?,?,?,00000055,?), ref: 00B950AF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4159b73421dc43cd3dfcd512d6f2830df30672791f34bfa4d7b8250bf5c4ddef
Instruction ID: 336dd5b6b29a65da6e9873e0032b42756523949e3ea59d2e496abd3f1b3354cd
Opcode Fuzzy Hash: 4159b73421dc43cd3dfcd512d6f2830df30672791f34bfa4d7b8250bf5c4ddef
Instruction Fuzzy Hash: 891129366007059FDF289F39C8956BAB7D1FF80358B14443CE58687A40E371B902CB80

Function 00B955E5 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00B9537F,00000000,00000000,?), ref: 00B95611

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: b9347516614c371b45a14dd9453d7aa84fc0d0d1c483802dbf53a7595204c430
Instruction ID: d8f33ce94e15bff7a73257c77251e0e020ed053700765e0c4c5d2912d46042d7
Opcode Fuzzy Hash: b9347516614c371b45a14dd9453d7aa84fc0d0d1c483802dbf53a7595204c430
Instruction Fuzzy Hash: DEF0F432A40512BBDF395F24C809BBA77E8EB40754F4444B8EC16B3180EA70FE01CB90

Function 00B94F4B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00B94F9F

Strings

utf8, xrefs: 00B94F0E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 9a00dc22e82f65b3587d88a40db6898db02c900d3cfbfabfc6bf1cad6d44ee2d
Instruction ID: d78dadacf26cfa6b8ac589fd1122cf21681d40fc0ddef51666a3bbf7fc38dac5
Opcode Fuzzy Hash: 9a00dc22e82f65b3587d88a40db6898db02c900d3cfbfabfc6bf1cad6d44ee2d
Instruction Fuzzy Hash: 5AF02832A00105ABCB24EB74DC49FFE33ECDB44715F0041B9B616D7241EA34AD05C750

Function 00B950D8 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

EnumSystemLocalesW.KERNEL32(00B953B6,00000001,00000000,?,-00000050,?,00B95758,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00B95122

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 8eabc120ae7505b0632d7b7b6c86d01ecee249bcc3ff16e1319ffc5035951da1
Instruction ID: fae1569611bb1f2bab225e3a375ce065c4710e28c9ce8639ddd540eafbd17925
Opcode Fuzzy Hash: 8eabc120ae7505b0632d7b7b6c86d01ecee249bcc3ff16e1319ffc5035951da1
Instruction Fuzzy Hash: EFF022362407046FCB25AF349C81A7A7BD1EB80368F0480BDF9454B690D6B1AC02CB50

Function 00B90DD9 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8BA2A: EnterCriticalSection.KERNEL32(-00C86108,?,00B8DFE9,009E9F26,00C7A8F8,0000000C,00B8E2B4,?), ref: 00B8BA39

EnumSystemLocalesW.KERNEL32(00B90DCC,00000001,00C7AA38,0000000C,00B911FB,00000000), ref: 00B90E11

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2ca2b8e9f18cf238d4e663b3bde8bad95fb775dab97e4eda61ebcc663a2b7520
Instruction ID: 37d0119403b01ff1cb96de63a32b61260a9531ae0aae382c31708a2b1f48c9b3
Opcode Fuzzy Hash: 2ca2b8e9f18cf238d4e663b3bde8bad95fb775dab97e4eda61ebcc663a2b7520
Instruction Fuzzy Hash: BEF03772A10205DFDB00EF98E842BAC77F0EB48721F10816AE4199B2E0DB75A900CB50

Function 00B94FF2 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00B8EA06: GetLastError.KERNEL32(?,00000008,00B90623), ref: 00B8EA0A
Part of subcall function 00B8EA06: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00B8EAAC

EnumSystemLocalesW.KERNEL32(00B94F4B,00000001,00000000,?,?,00B957B6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00B95029

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: c0fec690795edbfe2711b579c8b40e0b1055b800e1f0b7d710e6ce44cf1e0212
Instruction ID: 72269581e419c53148797e98b7a485d8ac1bd893abce3ff22c19208c3b0f9fbc
Opcode Fuzzy Hash: c0fec690795edbfe2711b579c8b40e0b1055b800e1f0b7d710e6ce44cf1e0212
Instruction Fuzzy Hash: 2DF0E53634020597CF15AF35D859B7A7FD4EFC2754B0640AAEA098B651D671D843C790

Function 00A018D0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,009FFFA7,?,?,?,?,?,?,?,?,009FFE18,?,?), ref: 00A01920

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 3aa60a042df92e1e300a5d523d58fbab3c0b6e9b056439fb42b7cf4ba8d0e6eb
Instruction ID: 8fe12af67a44e377f32076e006bb24f59c1b6ef9881fc05ba2dff0ee075386de
Opcode Fuzzy Hash: 3aa60a042df92e1e300a5d523d58fbab3c0b6e9b056439fb42b7cf4ba8d0e6eb
Instruction Fuzzy Hash: EBF0A034105149DFE3008B68E868BE9BBB6FB44392F8845F5F088CA5A5C339CE86DF10

Function 00B91356 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00B8B0A4,?,20001004,00000000,00000002,?,?,00B8A6A6), ref: 00B9138A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2af3550651b8dae0f180bae4d17057c1b36dc55e2fe529a8775698810887ce90
Instruction ID: 3d41f1e248f823d7b6d8673ab39f6e6a29e0f31f4249ce0904072ca31e5a00a2
Opcode Fuzzy Hash: 2af3550651b8dae0f180bae4d17057c1b36dc55e2fe529a8775698810887ce90
Instruction Fuzzy Hash: EEE04F31500219BBCF126F64DC08BAE7E6AEF54760F014460FD1967121CB319921EAA4

Function 00ABC150 Relevance: .5, Instructions: 507COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fb43549432997741116e403d14c89ab7e5dcc9d76added99d5e61c2ba0ce9d
Instruction ID: 00b1924340ec8d90b2d41ec54cbabcb5745dc24bf652063f23ce85535353dcb3
Opcode Fuzzy Hash: 48fb43549432997741116e403d14c89ab7e5dcc9d76added99d5e61c2ba0ce9d
Instruction Fuzzy Hash: 3302B671A006159FCB19DF68D885BEEB7B9FB48720F14822DE819E7391E730AD45CB90

Function 00B7F7DC Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 802826c450b7aed92c1c1b6f2de402fb93419228651b4b5d7d99f5a7a437350a
Instruction ID: 4cca4556117b5bcdef0f14edc44281c096cb92dc64673cf2b2faadf9832e91be
Opcode Fuzzy Hash: 802826c450b7aed92c1c1b6f2de402fb93419228651b4b5d7d99f5a7a437350a
Instruction Fuzzy Hash: 20E19E70A00606CFCB24DF68C590A7AB7F2FF48314B2485A9D56E9B3A1D730ED46CB59

Function 009EF7D0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e761c63ae77c1e56d450b6790d2afc60be8ec5c9d74bc96c7f62caba62ab4b8
Instruction ID: da722a009e9c05500e1e057525ceb24d71665f34363807f2b19db330e39b24f0
Opcode Fuzzy Hash: 0e761c63ae77c1e56d450b6790d2afc60be8ec5c9d74bc96c7f62caba62ab4b8
Instruction Fuzzy Hash: 047108B1801B48CFE761CF78C94478ABBF0BB05324F14865DD4A99B3D1D3B96648CB91

Function 00A88100 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa6513618f84b29fb0afd42887642603218ee0972d9ddf2b9523b54f9836a910
Instruction ID: 3c02e309d2cef5368f36ec3739e58fae5b71588d194ead1b7ea1c2895655de6e
Opcode Fuzzy Hash: aa6513618f84b29fb0afd42887642603218ee0972d9ddf2b9523b54f9836a910
Instruction Fuzzy Hash: 8541F4B0901B49EED704CF69C50878AFBF0BB09318F20825DD4589B781D3BAA659CFD5

Function 009F8840 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1961e6a52c37aba6845aea9378e43d08788ab94f4f8307c3f281151fecd29e00
Instruction ID: 6e6ff8710d936fc3555042d838564c3f561113759d00ab612c72fdb5d1446217
Opcode Fuzzy Hash: 1961e6a52c37aba6845aea9378e43d08788ab94f4f8307c3f281151fecd29e00
Instruction Fuzzy Hash: 6031CFB0405B84CEE721CF29C55834BBFF0BB15718F108A4DD4A64BB91C3BAA648CB91

Function 009F2330 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c599d5e5b81bb649a13b5fcd33d3050b64d06fce9628d546871b468084a51b17
Instruction ID: 18145a8b7b77245c82edc26564fefe01055b9ddb16767287d16805cf68a3fb5b
Opcode Fuzzy Hash: c599d5e5b81bb649a13b5fcd33d3050b64d06fce9628d546871b468084a51b17
Instruction Fuzzy Hash: 37216AB1804748DFD710CF58C94478ABBF4FB09314F1186AED4559B791E3B9AA44CF90

Function 009F1D70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67ecb4f79991fe185c64cd2149fbdf408fa46c9ec593ccd6c6846592bae87b90
Instruction ID: fa230d72cfb105465ae18e0501a43d4ef3074b1ba7bef38e828458db887c8bd1
Opcode Fuzzy Hash: 67ecb4f79991fe185c64cd2149fbdf408fa46c9ec593ccd6c6846592bae87b90
Instruction Fuzzy Hash: C72158B1804788DFD710CF58C944B8ABBF4FB09324F1186AED455AB791E3B9AA44CB90

Function 00A0D760 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a12222f5635aa252b36b316acd6c05434fe27fd0917eee643142220373912c3
Instruction ID: a884b90906fe3125d5fed7fdd64869b89ea467dc18bc3853a388a192c5865e34
Opcode Fuzzy Hash: 4a12222f5635aa252b36b316acd6c05434fe27fd0917eee643142220373912c3
Instruction Fuzzy Hash: 93110CF1905648DFCB40CF58D544789BBF4FB09328F2086AEE8189B381D3769A06CF84

Function 00B98A0E Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction ID: 53ba974ce3752116f4e0352ddbf9550ee2c000f08e1f2145006e2f4a634dbeca
Opcode Fuzzy Hash: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction Fuzzy Hash: 2FE08C32911278EBCB25DB9CC904D8AF3ECEB45B80B1104ABF501D3200C670DE00D7D0

Function 00B8D840 Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 196375293714f82e9c99ca5bb7d726515ed7690d3670f28b5cdcddecd6e68249
Instruction ID: f318d2e8fa5d7a992a646aee8728ace83bf8a04688f51c98adf3a8008d4655bf
Opcode Fuzzy Hash: 196375293714f82e9c99ca5bb7d726515ed7690d3670f28b5cdcddecd6e68249
Instruction Fuzzy Hash: 5BC08C3440094047CE29BA1082713A433E7F393782F8005CEC41B0BAA3DD5EDC82E700

Function 00ACB0F0 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 238libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

GetModuleHandleW.KERNEL32(kernel32,C310823C,?,?,00000000), ref: 00ACB1F3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00ACB23B
__Init_thread_footer.LIBCMT ref: 00ACB24E
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 00ACB296
__Init_thread_footer.LIBCMT ref: 00ACB2A9
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00ACB2F1
__Init_thread_footer.LIBCMT ref: 00ACB304

Part of subcall function 00AA2620: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00AA2661
Part of subcall function 00AA2620: _wcschr.LIBVCRUNTIME ref: 00AA271F

Strings

@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00ACB180, 00ACB18F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00ACB187
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00ACB167, 00ACB16F
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00ACB162
SetDllDirectory, xrefs: 00ACB290
kernel32, xrefs: 00ACB1EE
SetDefaultDllDirectories, xrefs: 00ACB2EB
SetSearchPathMode, xrefs: 00ACB235
kernel32.dll, xrefs: 00ACB44D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$DirectoryHandleHeapModuleProcessSystem_wcschr
String ID: @echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$kernel32$kernel32.dll
API String ID: 1258094593-3455668873
Opcode ID: 5c94a62b43343b7361c27f18118e012e51a43582277e07eefbc12cc7405a9236
Instruction ID: 8428b82deea2a6ee0afaec0a4f63068873fb68818c9575cadd6d92098192c519
Opcode Fuzzy Hash: 5c94a62b43343b7361c27f18118e012e51a43582277e07eefbc12cc7405a9236
Instruction Fuzzy Hash: 82A14BF09082199FDF10DF94D889BDEBBB4EF06318F504299E4196B380DBB15988DFA5

Function 00AEE980 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 167COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(?,C310823C,?,?,?,00BDD4D5,000000FF,?,00B2127F,?,?,?,00000000), ref: 00AEEB18
GetActiveWindow.USER32 ref: 00AEEA7A

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

Strings

.mst, xrefs: 00AEF5D7, 00AEF63E, 00AEFAFE
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 00AEFBD3
TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 00AEF6F7
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00AEFB1F
.msi, xrefs: 00AEF587, 00AEFA80
TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 00AEF750
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 00AEF73F
AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00AEF9D5
%s , xrefs: 00AEF88C, 00AEFBC1
majorupgrade-content.mst, xrefs: 00AEF596, 00AEFA8F
MSINEWINSTANCE=1 , xrefs: 00AEF726
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00AEF658
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00AEF5F2

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$ActiveDebugHeapOutputProcessStringWindow
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $.msi$.mst$majorupgrade-content.mst
API String ID: 758407959-743168453
Opcode ID: 2fb5306d45cd95c8cb5531befa1b0631fcd67256b511c4a618cb92d218041658
Instruction ID: 6f9f47e84f49449dbcfa30d8d726a2b451ac5e4a5537aa183aeefbb6f6b26dc5
Opcode Fuzzy Hash: 2fb5306d45cd95c8cb5531befa1b0631fcd67256b511c4a618cb92d218041658
Instruction Fuzzy Hash: 9C51E075A002459FDB11DB6DC8447AEBBF5EF45321F1482ADE816AB391EB309D00CB91

Function 009F17A0 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 361stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 009F1840
GetParent.USER32(?), ref: 009F1881
lstrcmpW.KERNEL32(?,#32770), ref: 009F18A1

Strings

#32770, xrefs: 009F1898

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ParentWindowlstrcmp
String ID: #32770
API String ID: 3676684576-463685578
Opcode ID: 87b385d943bdd015b529528c963f836399f9aecc845890a1731cec84423bd665
Instruction ID: bfd9a33b076415cd107f69795765d8665f1417368d1bdcd67688c8c7c967221a
Opcode Fuzzy Hash: 87b385d943bdd015b529528c963f836399f9aecc845890a1731cec84423bd665
Instruction Fuzzy Hash: E0E17C74A00219EFDB15CFA8C844BBDBBB9EF49714F148159F901AB2A0DB75AD44CBA0

Function 00A1DAD0 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,C310823C,?,?,00000000,?,?,?,?,?,?,C310823C,00BA9E15,000000FF), ref: 00A1DB3D
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A1DB43
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,C310823C,00BA9E15,000000FF,?,00A345FA,00C0C86C,C310823C,C310823C), ref: 00A1DB73
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A1DB79

Strings

CoIncrementMTAUsage, xrefs: 00A1DB69
DllGetActivationFactory, xrefs: 00A1DCF2
RoGetActivationFactory, xrefs: 00A1DB33
.dll, xrefs: 00A1DC96
combase.dll, xrefs: 00A1DB38, 00A1DB6E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2454113998
Opcode ID: dd3b7cbb8e0144d9f252cd8ac04103ee6a4171472c042f217176a654b5351b6c
Instruction ID: ddee9cebf71c607191884a0fa6e96f0d6e05aca0b04d5a01b8c3301be0bc3d6d
Opcode Fuzzy Hash: dd3b7cbb8e0144d9f252cd8ac04103ee6a4171472c042f217176a654b5351b6c
Instruction Fuzzy Hash: 46A17DB1A04209EFDF15DFA8D895BEEBBF4EF48710F144069E415B7290DB709A84CB91

Function 00A13790 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 222libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,C310823C,?,?,?,?,?,?,?,C310823C,00BA74D5,000000FF,?,00A13AAA,00C084E0), ref: 00A137F7
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A137FD
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,C310823C,00BA74D5,000000FF,?,00A13AAA,00C084E0,C310823C,C310823C), ref: 00A1382E
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A13834

Strings

CoIncrementMTAUsage, xrefs: 00A13824
DllGetActivationFactory, xrefs: 00A13979
RoGetActivationFactory, xrefs: 00A137ED
.dll, xrefs: 00A13939
combase.dll, xrefs: 00A137F2, 00A13829

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll
API String ID: 2574300362-2454113998
Opcode ID: 0a7e7c6c1ab76d1e4b288b2727fdd3506d4ebd0ce3a2de142dd15dfe8db0a742
Instruction ID: 517a631d69ef08d2d772b594d3ca306eb4444a0a5225627b0bf8135e459e0059
Opcode Fuzzy Hash: 0a7e7c6c1ab76d1e4b288b2727fdd3506d4ebd0ce3a2de142dd15dfe8db0a742
Instruction Fuzzy Hash: C6815CB2900248EFDF15DFA8C895BEEBBB4EF08710F144169E415B72D1DBB19A84CB61

Function 00B0FE90 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 413registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\JavaSoft\Java Development Kit\,00000000,?,?,C310823C,?,?), ref: 00B0FEF3
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?), ref: 00B10089
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?,?,?,?), ref: 00B100E5
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?), ref: 00B10135
RegCloseKey.ADVAPI32(?), ref: 00B10175

Strings

Software\JavaSoft\Java Development Kit\, xrefs: 00B0FEE5, 00B0FEED
Software\JavaSoft\Java Runtime Environment\, xrefs: 00B0FED6
JavaHome, xrefs: 00B100DF, 00B1012A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: OpenQueryValue$Close
String ID: JavaHome$Software\JavaSoft\Java Development Kit\$Software\JavaSoft\Java Runtime Environment\
API String ID: 2529929805-1079072530
Opcode ID: 31757829f975ddf217186277dffc837e1ea0399c7beb395225f0a72e20960849
Instruction ID: dee4f907eda3899c8f6de2d5c6410bdf828b553f0a89108a984cf2bd31f1d7bc
Opcode Fuzzy Hash: 31757829f975ddf217186277dffc837e1ea0399c7beb395225f0a72e20960849
Instruction Fuzzy Hash: 40024A719152699BDB20EB28CC88BEEB7F4EF45304F5042D9E409A7291DBB5AEC4CF50

Function 00AE91D0 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 286threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00C8711C,C310823C,?,?,00000000), ref: 00AE92F3
EnterCriticalSection.KERNEL32(?,C310823C,?,?,00000000,?,?,?,?,?,00000000,00BDC417,000000FF), ref: 00AE9305
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,00BDC417,000000FF), ref: 00AE9312
GetCurrentThread.KERNEL32 ref: 00AE931D
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,00C0438C,00000000), ref: 00AE94FE
LeaveCriticalSection.KERNEL32(?,00000000), ref: 00AE95DA

Strings

<--------------------MORE--FRAMES-------------------->, xrefs: 00AE94A2
*** Stack Trace (x86) ***, xrefs: 00AE93F7
v, xrefs: 00AE95DA
MODULE_BASE_ADDRESS, xrefs: 00AE954B
[0x%.8Ix] , xrefs: 00AE9505

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: 239d34c399b1eeff8f973ffe74b8da42d21aa5ac69a9231e8599061b080b9b1e
Instruction ID: a998cde7242ad7554f28a9a7a422c0ce84a9ca44aafa48ba668da9d9c62af8af
Opcode Fuzzy Hash: 239d34c399b1eeff8f973ffe74b8da42d21aa5ac69a9231e8599061b080b9b1e
Instruction Fuzzy Hash: CCC17B71504388AFDB26DFA4CC55BEEBBB8FF44304F504168E9199B281DBB55B08CBA1

Function 00A0CBB0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,C310823C), ref: 00A0CC38

Part of subcall function 009F0E60: SetWindowLongW.USER32(?,000000FC,00000000), ref: 009F0E96

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00A0CD3B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00A0CD4F
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00A0CD64
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00A0CD79
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00A0CD90
GetWindowRect.USER32(?,?), ref: 00A0CDC2
SendMessageW.USER32(00000000,00000412,00000000), ref: 00A0CE24
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00A0CE34

Strings

tooltips_class32, xrefs: 00A0CC32
,, xrefs: 00A0CCEA

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,$tooltips_class32
API String ID: 1954517558-3856767331
Opcode ID: 7141c2842ec5c6fc062fa35f638ce3771d40680c8f768ce740e1d836fd79d926
Instruction ID: 22011c38d3a8efd6a53f3d12207b4efee403e52ac8e2a4d082d8c393b4eb7462
Opcode Fuzzy Hash: 7141c2842ec5c6fc062fa35f638ce3771d40680c8f768ce740e1d836fd79d926
Instruction Fuzzy Hash: 04913B71A00608AFEB14CFA4DD95BAEBBF9FB48300F10852AE556EB290D774A904CB50

Function 00AE9280 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 223threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00C8711C,C310823C,?,?,00000000), ref: 00AE92F3
EnterCriticalSection.KERNEL32(?,C310823C,?,?,00000000,?,?,?,?,?,00000000,00BDC417,000000FF), ref: 00AE9305
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,00BDC417,000000FF), ref: 00AE9312
GetCurrentThread.KERNEL32 ref: 00AE931D
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,?,00C0438C,00000000), ref: 00AE94FE
LeaveCriticalSection.KERNEL32(?,00000000), ref: 00AE95DA

Strings

<--------------------MORE--FRAMES-------------------->, xrefs: 00AE94A2
*** Stack Trace (x86) ***, xrefs: 00AE93F7
v, xrefs: 00AE95DA
MODULE_BASE_ADDRESS, xrefs: 00AE954B
[0x%.8Ix] , xrefs: 00AE9505

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ v$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix]
API String ID: 3051236879-1086252000
Opcode ID: a7c899427976b367355c77d567362531d2c3279faba8038e9529fb9a6f5f2189
Instruction ID: a52b02ffb1b9b1044553f0bbd2a56703e77b291840b244bb7cac7b6358202aa5
Opcode Fuzzy Hash: a7c899427976b367355c77d567362531d2c3279faba8038e9529fb9a6f5f2189
Instruction Fuzzy Hash: 96A16C71904388AFDF26DFA4CC55BEE7BB8BF45304F404168E909AB291EB755B08CB51

Function 00AE62D0 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AE646E
__Init_thread_footer.LIBCMT ref: 00AE65C7
GetStdHandle.KERNEL32(000000F5,?,C310823C,?,?), ref: 00AE664F
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 00AE6656
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 00AE666A
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00AE6671

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,00000000,00000000,00C068B8,00000002,?,?), ref: 00AE6700
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00AE6707
IsWindow.USER32(00000000), ref: 00AE6920

Strings

Error, xrefs: 00AE68BF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalInit_thread_footerSectionText$BufferEnterInfoLeaveScreenWindow
String ID: Error
API String ID: 2811146417-2619118453
Opcode ID: 736db7b7e373cec6944d7055a6ccab9cba6215218d1774a9432cd8681b9a1034
Instruction ID: 0de9f3199898dcfefb73ebca1ca98be1898afb1f86dcdf69efd8966e9b0f63b8
Opcode Fuzzy Hash: 736db7b7e373cec6944d7055a6ccab9cba6215218d1774a9432cd8681b9a1034
Instruction Fuzzy Hash: CA228C70E00358DFDB10DFA5C844BDEBBB4BF55314F208698E419AB291EB75AA88CF51

Function 009EF600 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C87250,C310823C,00000000,?,?,?,?,?,?,009EEE60,00BA07AD,000000FF), ref: 009EF63D
LoadCursorW.USER32(00000000,00007F00), ref: 009EF6B8
LoadCursorW.USER32(00000000,00007F00), ref: 009EF75E
LeaveCriticalSection.KERNEL32(00C87250), ref: 009EF7B3

Strings

AtlAxWinLic140, xrefs: 009EF71F, 009EF775
v, xrefs: 009EF7B3
WM_ATLGETHOST, xrefs: 009EF649
0, xrefs: 009EF743
AtlAxWin140, xrefs: 009EF66F, 009EF6D3
WM_ATLGETCONTROL, xrefs: 009EF654

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: v$0$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST
API String ID: 3727441302-556780245
Opcode ID: eb9720237286c1c1be56e1803392b633f8b3cbe686547b737da56e0929049934
Instruction ID: 33d2c77c798e8a2fdb2f66615fd6128e3e9da3bfceae1dad2ab0c603f2892508
Opcode Fuzzy Hash: eb9720237286c1c1be56e1803392b633f8b3cbe686547b737da56e0929049934
Instruction Fuzzy Hash: 345111B0C01259EFDB11DFA8D844B9EBFF8AB08314F10012AE904B7290EBB55A45CFA4

Function 00A45A70 Relevance: 16.7, APIs: 11, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A45AB7
GetParent.USER32 ref: 00A45ACD
GetWindowRect.USER32(?,?), ref: 00A45AD8
GetParent.USER32(?), ref: 00A45AE0
GetWindow.USER32(?,00000004), ref: 00A45B12
GetWindowRect.USER32(?,?), ref: 00A45B20
GetWindowLongW.USER32(00000000,000000F0), ref: 00A45B2D
MonitorFromWindow.USER32(?,00000002), ref: 00A45B45
GetMonitorInfoW.USER32(00000000,?), ref: 00A45B5F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015,?,00000004), ref: 00A45C0D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$LongMonitorParentRect$FromInfo
String ID:
API String ID: 1820395375-0
Opcode ID: 34475f55e20aa624f9fbf8d61d9030bb8edea49c50e93c684a5fe2d293fb4a29
Instruction ID: 56b44ed908bb78e2b6aa4ab48213d426883040bb756bdefe8de5214c7b052d50
Opcode Fuzzy Hash: 34475f55e20aa624f9fbf8d61d9030bb8edea49c50e93c684a5fe2d293fb4a29
Instruction Fuzzy Hash: 11516D76D005199FDB20CFB8CD45BAEBBB9FB88710F244229E815E3295DB30AD45CB94

Function 00B33930 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 282COMMON

Download Yara Rule

Strings

PropertyValue, xrefs: 00B33B79
Visible, xrefs: 00B33A1D
TimeRemaining, xrefs: 00B33AFF
Progress, xrefs: 00B3396D
Text, xrefs: 00B339AA
Enabled, xrefs: 00B33A90

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: Enabled$Progress$PropertyValue$Text$TimeRemaining$Visible
API String ID: 0-2691827946
Opcode ID: 2c4c1025dd6058214fae92bb0c9def05339818efde8f45177b6f9ded36d5a3c0
Instruction ID: dfd35a1759ded57d6508b92c00f0815fe1dc4e01778bc8b570643d418dbdd7bd
Opcode Fuzzy Hash: 2c4c1025dd6058214fae92bb0c9def05339818efde8f45177b6f9ded36d5a3c0
Instruction Fuzzy Hash: FEB192B1A04344DFDB14CF58D845B5EBBE1FB85720F2082AEE8699B3D0D7769A00CB91

Function 00B0E920 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 121COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00B0E956

Strings

HKCU, xrefs: 00B0E9B5
HKCC, xrefs: 00B0EA05
HKEY_LOCAL_MACHINE, xrefs: 00B0E99D
HKLM, xrefs: 00B0E985
HKEY_CLASSES_ROOT, xrefs: 00B0E9F1
HKEY_CURRENT_USER, xrefs: 00B0E9C9
HKEY_CURRENT_CONFIG, xrefs: 00B0EA19
HKCR, xrefs: 00B0E9DD

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKLM
API String ID: 2691759472-1956487666
Opcode ID: cabfe73caf142dc9bcf85542659335fbeeded2c3186143a53eef56f1a392d519
Instruction ID: 5999ac46cfd25e3d1a6a444d7684ed16fde545142d7305fb0237a90debffd35e
Opcode Fuzzy Hash: cabfe73caf142dc9bcf85542659335fbeeded2c3186143a53eef56f1a392d519
Instruction Fuzzy Hash: 5E41EA72F40206ABDF10DA64DC02B9ABBE8FB45721F144AB9BC25E22E1E771DC10C761

Function 00A12BD0 Relevance: 15.4, APIs: 10, Instructions: 404memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

CreateThread.KERNEL32(00000000,00000000,00A12D20,00C08468,00000000,?), ref: 00A12C9A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00A12CB3
CloseHandle.KERNEL32(00000000), ref: 00A12CC9
CoInitializeEx.COMBASE(00000000,00000000), ref: 00A12D79
GetProcessHeap.KERNEL32(?,00000000), ref: 00A12E7B
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A12E81
GetProcessHeap.KERNEL32(?,00000000), ref: 00A12F00
HeapFree.KERNEL32(00000000,?,00000000), ref: 00A12F06
CoUninitialize.COMBASE ref: 00A1305A
Concurrency::cancel_current_task.LIBCPMT ref: 00A130DB

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseConcurrency::cancel_current_taskCreateHandleInitializeObjectSingleThreadUninitializeWait
String ID:
API String ID: 1779960141-0
Opcode ID: 62aaf5b11be6a6affc815c3ec4415d9d0c342e99f6eec52164ecaccbf316cf62
Instruction ID: be817cd6929706c5e00a2e415410f570a2668bb8ba3c68f9c71e41ab8c5efffb
Opcode Fuzzy Hash: 62aaf5b11be6a6affc815c3ec4415d9d0c342e99f6eec52164ecaccbf316cf62
Instruction Fuzzy Hash: DAF15DB1D01218DFDF14CFA8C944BEEBBF4BF44304F248199E415AB291DB749A85CBA1

Function 00A03480 Relevance: 15.3, APIs: 10, Instructions: 339memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A034DA
VariantClear.OLEAUT32(?), ref: 00A0350C
VariantClear.OLEAUT32(?), ref: 00A03606
VariantClear.OLEAUT32(?), ref: 00A03635
SysFreeString.OLEAUT32(00000000), ref: 00A0363C
SysAllocString.OLEAUT32(00000000), ref: 00A03683
VariantClear.OLEAUT32(?), ref: 00A0370A
VariantClear.OLEAUT32(?), ref: 00A0373C
VariantClear.OLEAUT32(?), ref: 00A03817
VariantClear.OLEAUT32(?), ref: 00A03846

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: 3b91998a66c33118d092be354612863f0742ae1ea223b32431998b8b219af8c3
Instruction ID: e3eafc6dc1361a9b3d0e9c576b66263f216ed228a679b19589cd5cf7a1fc759e
Opcode Fuzzy Hash: 3b91998a66c33118d092be354612863f0742ae1ea223b32431998b8b219af8c3
Instruction Fuzzy Hash: 08C17B7290024CDFCF11DFA8D844BDEBBB8EF48710F148269E405E7291E779AA45CBA5

Function 00B04B50 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00B04B8C
GetUserDefaultLangID.KERNEL32 ref: 00B04B99
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00B04BAB
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00B04BBF
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00B04BD4

Strings

kernel32.dll, xrefs: 00B04BA2
GetSystemDefaultUILanguage, xrefs: 00B04BB9
GetUserDefaultUILanguage, xrefs: 00B04BCE

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 3f35ed1595feba22d9812ee03035dbbab93c92e4be90feb0f755fcdb3a12eb70
Instruction ID: b17e13034b4e39d95835cbad1eb4c23379d64000a6f841656a8883a0c45ae67f
Opcode Fuzzy Hash: 3f35ed1595feba22d9812ee03035dbbab93c92e4be90feb0f755fcdb3a12eb70
Instruction Fuzzy Hash: AD41CFB06053019FD764EF28E8507BABBE1EFD8340F81096EE986C3280EB31D845CB52

Function 00B7A990 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00B7A9C7
___except_validate_context_record.LIBVCRUNTIME ref: 00B7A9CF
_ValidateLocalCookies.LIBCMT ref: 00B7AA58
__IsNonwritableInCurrentImage.LIBCMT ref: 00B7AA83
_ValidateLocalCookies.LIBCMT ref: 00B7AAD8
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00B7AAEE
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00B7AB03

Strings

csm, xrefs: 00B7AA6D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: c148b689ecbf49bfa3a8fe3228a23160bcf4d433e33b3672181ae6532ad13e9a
Instruction ID: 31ec98ebaba2c0a201eaeeba167c3a6118eb138495d28d909aadb367800ac69c
Opcode Fuzzy Hash: c148b689ecbf49bfa3a8fe3228a23160bcf4d433e33b3672181ae6532ad13e9a
Instruction Fuzzy Hash: B5419134A00209AFCF50DF68C985AAE7BE5EF85314F14C0E5E82D5B392DB359A15CF92

Function 00A3A6C0 Relevance: 13.6, APIs: 9, Instructions: 103COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A3A6E0
SetWindowLongW.USER32(?,000000F0,00C80000), ref: 00A3A70E
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00A3A53C), ref: 00A3A71F
GetWindowLongW.USER32(?,000000EC), ref: 00A3A753
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A3A77F
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00A3A53C), ref: 00A3A796
GetWindowLongW.USER32(?,000000F0), ref: 00A3A7BA
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A3A7D2
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00A3A53C), ref: 00A3A7E3

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: af2e604c3ed857da227f79290f604cbe4d76dadd1410931677c4a4d4af9e0ea4
Instruction ID: 81cadfc8078d3e92b2492ba969e94dd9d79443b6ba857c790675de3af6fb26e8
Opcode Fuzzy Hash: af2e604c3ed857da227f79290f604cbe4d76dadd1410931677c4a4d4af9e0ea4
Instruction Fuzzy Hash: 4B31F631A44229BFEF258F24CC85FED3722EBC4360F244229F959AB2E1DBB59D409744

Function 00ACAE10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 232fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?), ref: 00ACAEA9
CloseHandle.KERNEL32(00000000), ref: 00ACAED0

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

Part of subcall function 00ACCA40: FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,00AF4C1A,80070057,C310823C,?,?,?,00B9E7D0,000000FF,?,00ACC8D7), ref: 00ACCA7D
Part of subcall function 00ACCA40: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00ACCAAE

WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?), ref: 00ACAF45
CloseHandle.KERNEL32(00000000), ref: 00ACAF97

Part of subcall function 00ACC860: WideCharToMultiByte.KERNEL32(00000003,00000000,00AF4C1A,000000FF,00000000,00000000,00000000,00000000,?,?,?,00AF4C1A,?,?), ref: 00ACC87C
Part of subcall function 00ACC860: WideCharToMultiByte.KERNEL32(00000003,00000000,00AF4C1A,000000FF,?,-00000001,00000000,00000000,?,?,?,00AF4C1A,?,?), ref: 00ACC8B2

Strings

EXE, xrefs: 00ACAE63
.bat, xrefs: 00ACAE5E
open, xrefs: 00ACAFC3

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ByteCharMultiWide$CloseFileHandleInit_thread_footer$CreateFindHeapProcessResourceWrite
String ID: .bat$EXE$open
API String ID: 4275363648-2898749727
Opcode ID: 1e849d80b848c9d9f9a81998d5350fb70274d2bcc9d2d27933c7969964c0134b
Instruction ID: 37b22bea21f3c1a6337a69ab5a0bee93a7b77668b6517d16ef59e7e5ba90b902
Opcode Fuzzy Hash: 1e849d80b848c9d9f9a81998d5350fb70274d2bcc9d2d27933c7969964c0134b
Instruction Fuzzy Hash: 1DA18A70901648EFEB10CFA8C948B9EFBB4FF45314F248299E414AB2A1DB749D44CF90

Function 009F6CD0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 150fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009F6DBF

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?), ref: 009F6E13
CloseHandle.KERNEL32(00000000), ref: 009F6E70

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 009F6ED4
CloseHandle.KERNEL32(00000000,?), ref: 009F6EFA

Strings

html, xrefs: 009F6DCC
aix, xrefs: 009F6DD1

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html
API String ID: 2030708724-2369804267
Opcode ID: 37c25b5da554cc67c2b6c9782da149856401d7617eeb3312829befe646de67a3
Instruction ID: bda47122d0e7116801033800dbf71abda79e61ff4445587ac3528d8caa93220b
Opcode Fuzzy Hash: 37c25b5da554cc67c2b6c9782da149856401d7617eeb3312829befe646de67a3
Instruction Fuzzy Hash: D2618EB0904348DFDB10CFA4DD59B9EBBF4FB45308F204259E105AB2D1EBB9A908CB95

Function 009E2860 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00C87028,00000000,C310823C,00000000,00BD7533,000000FF,?,C310823C), ref: 009E29D3
GetLastError.KERNEL32(?,C310823C), ref: 009E29DD

Strings

VolumeCostVolume, xrefs: 009E288D, 009E2945
VolumeCostDifference, xrefs: 009E28B3
VolumeCostAvailable, xrefs: 009E28A0
VolumeCostSize, xrefs: 009E2897
VolumeCostRequired, xrefs: 009E28A9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpin
String ID: VolumeCostAvailable$VolumeCostDifference$VolumeCostRequired$VolumeCostSize$VolumeCostVolume
API String ID: 439134102-34576578
Opcode ID: 39cf4d928aac67b8d5a69738a7e6ccd3add39fc1c5242ee1ed4ff5d22718403f
Instruction ID: 44beffafb2da4f65d4dff8cd65ca66466de672384884d1bddeadb8e6cf5aeac5
Opcode Fuzzy Hash: 39cf4d928aac67b8d5a69738a7e6ccd3add39fc1c5242ee1ed4ff5d22718403f
Instruction Fuzzy Hash: 225134B1804648CBCB11CF65DD057EEBBF8FB04324F20476AD429A7391E7759A08CBA5

Function 00AC2E80 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00AC2F10

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00AC2F4D
__Init_thread_footer.LIBCMT ref: 00AC2F64
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00AC2F8F

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

Part of subcall function 00AA2620: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00AA2661
Part of subcall function 00AA2620: _wcschr.LIBVCRUNTIME ref: 00AA271F

Strings

UxTheme.dll, xrefs: 00AC2EE1
SetWindowTheme, xrefs: 00AC2F42
explorer, xrefs: 00AC2F77

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake_wcschr
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3852524043-3123591815
Opcode ID: 6d863a73a7c2e814d22518251dad85e5e431c127bfcb2943d88af5b3e44c59fa
Instruction ID: c78b137a06f7f2e9ce643818f89a3636808c973865a78d70e7c55d34bec66c09
Opcode Fuzzy Hash: 6d863a73a7c2e814d22518251dad85e5e431c127bfcb2943d88af5b3e44c59fa
Instruction Fuzzy Hash: 1921A2B0A48604ABC710DF64EC06F9DB7A0EB05720F204369F425A77D0EB70AE41DB98

Function 009F9A20 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 009F9A4A
GetWindow.USER32(?,00000005), ref: 009F9A57
GetWindow.USER32(00000000,00000002), ref: 009F9B92

Part of subcall function 009F98A0: GetWindowRect.USER32(?,?), ref: 009F98CC
Part of subcall function 009F98A0: GetWindowRect.USER32(?,?), ref: 009F98DC

GetWindowRect.USER32(?,?), ref: 009F9AEB
GetWindowRect.USER32(00000000,?), ref: 009F9AFB
GetWindowRect.USER32(00000000,?), ref: 009F9B15

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: 2307eddf0fa6f9d5915ed2614ed3defcadf67319cec316aeeec14187068e1086
Instruction ID: 8ca33c3d9c082e43c34476cb608a044932de73b73bc4cbc17e718a91201da580
Opcode Fuzzy Hash: 2307eddf0fa6f9d5915ed2614ed3defcadf67319cec316aeeec14187068e1086
Instruction Fuzzy Hash: D24178315087059BC721DF29C980B7BF7E9AF9A704F504A1DF28693561EB30E989CB52

Function 00B76656 Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00B76800,00000000,?,?,009F0C24,?), ref: 00B7667A
HeapAlloc.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B76681

Part of subcall function 00B7674C: IsProcessorFeaturePresent.KERNEL32(0000000C,00B76668,00000000,?,00B76800,00000000,?,?,009F0C24,?), ref: 00B7674E

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00B76800,00000000,?,?,009F0C24,?), ref: 00B76691
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,009F0C24,?), ref: 00B766B8
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,009F0C24,?), ref: 00B766CC
InterlockedPopEntrySList.KERNEL32(00000000,?,?,009F0C24,?), ref: 00B766DF
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,009F0C24,?), ref: 00B766F2

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 1722b7795164e5e243deb6b7214091870a2613a50f6ade4d2ebb1095455242cf
Instruction ID: 9f4226b8642fbc4382cc1759de8221c3b47b4aa8aecf5df4e0ae91410d4da852
Opcode Fuzzy Hash: 1722b7795164e5e243deb6b7214091870a2613a50f6ade4d2ebb1095455242cf
Instruction Fuzzy Hash: 7F11B275600E21BBEB215B68AC48F7A77EDEB48784F508465FD19E7190DE60DC00CBA4

Function 00B114F0 Relevance: 11.0, APIs: 3, Strings: 3, Instructions: 454synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00B13390: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00B1152A,?,C310823C,?,?,?,000000FF,?,00B10EF4), ref: 00B1339D
Part of subcall function 00B13390: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00B1152A,?,C310823C,?,?,?,000000FF,?,00B10EF4,?), ref: 00B133BE
Part of subcall function 00B13390: GetLastError.KERNEL32(?,C310823C,?,?,?,000000FF,?,00B10EF4,?,?,00000000,00000000,C310823C,?,?), ref: 00B1341E

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

ResetEvent.KERNEL32(?,00000000,00BE499D), ref: 00B115FA
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00B11619
WaitForSingleObject.KERNEL32(C310823C,000000FF), ref: 00B11620

Part of subcall function 009E9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,009F6AC0,-00000010,?,00B21897,00000008,C310823C), ref: 009E9143

Strings

filename, xrefs: 00B11971
GET, xrefs: 00B1157A
attachment, xrefs: 00B1182D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Event$CreateInit_thread_footerObjectSingleWait$ErrorFindHeapLastProcessResetResource
String ID: GET$attachment$filename
API String ID: 818129584-3911147371
Opcode ID: 518d64f1221a31d5eff1556ae71f935582c066bc9c12507f12c4786aacc89e55
Instruction ID: 84d374bf9b15a0e92282fe6908ddb81c6ca0d0fbbd6a9d14922288a61e723af7
Opcode Fuzzy Hash: 518d64f1221a31d5eff1556ae71f935582c066bc9c12507f12c4786aacc89e55
Instruction Fuzzy Hash: 4002A9B0901249DFDB00DFA8C948BEEBBF4EF15314F1485ADE515AB291EB749E44CBA0

Function 00B27C60 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

_wcschr.LIBVCRUNTIME ref: 00B27D2B
_wcschr.LIBVCRUNTIME ref: 00B27DD2
_wcschr.LIBVCRUNTIME ref: 00B27DF1

Part of subcall function 009E9120: FindResourceW.KERNEL32(00000000,?,00000006,-00000010,?,?,009F6AC0,-00000010,?,00B21897,00000008,C310823C), ref: 009E9143

_wcschr.LIBVCRUNTIME ref: 00B27E93
GetTickCount.KERNEL32 ref: 00B2803A

Strings

0123456789AaBbCcDdEeFf, xrefs: 00B27CC1, 00B27CD3, 00B27CDD

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$CountFindHeapProcessResourceTick
String ID: 0123456789AaBbCcDdEeFf
API String ID: 2181188311-3822820098
Opcode ID: 40a5d9410e114961c529fe42a2b1569215e9fb7c77214426b116c4487322d4c7
Instruction ID: a9004e17b49ed59ce22894547f152f651fdd2c6b10cb0a43e5d3efd9d396cb14
Opcode Fuzzy Hash: 40a5d9410e114961c529fe42a2b1569215e9fb7c77214426b116c4487322d4c7
Instruction Fuzzy Hash: CDD12470A04A158FDB10DF68D888BAEB7F5FF48320F14829DE45997291DB34ED45CBA4

Function 00AE1A30 Relevance: 10.8, APIs: 7, Instructions: 294fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,C310823C,?,00000000), ref: 00AE1AB9
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000,00001000), ref: 00AE1B29
CloseHandle.KERNEL32(?), ref: 00AE1D2E
ReadFile.KERNEL32(?,00000000,00001000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00AE1DB5

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$Read$CloseCreateHandle
String ID:
API String ID: 1724936099-0
Opcode ID: 5bf8bbb67a4bfee5a3522efa9edc3e723bde2a7c3fb5fa664a8c3d54947c83e9
Instruction ID: bb3f7477e5d56750ba50c48f3490fd95c12838a77feea3b14825906592db306a
Opcode Fuzzy Hash: 5bf8bbb67a4bfee5a3522efa9edc3e723bde2a7c3fb5fa664a8c3d54947c83e9
Instruction Fuzzy Hash: E7C18D71E00358DBDB20CFA5CD89BAEBBB5EF44304F208659E415AB281E770AE45CB91

Function 009F4F10 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C87008,C310823C,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00BA1605), ref: 009F4F7A
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00BA1605), ref: 009F4FFA
EnterCriticalSection.KERNEL32(00C87024,?,?,?,?,?,?,?,?,?,?,?,00000000,00BA1605,000000FF), ref: 009F51B3
LeaveCriticalSection.KERNEL32(00C87024,?,?,?,?,?,?,?,?,?,?,00000000,00BA1605,000000FF), ref: 009F51D4

Strings

v, xrefs: 009F51CD

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: v
API String ID: 1807155316-3261393531
Opcode ID: 4fc553b02c245f64a85efe144a7210a226f5efe56b29189faad7d6eb05b8e049
Instruction ID: df6e0a61d3c3e95f259e99c67b6f87f623ed031470ffbbcba94f8ff6a72216c3
Opcode Fuzzy Hash: 4fc553b02c245f64a85efe144a7210a226f5efe56b29189faad7d6eb05b8e049
Instruction Fuzzy Hash: 5AB18270A04648DFDB10CFA4C888BBEBBB8BF05314F194158EA14EB291CB75ED45CBA0

Function 009F0ED0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00C0480C,00000000,00000001,00C04E94,?), ref: 009F0FA0

Strings

:, xrefs: 009F0F8A
{, xrefs: 009F1000

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CreateInstance
String ID: :${
API String ID: 542301482-3766677574
Opcode ID: 5cd469fea2f7efe5f1f38592ec104a41fd9c8d906b834d45c564759bc46435d0
Instruction ID: c3e72c133cf6edfe5d2da51fcafd7bb4aceb72b66627965fd6bf493139a7d6c1
Opcode Fuzzy Hash: 5cd469fea2f7efe5f1f38592ec104a41fd9c8d906b834d45c564759bc46435d0
Instruction Fuzzy Hash: 5C619374A00259DBDF248F95CC54BBEB7E8EB49714F184469FA05EB2C1DB759C80CBA0

Function 00A15053 Relevance: 10.7, APIs: 7, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00A150E4
SysFreeString.OLEAUT32(00000000), ref: 00A15159
GetProcessHeap.KERNEL32(?,?), ref: 00A151BF
HeapFree.KERNEL32(00000000,?,?), ref: 00A151C5
GetProcessHeap.KERNEL32(?,00000000,?,00000000), ref: 00A151F5
HeapFree.KERNEL32(00000000,?,00000000,?,00000000), ref: 00A151FB
SysFreeString.OLEAUT32(00000000), ref: 00A15213

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: fcbfab3ccd3128fced6c2acef7f63a04d3008da7064619581eefe47c115556c0
Instruction ID: 4203883442df016fec154d65feeaabe9acec8df42fd855db4f82f24ca3c243da
Opcode Fuzzy Hash: fcbfab3ccd3128fced6c2acef7f63a04d3008da7064619581eefe47c115556c0
Instruction Fuzzy Hash: AA61AEB1D01619DFDF11EFB8C845BEEBBB4BF54310F144198E821AB281C7789A45CBA1

Function 009F25E0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 157COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C87250,C310823C,00000000,00C8726C), ref: 009F2653
LeaveCriticalSection.KERNEL32(00C87250), ref: 009F26B8
LoadCursorW.USER32(009E0000,?), ref: 009F2714
LeaveCriticalSection.KERNEL32(00C87250), ref: 009F27AB

Strings

v, xrefs: 009F26B8, 009F27AB
ATL:%p, xrefs: 009F2734

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: v$ATL:%p
API String ID: 2080323225-109518622
Opcode ID: fc52bf873900674c452535ea7d876bde3e645f9b810a92150abd272b215efd91
Instruction ID: 4fb0a48c22f2f13393ea1fcd864a10b8fbf4b65ee913622f3a9ad54da59257e8
Opcode Fuzzy Hash: fc52bf873900674c452535ea7d876bde3e645f9b810a92150abd272b215efd91
Instruction Fuzzy Hash: 4651AB70D04B48CBDB20DF68C944BAABBF4FF58324F00461DE996A3690EB70B984CB50

Function 00A0BC60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 00A0BCD5
lstrcpynW.KERNEL32(?,?,00000020), ref: 00A0BD4B
MulDiv.KERNEL32(?,00000048,00000000), ref: 00A0BD88
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 00A0BDBA

Strings

t, xrefs: 00A0BD96
?, xrefs: 00A0BD8E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$lstrcpyn
String ID: ?$t
API String ID: 3928028829-1995845436
Opcode ID: 0eb77a655f08a7950522185210a42b030b8c49c90014b5eb61c1e9b6b0842f75
Instruction ID: cddc130b15fb313a00796f4c9b73d811afece07499302523d5f81fff46ca9dea
Opcode Fuzzy Hash: 0eb77a655f08a7950522185210a42b030b8c49c90014b5eb61c1e9b6b0842f75
Instruction Fuzzy Hash: 78516E71908744AFE721DF60DC49B9BBBE8EB88700F00492DF69AD6191DBB4D508CB62

Function 00B0F550 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,C310823C,?,?), ref: 00B0F597
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,C310823C,00BE450D), ref: 00B0F60F
GetLastError.KERNEL32 ref: 00B0F620
WaitForSingleObject.KERNEL32(00BE450D,000000FF), ref: 00B0F63C
GetExitCodeProcess.KERNEL32(00BE450D,00000000), ref: 00B0F64D
CloseHandle.KERNEL32(00BE450D), ref: 00B0F657
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00B0F672

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: 11394958e7af6c2df362538dd78472e8d97cf60b395fa1ac9019c5bebf976611
Instruction ID: 74ea323ef2029527563eab898e179e6a79a7aaddb6ea9348a8190a9a6fa374ac
Opcode Fuzzy Hash: 11394958e7af6c2df362538dd78472e8d97cf60b395fa1ac9019c5bebf976611
Instruction Fuzzy Hash: 43416F31E0438AABDB10CFA5CD087EEBBF4EF49714F148669E425A7290DB759A40CF50

Function 00B21C40 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000010,?,00000000,00B07731,00000000,C310823C,?,00000010,00000000), ref: 00B21C5B
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00B21C71
FreeLibrary.KERNEL32(00000000), ref: 00B21CAA
FreeLibrary.KERNEL32(00000000,?,00000010,?,00000000,00B07731,00000000,C310823C,?,00000010,00000000), ref: 00B21CC6

Strings

Shlwapi.dll, xrefs: 00B21C5A
DllGetVersion, xrefs: 00B21C6B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 5ba1bb7afbd2be58c2d47fdca0b2865185a96fcc888ca2eaba5385fa87cf1da8
Instruction ID: e9f58f27bd03112810ec9f93370f4146025647cdf721fa8f32e1de9d66ff4b7f
Opcode Fuzzy Hash: 5ba1bb7afbd2be58c2d47fdca0b2865185a96fcc888ca2eaba5385fa87cf1da8
Instruction Fuzzy Hash: BA2180766046114BC704AF2DEC41A7BB7E4FFE9610B80096EF899C7201EF25984586A2

Function 00B90FA2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00B910AF,00B8E2B4,0000000C,?,00000000,00000000,?,00B912D9,00000021,FlsSetValue,00BFDF90,00BFDF98,?), ref: 00B91063

Strings

api-ms-, xrefs: 00B90FF9
ext-ms-, xrefs: 00B9100D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3825583ba23aaccdb57381352a53584bab4d9863910d3790ce73e6ee7e5206c6
Instruction ID: 2cd165bd58167f1a9496879da0ad0684cb2ce4a32603f4f85e007fc4cd96f9e0
Opcode Fuzzy Hash: 3825583ba23aaccdb57381352a53584bab4d9863910d3790ce73e6ee7e5206c6
Instruction Fuzzy Hash: 4B21E735A01256ABCF32AB38DC80B6E37E9EB417A0F1409B0E915A72D0DB71ED40DBD0

Function 00B74068 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,?,00B740E3,00B74046,00B742E7), ref: 00B7407F
GetProcAddress.KERNEL32(00000000,AcquireSRWLockExclusive), ref: 00B74095
GetProcAddress.KERNEL32(00000000,ReleaseSRWLockExclusive), ref: 00B740AA

Strings

KERNEL32.DLL, xrefs: 00B7407A
AcquireSRWLockExclusive, xrefs: 00B7408F
ReleaseSRWLockExclusive, xrefs: 00B7409F

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 667068680-1718035505
Opcode ID: fa8d64f1ac4b71c71265e54beb35e1914a79575fa74735ccb1cea0c3cf64c138
Instruction ID: 445bc882e86eee1f705ecb8766ebbe6889d9bfabef67ecdcd4b3f3d2ba7ad3ac
Opcode Fuzzy Hash: fa8d64f1ac4b71c71265e54beb35e1914a79575fa74735ccb1cea0c3cf64c138
Instruction Fuzzy Hash: FCF0C271740762AB8F315E704C8437B62ECDA0535331181BAEB2AE3290EB91CC49EFD0

Function 00A0E350 Relevance: 9.2, APIs: 6, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00A0E3B7
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00A0E3DF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A0E3F7
SendMessageW.USER32(?,0000130A,00000000,?), ref: 00A0E428
GetParent.USER32(?), ref: 00A0E504
SendMessageW.USER32(00000000,00000136,?,?), ref: 00A0E515

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$Parent
String ID:
API String ID: 1020955656-0
Opcode ID: 1bb084927e62aa990559802357b6d8d17e3c11b19183a3960ed597a87011ebe0
Instruction ID: 58161299a5d387737bc0b9790ff225858235a93a8772c711cbe091ee84548e24
Opcode Fuzzy Hash: 1bb084927e62aa990559802357b6d8d17e3c11b19183a3960ed597a87011ebe0
Instruction Fuzzy Hash: EC610672900618AFDB119FE4DC49FEEBBB9FF49710F140119F619AB2A0CBB16940CB54

Function 00AC2C50 Relevance: 9.2, APIs: 6, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 00AC2CBB
GetParent.USER32(00000000), ref: 00AC2D0E
GetWindowRect.USER32(00000000), ref: 00AC2D11
GetParent.USER32(00000000), ref: 00AC2D20

Part of subcall function 00A7FEF0: GetWindowRect.USER32(?,?), ref: 00A7FF82
Part of subcall function 00A7FEF0: GetWindowRect.USER32(?,?), ref: 00A7FF9A

SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00AC2E10
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00AC2E23

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageRectSendWindow$Parent
String ID:
API String ID: 425339167-0
Opcode ID: f0bef6804058d3b8d98bc6c7697fd12e6956233cada4c13cd60cb18450a2bc48
Instruction ID: 6306715167b73adae8d2786330408935bab3317cef7adbe7b5259f2a0eef7ffc
Opcode Fuzzy Hash: f0bef6804058d3b8d98bc6c7697fd12e6956233cada4c13cd60cb18450a2bc48
Instruction Fuzzy Hash: 4D513871D00708ABDB11DFA8CD45BDEBBF8EF59710F144319E815A7291EBB06A81CB54

Function 00AD6F60 Relevance: 9.2, APIs: 6, Instructions: 153COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AD6FAA
std::_Lockit::_Lockit.LIBCPMT ref: 00AD6FCC
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD6FF4
__Getctype.LIBCPMT ref: 00AD70D5
std::_Facet_Register.LIBCPMT ref: 00AD7137
std::_Lockit::~_Lockit.LIBCPMT ref: 00AD7161

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 749dd00fd3cd620f925d2261a76d73ab77f01fed8f978a40ade86cb82a8713e0
Instruction ID: 683d90b337c28acf8bd59f549ae95f9dabeb0c1dfca5c6fbd5d1092af2be1ead
Opcode Fuzzy Hash: 749dd00fd3cd620f925d2261a76d73ab77f01fed8f978a40ade86cb82a8713e0
Instruction Fuzzy Hash: 6061CDB1C05649CFDB14CF68C941BAEBBF0FF14310F14829AD859AB392E774AA44CB91

Function 00A0FCA0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 370windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A0FCED

Strings

ControlEvent, xrefs: 00A0FF79
' AND `Control_`=', xrefs: 00A0FE67
AiTabPage, xrefs: 00A0FF03, 00A1000A
`Dialog_`=', xrefs: 00A0FE26

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend
String ID: ' AND `Control_`='$AiTabPage$ControlEvent$`Dialog_`='
API String ID: 3850602802-1655181372
Opcode ID: 8543ac461bf85c8c58e2c03b5d4720694b49297aa75a61d1839d1d318733b8cb
Instruction ID: 423a660adc39ffe0466ccabd0acc8aa6b4d212d199b0e753ad5dc64c526abcb8
Opcode Fuzzy Hash: 8543ac461bf85c8c58e2c03b5d4720694b49297aa75a61d1839d1d318733b8cb
Instruction Fuzzy Hash: B5F16971900288DFDF14DF68C889BDEBBB5FF58304F1441A8E914AB292DB75AE44CB91

Function 00B78769 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00B78760,00B7872C,?,?,00A1254D,00AE1180,?,00000008), ref: 00B78777
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00B78785
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00B7879E
SetLastError.KERNEL32(00000000,00B78760,00B7872C,?,?,00A1254D,00AE1180,?,00000008), ref: 00B787F0

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: eb1b839a5e35d12ee5dbd9f6726f87bd14a10d73a576971eb78c8b7fb0339aa5
Instruction ID: 0b1f70b2f212635124c751f9c7c51051d1fd13f3328b1c6ed9cbab31f9ec7494
Opcode Fuzzy Hash: eb1b839a5e35d12ee5dbd9f6726f87bd14a10d73a576971eb78c8b7fb0339aa5
Instruction Fuzzy Hash: C001B1322493116EA7283678ACCDB3B2BE4EB0277473082BEF43D966F1EF114C419651

Function 00AF4B10 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 287COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(C310823C,00000000,00000000), ref: 00AF4B6F
GetShortPathNameW.KERNEL32(?,?,?), ref: 00AF4BDD

Strings

x64, xrefs: 00AF4DFB
neutral, xrefs: 00AF4D37
x86, xrefs: 00AF4D9B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: NamePathShort
String ID: neutral$x64$x86
API String ID: 1295925010-1541741584
Opcode ID: fdedb3a6b3ddf6e09d9e244cf6af427a8ebdcf674548c817ee4fdd2b0b6ee2ad
Instruction ID: 3b90b1581032c1f7a7786875c551a1d16c6a49f783e8ef4c1b323082d95a4a32
Opcode Fuzzy Hash: fdedb3a6b3ddf6e09d9e244cf6af427a8ebdcf674548c817ee4fdd2b0b6ee2ad
Instruction Fuzzy Hash: CDB1B271A01248EFDB00DFA8C849BEEFBB4EF48324F148159E515AB391DB74AA44CB95

Function 00AEA570 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 266COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 00AEA85B

Strings

Details >>, xrefs: 00AEA7E1
Send Error Report, xrefs: 00AEA7BD
Close, xrefs: 00AEA774
Copy, xrefs: 00AEA842

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: 9c759375d87e8f51e109aab05d6ac124650e73e1ba861e478579516f315e8ede
Instruction ID: c97df15221393a4ad76264aaf111f89cde41d514e79c626e55b631cb686d49db
Opcode Fuzzy Hash: 9c759375d87e8f51e109aab05d6ac124650e73e1ba861e478579516f315e8ede
Instruction Fuzzy Hash: A8A19F70A50246ABEB24DF61CC56FAEB7B5BF54700F044229F611BB2C0EBB0A945CB91

Function 00B210D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00B21104

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

DeleteFileW.KERNEL32(?), ref: 00B211AA
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 00B212DF

Part of subcall function 00B10510: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,C310823C,00000001,75A8EB20,00000000), ref: 00B1055F
Part of subcall function 00B10510: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,C310823C,00000001,75A8EB20,00000000), ref: 00B10595

Part of subcall function 00B0D930: LoadStringW.USER32(000000CA,?,00000514,C310823C), ref: 00B0D986

_wcsrchr.LIBVCRUNTIME ref: 00B21219

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 00B2115E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: File$DeleteInit_thread_footer_wcsrchr$CreateHeapLoadProcessReadString
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 675357196-3685554107
Opcode ID: 176a9f5f1ccd6457d93be542b1b6e3632515ca1555eb843a88d06ca412e3b8d7
Instruction ID: f266098b9ea6c9297059e31476a098265d2339178dd4315a5fa177aa1a6d879e
Opcode Fuzzy Hash: 176a9f5f1ccd6457d93be542b1b6e3632515ca1555eb843a88d06ca412e3b8d7
Instruction Fuzzy Hash: D991AE31A00649DFDB00DBADC844B9EBBF5EF55321F1486A9E819DB2A2DB31DD04CB90

Function 009E8860 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009E8945
__Init_thread_footer.LIBCMT ref: 009E89BF

Strings

<a href=", xrefs: 009E8907
</a>, xrefs: 009E8AC9
<a>, xrefs: 009E8B71

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: d6c55d8b9d00bcc4c3de4a2dba97e6796ac189a4f4a6dceafe7f3bf2013c5146
Instruction ID: f690a4b6dede42bdb037aa4ca8dea13791cb0f69b81544c293519f7387fdd4a0
Opcode Fuzzy Hash: d6c55d8b9d00bcc4c3de4a2dba97e6796ac189a4f4a6dceafe7f3bf2013c5146
Instruction Fuzzy Hash: 7EA1D3B0A04204EFCB05DFA4D889BAEB7B5FF44314F244769E419AB6D1EB30AD45CB54

Function 00A0E140 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 00A0E23D
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00A0E252
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00A0E25A

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Part of subcall function 00A0FCA0: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A0FCED

Strings

SysTabControl32, xrefs: 00A0E235
TabHost, xrefs: 00A0E1C9, 00A0E1DB, 00A0E1E5

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 2359350451-2872506973
Opcode ID: d35bcc20c665eed356f586866e4049a2f1e164df3852c11fd6c9e25c5bdee0e8
Instruction ID: 2f9d4f95a4e7719ab2722b14cc958f884435cd67bfab6c179316ef0992513655
Opcode Fuzzy Hash: d35bcc20c665eed356f586866e4049a2f1e164df3852c11fd6c9e25c5bdee0e8
Instruction Fuzzy Hash: 52518D71A006099FDB14DF69C844BAEBBF9FF89310F14466DE815A7391DB71AD00CBA0

Function 009F6F40 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,C310823C), ref: 009F6FE1
GetLastError.KERNEL32 ref: 009F700A
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00C0438C,00000000,00000000,80000001,00000000,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 009F7153

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 009F6FD6
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 009F704A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CloseCreateErrorEventLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1713683948-2079760225
Opcode ID: 3d069d2f8407f902f06e2ecdf9d3d0fe127ba14b8ff4e80f39a25d6b741c44fe
Instruction ID: 04a1ce044643e8fe2e728979695d1b9c26981849fbe9213371185fbbf56309e5
Opcode Fuzzy Hash: 3d069d2f8407f902f06e2ecdf9d3d0fe127ba14b8ff4e80f39a25d6b741c44fe
Instruction Fuzzy Hash: 7C615CB0D05748EFDB11CFA8C945B9EFBF4AF14304F108699E559A7281DBB4AA08CB91

Function 00B076D0 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

AppDataFolder, xrefs: 00B07878, 00B078B5
PROGRAMFILES, xrefs: 00B078ED
APPDATA, xrefs: 00B07907, 00B0790F
ProgramFilesFolder, xrefs: 00B07797

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID:
String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFilesFolder
API String ID: 0-3551742416
Opcode ID: 6a8167805b341ad2a1d0a78a143e4a3c95f3d9f7638074341103e25fec26ce87
Instruction ID: 112c806ae0ba8bada9f9a9fe791e56eb8b4a5736715379aa3717276b78af94df
Opcode Fuzzy Hash: 6a8167805b341ad2a1d0a78a143e4a3c95f3d9f7638074341103e25fec26ce87
Instruction Fuzzy Hash: A321F072A44205ABCB149F68D844BBAF7E9FB45B60F5046AAE825D73D0EF31ED40C790

Function 00B7B91C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,00B7B9DF,?,?,00000000,?,?,00B7BA91,00000002,FlsGetValue,00BFB0D0,00BFB0D8), ref: 00B7B9AD

Strings

api-ms-, xrefs: 00B7B96D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 0a45ca8b14f7a1e9be5ac7a28b3488414da0e4b2400e37620ccee9d834ad9828
Instruction ID: 32cf4223aad0317cdb3656cba168f9cb68cce567855b5c70d7125f1c509d95e3
Opcode Fuzzy Hash: 0a45ca8b14f7a1e9be5ac7a28b3488414da0e4b2400e37620ccee9d834ad9828
Instruction Fuzzy Hash: F1117332A01225ABCB229B689C44F6E73E4EF41760F254590EB79EB280DB60ED00CED5

Function 00B8D862 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,C310823C,?,?,00000000,00BF7106,000000FF,?,00B8D7F2,?,?,00B8D7C6,?), ref: 00B8D897
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00B8D8A9
FreeLibrary.KERNEL32(00000000,?,00000000,00BF7106,000000FF,?,00B8D7F2,?,?,00B8D7C6,?), ref: 00B8D8CB

Strings

mscoree.dll, xrefs: 00B8D890
CorExitProcess, xrefs: 00B8D8A1

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: f656f72a4a57b534a56f532480aaf03c8471311ca4d941c8bb1546a52fb6f9f0
Instruction ID: f04fef2fce9ec5cac059c51da5b7ca983e149f9ba9e76e2c15dccc2caa87fe67
Opcode Fuzzy Hash: f656f72a4a57b534a56f532480aaf03c8471311ca4d941c8bb1546a52fb6f9f0
Instruction Fuzzy Hash: A0016D32A44629EFDB119B54DC05FBEBBF9FB04B10F00856AE921A36E0DF749904CB90

Function 00AE8850 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00AE88AE
GetProcAddress.KERNEL32(00000000), ref: 00AE88B5
__Init_thread_footer.LIBCMT ref: 00AE88CC

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

Strings

SymFromAddr, xrefs: 00AE88A4
Dbghelp.dll, xrefs: 00AE88A9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: 99b10ed9ed2fe94823da04abe57d91e09828953cbe524647eac1416c632e4874
Instruction ID: 0eac284edc46a693af478c7ce9c2c1e37defb60f3752358746d603537ca84f3b
Opcode Fuzzy Hash: 99b10ed9ed2fe94823da04abe57d91e09828953cbe524647eac1416c632e4874
Instruction Fuzzy Hash: 3401B171A48644EFC710DF58ED46B5AB3A4E708720F2083B5E829937E0EB34A800CB15

Function 00B7719A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00B77137,00000064), ref: 00B771BD
LeaveCriticalSection.KERNEL32(00C85CD8,?,?,00B77137,00000064,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C), ref: 00B771C7
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00B77137,00000064,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C), ref: 00B771D8
EnterCriticalSection.KERNEL32(00C85CD8,?,00B77137,00000064,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010), ref: 00B771DF

Strings

v, xrefs: 00B771C7

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: v
API String ID: 3269011525-3261393531
Opcode ID: cb8e66f8710bf704172662fea74cc4059effd4357f8f62bc3f7f71d7e67950b0
Instruction ID: e6c4c1339f3fc9ef6546ab3ccef11a82c4cbcf197eb52ee424be9b5a7422497c
Opcode Fuzzy Hash: cb8e66f8710bf704172662fea74cc4059effd4357f8f62bc3f7f71d7e67950b0
Instruction Fuzzy Hash: D0E01231681734BBCB012FA5ED09BAD3F58EB08B52B514060F909B7560CFE11900DFD8

Function 00A00670 Relevance: 7.7, APIs: 5, Instructions: 234windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A028C0: __Init_thread_footer.LIBCMT ref: 00A0292F

SendMessageW.USER32(?,0000104D,00000000,00000000), ref: 00A007B2
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00A00867
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00A00906
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00A009B1

Part of subcall function 009F2A50: RaiseException.KERNEL32(C310823C,C310823C,00000000,00000000,00B2197B,C000008C,00000001,C310823C), ref: 009F2A5C

SendMessageW.USER32(?,0000104C,00000000,?), ref: 00A00A37

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$ExceptionInit_thread_footerRaise
String ID:
API String ID: 3442259968-0
Opcode ID: bbc480a8e54071562cf97139e9799e9987127cc18d94f8fcff39b6b047997379
Instruction ID: 8c61d750d25fb364da572b189255a6209957ea83c2afcdda83a5cc43253b5d94
Opcode Fuzzy Hash: bbc480a8e54071562cf97139e9799e9987127cc18d94f8fcff39b6b047997379
Instruction Fuzzy Hash: A1B1F8B1D0175D9BEB20CF54CD54BDEBBB1BF49308F108299E9186B281E7B56A84CF90

Function 00A46D80 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 227memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A46F9E
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00A46FA4
GetProcessHeap.KERNEL32(-000000FF,00000000), ref: 00A46FCF
HeapFree.KERNEL32(00000000,-000000FF,00000000), ref: 00A46FD5

Strings

_TEMP, xrefs: 00A46EC7, 00A46EF8

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: _TEMP
API String ID: 3859560861-1625495653
Opcode ID: 4b67d6ea1fe4dce87752c69bcd2152b3e267db0e4c9692355fe77dfa22c9af4b
Instruction ID: b8ca9c38c8ae42e46ec184cbdef510d88bbded5f09f736b6d1ac970697f6ccb5
Opcode Fuzzy Hash: 4b67d6ea1fe4dce87752c69bcd2152b3e267db0e4c9692355fe77dfa22c9af4b
Instruction Fuzzy Hash: AF91AAB4D01248DFDB14DFA8C985BEEBBB4BF88324F2442ACE415A7291C7745A44CBA1

Function 00A3A4F0 Relevance: 7.6, APIs: 5, Instructions: 144COMMON

Download Yara Rule

APIs

Part of subcall function 00A3A6C0: GetWindowLongW.USER32(?,000000F0), ref: 00A3A6E0
Part of subcall function 00A3A6C0: SetWindowLongW.USER32(?,000000F0,00C80000), ref: 00A3A70E
Part of subcall function 00A3A6C0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00A3A53C), ref: 00A3A71F
Part of subcall function 00A3A6C0: GetWindowLongW.USER32(?,000000EC), ref: 00A3A753
Part of subcall function 00A3A6C0: SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A3A77F
Part of subcall function 00A3A6C0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00A3A53C), ref: 00A3A796
Part of subcall function 00A3A6C0: GetWindowLongW.USER32(?,000000F0), ref: 00A3A7BA
Part of subcall function 00A3A6C0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A3A7D2
Part of subcall function 00A3A6C0: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,00A3A53C), ref: 00A3A7E3

GetWindowRect.USER32(?,?), ref: 00A3A589
GetWindowLongW.USER32(?,000000EC), ref: 00A3A5B0
GetWindowRect.USER32(?,00000000), ref: 00A3A5FB
SetWindowPos.USER32(?,00000000,?,?,?,?,00000604,?,00000000), ref: 00A3A632
SetWindowTextW.USER32(?,C310823C), ref: 00A3A674

Part of subcall function 00A45A70: GetWindowLongW.USER32(?,000000F0), ref: 00A45AB7
Part of subcall function 00A45A70: GetParent.USER32 ref: 00A45ACD
Part of subcall function 00A45A70: GetWindowRect.USER32(?,?), ref: 00A45AD8
Part of subcall function 00A45A70: GetParent.USER32(?), ref: 00A45AE0

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Long$Rect$Parent$Text
String ID:
API String ID: 1351983003-0
Opcode ID: 6835721fcd8fc6aeef3918ccd5fb391dd5a2b0e2c6b47e1e3fffee1759d26798
Instruction ID: 220b576d5834fa2c8ffa494da510ed4b794aa8123be37cd0a3bea246836dbf4e
Opcode Fuzzy Hash: 6835721fcd8fc6aeef3918ccd5fb391dd5a2b0e2c6b47e1e3fffee1759d26798
Instruction Fuzzy Hash: 69512A71E00509AFDB04DFA4DD85BEEFBB8FF48314F108225E825A7290DB70A955CB90

Function 009EFD30 Relevance: 7.6, APIs: 5, Instructions: 125windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 009EFD8E
GetDlgItem.USER32(?,?), ref: 009EFDB3
SendMessageW.USER32(?,?,?,?), ref: 009EFE7D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: 1cfc3996eb7265f25d1ef78a0e4666a3c4b46d2fcbbf674a81e59255c63434ea
Instruction ID: 21727664bdacddc3d9de0fd6367c1c34eb5baaec1b7bb4d93c2addde98714102
Opcode Fuzzy Hash: 1cfc3996eb7265f25d1ef78a0e4666a3c4b46d2fcbbf674a81e59255c63434ea
Instruction Fuzzy Hash: 81416032200685EFDB168F56E8A4A66B7E9FB88311B04887FE546C6572D732FC50DB60

Function 00ADCCA0 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00ADCCD4
std::_Lockit::_Lockit.LIBCPMT ref: 00ADCCF6
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADCD1E
std::_Facet_Register.LIBCPMT ref: 00ADCE07
std::_Lockit::~_Lockit.LIBCPMT ref: 00ADCE31

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 41aa58fdcf3b81772b2e73ca99a4f2bf1e60b4d0313183ec4ef67a67037e82a0
Instruction ID: 8e5c51500eaf5a83d48cbc8f616d903ea5ec39c4193146bc61290169e0d8ece7
Opcode Fuzzy Hash: 41aa58fdcf3b81772b2e73ca99a4f2bf1e60b4d0313183ec4ef67a67037e82a0
Instruction Fuzzy Hash: 0D51BF71900259DFDB11CF58C840BAEBBF0FB10724F6481AED85AAB381E775AE05CB90

Function 00A37B30 Relevance: 7.6, APIs: 5, Instructions: 100threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A37B59
CoInitializeEx.COMBASE(00000000,00000002), ref: 00A37B69
SendMessageW.USER32(?,000005FA,?,00000000), ref: 00A37C81

Part of subcall function 00A46100: EnterCriticalSection.KERNEL32(C310823C,C310823C), ref: 00A46140
Part of subcall function 00A46100: GetCurrentThreadId.KERNEL32 ref: 00A46153
Part of subcall function 00A46100: LeaveCriticalSection.KERNEL32(?), ref: 00A461D1

Part of subcall function 00A40200: SetLastError.KERNEL32(0000000E,?,00A37BEF,?,?,00C0D550,00000000), ref: 00A40218

GetLastError.KERNEL32(?,?,00C0D550,00000000), ref: 00A37BF3
ShowWindow.USER32(?,0000000A,?,?,00C0D550,00000000), ref: 00A37C05

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalCurrentErrorLastSectionThread$EnterInitializeLeaveMessageSendShowWindow
String ID:
API String ID: 2782539745-0
Opcode ID: 530f6c3acd88fa6dbe0a64fc16b6e1783cf1ebf850daa2c65765072275b3afc1
Instruction ID: 076270cb98fd5ec8a15262ea53b05ad0f6b99285c98d2628aea1f7078970bc57
Opcode Fuzzy Hash: 530f6c3acd88fa6dbe0a64fc16b6e1783cf1ebf850daa2c65765072275b3afc1
Instruction Fuzzy Hash: AF31CEB1D00208EBEB15EFA4C95ABEEFBB4EF50308F104259F511AB2D1DBB55A44CB91

Function 009EDB80 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 009EDBE2
VariantClear.OLEAUT32(?), ref: 009EDC3B
VariantClear.OLEAUT32(?), ref: 009EDC45
VariantClear.OLEAUT32(?), ref: 009EDC4F
VariantClear.OLEAUT32(?), ref: 009EDC5C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: c0645a5be0a5ae5c609e7a00b14f80e9e4ce634215f8e20bc680fc501b893b72
Instruction ID: 6a6e1d5566c1f296b6569b727d5c7bd1d88691811ab0e24a0ac6b3ef5e283088
Opcode Fuzzy Hash: c0645a5be0a5ae5c609e7a00b14f80e9e4ce634215f8e20bc680fc501b893b72
Instruction Fuzzy Hash: D8310771D15248EFDB01CFA8C944BDEBBF8EF49304F14819AE410E7291D7B5AA04CBA1

Function 00A14A70 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A14ABA
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00A14AC0
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00A14AE3
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00BA7786,000000FF), ref: 00A14B0B
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00BA7786,000000FF), ref: 00A14B11

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: d71a83ac751285d7c783df3656dfaf5defb22329b1c2ae212c9b5c2d5c8db46d
Instruction ID: ef52e50feeadc04e8f199be702e0ff732c44ca7002e46d94efa7b61dc6146099
Opcode Fuzzy Hash: d71a83ac751285d7c783df3656dfaf5defb22329b1c2ae212c9b5c2d5c8db46d
Instruction Fuzzy Hash: 9D1160B0A49219ABEB10DF98CC42FAFBBFCEB04B04F104559F514A76C1D7B59A0487A0

Function 00A01090 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A0109B
SendMessageW.USER32(?,?,?,0000102B), ref: 00A010F8
SendMessageW.USER32(?,?,?,0000102B), ref: 00A01147
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00A01158
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00A01165

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a403ac8dd27e184045e8cd513a9e808797b9c75871dd846176124ffe0bf025ed
Instruction ID: aec4b56bb5df93acfe5d32436cc35f8a340d4989ec7de71b172497d9daf850e7
Opcode Fuzzy Hash: a403ac8dd27e184045e8cd513a9e808797b9c75871dd846176124ffe0bf025ed
Instruction Fuzzy Hash: 88213E31918746A6D220DF11CD45B5ABBE1BFEE758F202B0EF1D4211E4E7F191848E86

Function 00A06060 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Part of subcall function 00AC2A60: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00A00408,00000000,80004005), ref: 00AC2AC8
Part of subcall function 00AC2A60: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00AC2AF8

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00A0621D
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00A06234
SendMessageW.USER32(?,00001061,00000000,?), ref: 00A06290

Strings

QuickSelectionList, xrefs: 00A06152, 00A06164, 00A0616E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID: QuickSelectionList
API String ID: 3168177373-3633591268
Opcode ID: 111549c292bfccc1ca35a72e51800ec987c16e332a46421a8505df9e269d1b24
Instruction ID: 1c73646f4e8b738b600dca4cd9aec3c07de21d4c181202b2e595b4b177783ddd
Opcode Fuzzy Hash: 111549c292bfccc1ca35a72e51800ec987c16e332a46421a8505df9e269d1b24
Instruction Fuzzy Hash: E481AB71A002099FDB14DF68C884BEEF7F5FF88314F148269E515A7291CB75AD00CBA0

Function 00A39A90 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AE1F70: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00AE1FB4
Part of subcall function 00AE1F70: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00AE1FBF

GetCurrentThreadId.KERNEL32 ref: 00A39BFC
SendMessageW.USER32(?,00000127,00030003,00000000), ref: 00A39C85

Strings

AI_HIDE_CAPTION_ICON_AND_TEXT_ALL, xrefs: 00A39B29
AI_HIDE_CAPTION_ICON_AND_TEXT, xrefs: 00A39BA0

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$CurrentThread
String ID: AI_HIDE_CAPTION_ICON_AND_TEXT$AI_HIDE_CAPTION_ICON_AND_TEXT_ALL
API String ID: 2377075789-1831360935
Opcode ID: 6d173b7be06d358d702778e6a02c03708b02de3870ed3ea4ee1c2b6d9602bc4a
Instruction ID: dc1891705f250e1be79d5a680709d5208cc2c2ff96e4ee9c36ba7921544451e2
Opcode Fuzzy Hash: 6d173b7be06d358d702778e6a02c03708b02de3870ed3ea4ee1c2b6d9602bc4a
Instruction Fuzzy Hash: B3819471A04248DFCF05EF74C995BAEBBB5AF55300F1441A9E906AB293DB70AE04CB91

Function 00A3C560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A3C59E
SetWindowPos.USER32(?,00000000,?,?,?,00000008,00000604), ref: 00A3C778

Strings

AiDlgWeight, xrefs: 00A3C5C3
AiDlgHeight, xrefs: 00A3C698

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Rect
String ID: AiDlgHeight$AiDlgWeight
API String ID: 3200805268-871102398
Opcode ID: 89b1461dd90ee3c7958a8051c15bbc5c7a26769a9b6cc8a1121f447e926a71f8
Instruction ID: 94e78acd67593d00fcb747f2c83dec82e2da482183a7fac6456e4db6d95ea2e2
Opcode Fuzzy Hash: 89b1461dd90ee3c7958a8051c15bbc5c7a26769a9b6cc8a1121f447e926a71f8
Instruction Fuzzy Hash: 13618F71D00248DFCB14DFA9D985B9EBBB8EF48314F148269E815AB391D774AA08CF91

Function 00B206F0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,C310823C,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00B20724

Part of subcall function 00AE6130: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,?,80004005,?,?,?,00000000,00BDB90D,000000FF), ref: 00AE6148
Part of subcall function 00AE6130: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,?,80004005,?,?,?,00000000,00BDB90D,000000FF), ref: 00AE617A

Part of subcall function 009F2A50: RaiseException.KERNEL32(C310823C,C310823C,00000000,00000000,00B2197B,C000008C,00000001,C310823C), ref: 009F2A5C

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Strings

.jar, xrefs: 00B20BAC
*.*, xrefs: 00B2079A, 00B207AC, 00B207B4
.pack, xrefs: 00B20A61

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateExceptionHeapObjectRaiseSingleWait
String ID: *.*$.jar$.pack
API String ID: 2917691982-3892993289
Opcode ID: 99526446bfea2ccc7a811c64b447246c177692fca3c18e5f93329fc3c9397faa
Instruction ID: 468d7df999a8df19e27d7a03b58a53646344aae11f798fac2bc42d21c978cc3d
Opcode Fuzzy Hash: 99526446bfea2ccc7a811c64b447246c177692fca3c18e5f93329fc3c9397faa
Instruction Fuzzy Hash: 06515370A006599FDB10EFA9D844BAEF7F4FF44314F1442A9E425AB692D734ED05CB90

Function 00A45EC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(011CF5F8,C310823C,011CF5F8), ref: 00A45F01
GetCurrentThreadId.KERNEL32 ref: 00A45F11
LeaveCriticalSection.KERNEL32(?), ref: 00A45F37

Strings

v, xrefs: 00A45F37

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: b1fa064d40df7cf9fe102b372826d019d364404d5f28df384a8fc89a6f338d76
Instruction ID: 6934816b44e26871411b555879080e5697bff4c2efa329e789e5aaa524fe3044
Opcode Fuzzy Hash: b1fa064d40df7cf9fe102b372826d019d364404d5f28df384a8fc89a6f338d76
Instruction Fuzzy Hash: BF41C079900A15AFDB14DF68C944BAEF7A8FB84314F108329E825D7292E731ED58CB91

Function 009F2A70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 009F2AA6
EnterCriticalSection.KERNEL32(00C87250), ref: 009F2AC6
LeaveCriticalSection.KERNEL32(00C87250), ref: 009F2AEA

Strings

v, xrefs: 009F2AEA

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: feefe04cb1a0cf58e2fe029d67a5945570bc87f11dc86d0de88eec4bfbea7a49
Instruction ID: c0743d994bb3390431ad4f2ff2a4bffe6fd6d10d8a38de25f362b85483895a34
Opcode Fuzzy Hash: feefe04cb1a0cf58e2fe029d67a5945570bc87f11dc86d0de88eec4bfbea7a49
Instruction Fuzzy Hash: 8621A071908748DFCB20DF68DC41B9ABBE8FB05720F10466EE82597780E775A904CB90

Function 00A46100 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(C310823C,C310823C), ref: 00A46140
GetCurrentThreadId.KERNEL32 ref: 00A46153
LeaveCriticalSection.KERNEL32(?), ref: 00A461D1

Strings

v, xrefs: 00A461D1

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 199e11249d6b91bf9daaad3f6004c90303bedf5835602b8cd98cadf6f3f1739d
Instruction ID: 0732bd7be352f726d86dcd5aca1b77310d5895fd107de1ec15d4a5509f90937a
Opcode Fuzzy Hash: 199e11249d6b91bf9daaad3f6004c90303bedf5835602b8cd98cadf6f3f1739d
Instruction Fuzzy Hash: 9631BC75900244DFDB11CF6CC844BAEBBF4EF09314F144169E895A33A2E7B5AA04CB91

Function 00A14EE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00A14F22
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00A14F28

Strings

RoOriginateLanguageException, xrefs: 00A14F18
combase.dll, xrefs: 00A14F1D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: ba4503f0e5d14c8a305260d5f237cd1c2e7a4aefd19b08eef7cee83a4c7f74de
Instruction ID: 78de79ca3bcda5c312aaa9a24d512c6b48cdd1de778816180a032242a1d2b408
Opcode Fuzzy Hash: ba4503f0e5d14c8a305260d5f237cd1c2e7a4aefd19b08eef7cee83a4c7f74de
Instruction Fuzzy Hash: BE318EB1904219EFDF15DFA8C945BEEB7F4EF04710F108569E824A72D0DBB49A84CB91

Function 00B13390 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00B1152A,?,C310823C,?,?,?,000000FF,?,00B10EF4), ref: 00B1339D
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00B1152A,?,C310823C,?,?,?,000000FF,?,00B10EF4,?), ref: 00B133BE
GetLastError.KERNEL32(?,C310823C,?,?,?,000000FF,?,00B10EF4,?,?,00000000,00000000,C310823C,?,?), ref: 00B1341E

Strings

AdvancedInstaller, xrefs: 00B13406

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: d4aba8cfbeeb5ec12f34ba37f2362cac77dcf4a94a707f3557d9043615d82374
Instruction ID: 0548a91fb335f59adfac2804803c88b7b6a408fe4545117bd29777270506d06b
Opcode Fuzzy Hash: d4aba8cfbeeb5ec12f34ba37f2362cac77dcf4a94a707f3557d9043615d82374
Instruction Fuzzy Hash: A1115B71340602ABD325CF31DC89F9ABBE4FB84B14F604468F5159B290EBB1F991CB98

Function 00AC2970 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC2E80: __Init_thread_footer.LIBCMT ref: 00AC2F10
Part of subcall function 00AC2E80: GetProcAddress.KERNEL32(SetWindowTheme), ref: 00AC2F4D
Part of subcall function 00AC2E80: __Init_thread_footer.LIBCMT ref: 00AC2F64
Part of subcall function 00AC2E80: SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00AC2F8F

CreateWindowExW.USER32(80000000,SysListView32,?,00000000,00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00AC29C2
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00AC29E0
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00AC29E8

Part of subcall function 009F0E60: SetWindowLongW.USER32(?,000000FC,00000000), ref: 009F0E96

Strings

SysListView32, xrefs: 00AC29B9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$Init_thread_footerWindow$AddressCreateLongProc
String ID: SysListView32
API String ID: 605634508-78025650
Opcode ID: c0dd933eb3f0e770dfcb1807a0b137e9a76beb991c4056f6db651b5bdacddb1f
Instruction ID: 54f832ec3b9e1c4b3620ce3793903dd7d24834f0020280ee70ee1a679cd80d73
Opcode Fuzzy Hash: c0dd933eb3f0e770dfcb1807a0b137e9a76beb991c4056f6db651b5bdacddb1f
Instruction Fuzzy Hash: D1117C31301210BBD6149B15CC05F5BFFAAEBC9750F014619FA44AB2A1C6B1AC00CB90

Function 009F27E0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C87250), ref: 009F281C
GetCurrentThreadId.KERNEL32 ref: 009F2830
LeaveCriticalSection.KERNEL32(00C87250), ref: 009F286F

Strings

v, xrefs: 009F286F

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: v
API String ID: 2351996187-3261393531
Opcode ID: 6146467c8a57f0387cdadc5e1f023209c05fc90be1ff46c6878789b6d54be951
Instruction ID: 2af2867f623d35e7e8227090cd8d1f3a0424985da4a3d9fe2099dade514467b3
Opcode Fuzzy Hash: 6146467c8a57f0387cdadc5e1f023209c05fc90be1ff46c6878789b6d54be951
Instruction Fuzzy Hash: 0311C831D08344DBCB20CF65C84476ABBF4EB55B24F24466EE825A3390D7759C04C790

Function 00AC33D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(46030080,RichEdit20W,?,00000000,46030080,80000000,00000000,00000000,00000000,00000000,00000000), ref: 00AC341B
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00AC3433
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00AC343B

Part of subcall function 009F0E60: SetWindowLongW.USER32(?,000000FC,00000000), ref: 009F0E96

Strings

RichEdit20W, xrefs: 00AC3412

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSendWindow$CreateLong
String ID: RichEdit20W
API String ID: 4015368215-4173859555
Opcode ID: 2fd818632fd48b33f6f7264f89491eed2194520325dd28d82f51ac1ccb4c91b1
Instruction ID: 48dde8ccce2e149766485a500481ea9d3e340cb04bb006679b89537faa64565a
Opcode Fuzzy Hash: 2fd818632fd48b33f6f7264f89491eed2194520325dd28d82f51ac1ccb4c91b1
Instruction Fuzzy Hash: 80016935301214BFD6149B15DC04F6BFBEAFBC9B60F158219FA48A72A0C6B1EC00CBA5

Function 00A448F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A44941
GetParent.USER32(?), ref: 00A4494A
SendMessageW.USER32(?,00000411,00000000,?), ref: 00A4495F

Strings

,, xrefs: 00A44939

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Parent$MessageSend
String ID: ,
API String ID: 2251359880-3772416878
Opcode ID: dacd3a81c6c9279939505b115468590a6e57d627c963115994178e9e8d458b59
Instruction ID: ab9ded5d84a1fcd81483eec3e6e31eca8b762c233a77eed0ade4583b26bae929
Opcode Fuzzy Hash: dacd3a81c6c9279939505b115468590a6e57d627c963115994178e9e8d458b59
Instruction Fuzzy Hash: 3D1187B1504300AFD720DF28D844B1BFBE4FB8D310F00492AF56992662C7B1E854CF96

Function 00AFB670 Relevance: 6.4, APIs: 4, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

Part of subcall function 00AFB460: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000010), ref: 00AFB48D

_wcsrchr.LIBVCRUNTIME ref: 00AFB6DE
_wcsrchr.LIBVCRUNTIME ref: 00AFB73E
_wcschr.LIBVCRUNTIME ref: 00AFB9D2
_wcschr.LIBVCRUNTIME ref: 00AFBA5F

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer_wcschr_wcsrchr$FileHeapModuleNameProcess
String ID:
API String ID: 1360097548-0
Opcode ID: 6b0e1c0ec1b054312ed00b10534bdd1191ec7365a57146385781538596d06e11
Instruction ID: 10b4b7119d4a3f7adf4eaddd15990ecf989803c4490c39cb33f34f95edf75eaa
Opcode Fuzzy Hash: 6b0e1c0ec1b054312ed00b10534bdd1191ec7365a57146385781538596d06e11
Instruction Fuzzy Hash: 10F1927190024DDFDB00DFA8C849BAEBBF8EF44314F148269F915AB2D1EB709945CBA0

Function 00A00270 Relevance: 6.3, APIs: 4, Instructions: 291windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 00A003B8
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 00A003CD

Part of subcall function 009E9AE0: RtlAllocateHeap.NTDLL(?,00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,?,00C7ACAC,?,009F6B09,80004005,C310823C,-00000010,?), ref: 009E9B2A

Part of subcall function 00AC2A60: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00A00408,00000000,80004005), ref: 00AC2AC8
Part of subcall function 00AC2A60: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00AC2AF8

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00A00503
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 00A005FF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID:
API String ID: 3168177373-0
Opcode ID: 5ed42cbd147a6d7ed2831adb54fa05746ca9bb367836f9a6f103890d3e69e109
Instruction ID: cfef9feceb82b4440d8d44016148911d40778826ddfa7a2bf9f502dac9ebfe2c
Opcode Fuzzy Hash: 5ed42cbd147a6d7ed2831adb54fa05746ca9bb367836f9a6f103890d3e69e109
Instruction Fuzzy Hash: C9B17C71A006099FDB18CFA8D895FEEFBB5FF48314F144219E415AB2D0DBB5A944CBA0

Function 009EEFB0 Relevance: 6.3, APIs: 4, Instructions: 269memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 009EF07A
SysFreeString.OLEAUT32(00000000), ref: 009EF0C6
SysFreeString.OLEAUT32(00000000), ref: 009EF0E8
SysFreeString.OLEAUT32(00000000), ref: 009EF243

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: f78828e875fbdcb796288ac20a03e4ae123254f20f96d7f8f75adc1c7bf426f1
Instruction ID: d5f32f9fbb9f34c078173a4eae88907c369d4baed01636b8ec220e08acd749ef
Opcode Fuzzy Hash: f78828e875fbdcb796288ac20a03e4ae123254f20f96d7f8f75adc1c7bf426f1
Instruction Fuzzy Hash: B0A1BE71A00249EFDB11CFA9CC54BAFB7B8EF44714F10816AE515EB280E774AE01CB61

Function 00A08500 Relevance: 6.3, APIs: 4, Instructions: 268windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 00A085D8
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00A08607
SendMessageW.USER32(?,0000110A,00000004,?), ref: 00A087CE
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00A087F6

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6ec29c17f29b4d562737a7a546534d40f642315c64348ddfd81e096e19f5e111
Instruction ID: 37d028c2d79247fab131f59104d7439386ef3ac4ba86fe5a490c9728456db673
Opcode Fuzzy Hash: 6ec29c17f29b4d562737a7a546534d40f642315c64348ddfd81e096e19f5e111
Instruction Fuzzy Hash: 89A17B71A00218DFCB15DF68E884BEEBBB5BF48310F154569E842AB2D5DB34EC41CBA4

Function 00A04160 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A041BD
VariantClear.OLEAUT32(?), ref: 00A041EF
VariantClear.OLEAUT32(?), ref: 00A04407
VariantClear.OLEAUT32(?), ref: 00A04436

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 52fc9098e7fcbd6aae7963795941cc97b57ab1ca470380c6e38cf090926107d5
Instruction ID: e0bd31c4aaee99dde29e1b152fdb1135dac936d5a7f1e8866c376e7542fbe2be
Opcode Fuzzy Hash: 52fc9098e7fcbd6aae7963795941cc97b57ab1ca470380c6e38cf090926107d5
Instruction Fuzzy Hash: 40A168B4900258DFCB10DFA8C888BDEFBB4FF58314F258259E504A7391E7749A45CB95

Function 00A031F0 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00A0324A
VariantClear.OLEAUT32(?), ref: 00A0327C
VariantClear.OLEAUT32(?), ref: 00A033E5
VariantClear.OLEAUT32(?), ref: 00A03414

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 729422efa3f824461ac367a82b327615f8595bbc037071be60c51b2574c26212
Instruction ID: 8c93ff27e41bfc7a50f49af4bee7d0034aaa570199fd8623bda1be0b0e937f52
Opcode Fuzzy Hash: 729422efa3f824461ac367a82b327615f8595bbc037071be60c51b2574c26212
Instruction Fuzzy Hash: 8F81E271E00348DBDB11DFA8C844B9EFBB8EF44700F148258E815AB392E775AE45CB91

Function 00B0CDA0 Relevance: 6.2, APIs: 4, Instructions: 157registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,C310823C), ref: 00B0CE16
_wcsrchr.LIBVCRUNTIME ref: 00B0CE40
RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,00000000,00000000,?,00000001,?,00000000,00000000), ref: 00B0CEC3
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00B0CF0F

Part of subcall function 00B0CCC0: RegOpenKeyExW.ADVAPI32(00000000,C310823C,00000000,00020019,00000002,C310823C,00000001,00000010,00000002,00B0C00C,C310823C,00000000,?), ref: 00B0CD5C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Close$OpenQueryValue_wcsrchr
String ID:
API String ID: 213811329-0
Opcode ID: c1dd705e677ffe30909b4fb2f3147b9cd345ca79a6a85c3cc6fb3b996303ab6b
Instruction ID: dfedd52bdb67601fa128421d47e5555cc7647da1bceb69df695392039e6fd78b
Opcode Fuzzy Hash: c1dd705e677ffe30909b4fb2f3147b9cd345ca79a6a85c3cc6fb3b996303ab6b
Instruction Fuzzy Hash: FB51DF72901249AFDB10CF68C848B9EBFB5EF45320F1483A9E824A73D1C7759A04CB90

Function 00A7FEF0 Relevance: 6.1, APIs: 4, Instructions: 127COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A7FF82
GetWindowRect.USER32(?,?), ref: 00A7FF9A
GetWindowRect.USER32(?,?), ref: 00A80006
GetWindowLongW.USER32(?,000000EC), ref: 00A8002A

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Rect$Long
String ID:
API String ID: 3486571012-0
Opcode ID: 8d499ddf46aaadcbfc7d7c294b832443d711d33ddfae2f19cec512639a8836a5
Instruction ID: 7fc2f8cb7f7eacadf96e8323d2c347881fccdbfb7a826ada5f963a3dc990c666
Opcode Fuzzy Hash: 8d499ddf46aaadcbfc7d7c294b832443d711d33ddfae2f19cec512639a8836a5
Instruction Fuzzy Hash: 5A417C326087059FC700DF24D884B5FB7E8EF99705F05862DF94997251EB30EA858B52

Function 009FCF60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(C310823C,C310823C,?), ref: 009FCF9F
EnterCriticalSection.KERNEL32(?,C310823C,?), ref: 009FCFAC
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 009FD083

Strings

v, xrefs: 009FD083

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: adbf6978fd5ad9f710a3e0fdaf7fd844deed1ca415100802e4fb604002bb08ee
Instruction ID: 671e673bf0852b042d15682733c8330be60fa19b9feb120cccbb2e5db00661d4
Opcode Fuzzy Hash: adbf6978fd5ad9f710a3e0fdaf7fd844deed1ca415100802e4fb604002bb08ee
Instruction Fuzzy Hash: 1941CF7460170A8FCB21DF38C940BBABBA6EF45310F144569EA96D7391CF31A916CBA0

Function 00AFD570 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,?,00000000,00000000), ref: 00AFD5CF
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 00AFD5DC
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00AFD5F9
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00AFD61B

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 1f0f3b7452030632b4148d912e3b151a4614ca79c550e7d0f9ffa5d690174e32
Instruction ID: 62c161474d7d51d5a0fdb0597c9f74c1bd12f64ac140a48bcadb47ea9b09a5d8
Opcode Fuzzy Hash: 1f0f3b7452030632b4148d912e3b151a4614ca79c550e7d0f9ffa5d690174e32
Instruction Fuzzy Hash: BB2125B274030A7BEB116F94DC82F76B75EEB54B44F240129FB05AB1C0EBA17D15CAA4

Function 00A36404 Relevance: 6.1, APIs: 4, Instructions: 98COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000010,?,00000060), ref: 00A36432
GetWindowRect.USER32(?,?), ref: 00A36481
GetWindowLongW.USER32(?,000000EC), ref: 00A364AA
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,?,00000060), ref: 00A3653C

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$LongRect
String ID:
API String ID: 463821813-0
Opcode ID: fb454fbde8bb5c61f374f8da0efb9fddf06878fe8c3e2de8e49738cefbde3e39
Instruction ID: ce31514a2da22d2a703cc936a1bff6739516f0c34594883d75ddac5cc3754c03
Opcode Fuzzy Hash: fb454fbde8bb5c61f374f8da0efb9fddf06878fe8c3e2de8e49738cefbde3e39
Instruction Fuzzy Hash: 1E412571508745AFD705DF29DD85B6ABBB8FF88300F408A1AF98593260DB31E895CB92

Function 00AE6130 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,?,80004005,?,?,?,00000000,00BDB90D,000000FF), ref: 00AE6148
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,?,80004005,?,?,?,00000000,00BDB90D,000000FF), ref: 00AE617A
GetStdHandle.KERNEL32(000000F5,?,C310823C,00000000,00B9E9A0,000000FF,?,80070057,?,-00000001,?,?,?,80004005,?,?), ref: 00AE61E6
SetConsoleTextAttribute.KERNEL32(00000000,?,C310823C,00000000,00B9E9A0,000000FF,?,80070057,?,-00000001,?,?,?,80004005,?,?), ref: 00AE61ED

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ByteCharMultiWide$AttributeConsoleHandleText
String ID:
API String ID: 3849414675-0
Opcode ID: d32bf569c65d7c6abfb97cb1c9e9bcbadcdecd32646ef6e06e527d7d27a41a6a
Instruction ID: 5c6279e53bc9566aadb62d32e8722b813a45a9328fd6fc06c6e1992b6eaa1fd6
Opcode Fuzzy Hash: d32bf569c65d7c6abfb97cb1c9e9bcbadcdecd32646ef6e06e527d7d27a41a6a
Instruction Fuzzy Hash: 8D21F372304251BFDB11CB99DC49F6AB769EB85761F20432EF626E72D0CB316901CBA0

Function 00A399A0 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A39A2F
GetParent.USER32(00000000), ref: 00A39A37
GetParent.USER32(00000000), ref: 00A39A3C
SendMessageW.USER32(00000000,0000037F,00000000,?), ref: 00A39A4D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: 4fc2be879b2cd8983c126f65d63fe5ddef8a30761403b331b7c6581b9a7202c8
Instruction ID: 7e6d08c093f8dbb0263686d3979e76756437df0608954ea11931c9543a23d0b2
Opcode Fuzzy Hash: 4fc2be879b2cd8983c126f65d63fe5ddef8a30761403b331b7c6581b9a7202c8
Instruction Fuzzy Hash: F221BE32700115AFDB249B28EC84FAFF799EF91754F444626F505C2260EBB1DD928764

Function 009FCD90 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,C310823C), ref: 009FCDFA
EnterCriticalSection.KERNEL32(?,C310823C), ref: 009FCE07
LeaveCriticalSection.KERNEL32(?), ref: 009FCE58

Strings

v, xrefs: 009FCE58

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: ba082186ede285b5c00192a55801b67be058ba6c10c5c330e5374add6450bd25
Instruction ID: 2642ad9f29e0ec00157a0931e607b27899a0d5f3b0cf9c8a159526705d23d284
Opcode Fuzzy Hash: ba082186ede285b5c00192a55801b67be058ba6c10c5c330e5374add6450bd25
Instruction Fuzzy Hash: 4621F4769002499FDF11CF24C940BEABBB4FF56324F5041A9ED59AB392C7319D09CBA0

Function 009FCE80 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,C310823C), ref: 009FCEEA
EnterCriticalSection.KERNEL32(?,C310823C), ref: 009FCEF7
LeaveCriticalSection.KERNEL32(?), ref: 009FCF3E

Strings

v, xrefs: 009FCF3E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: 97a366dc07b555a6258d482f5edd1a3ea082a7fa0d41833a5660e01ac8096d7d
Instruction ID: 22649e6d20a98e288338432d2ea40716f9b42555038ed4fad504030f23c5c57b
Opcode Fuzzy Hash: 97a366dc07b555a6258d482f5edd1a3ea082a7fa0d41833a5660e01ac8096d7d
Instruction Fuzzy Hash: 5F21CF769002499FDF11CF24C940BA9BBB4FF15324F6045A9ED59AB392DB319909CBA0

Function 009FCCD0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,C310823C,?), ref: 009FCD2D
EnterCriticalSection.KERNEL32(?,C310823C,?), ref: 009FCD3A
LeaveCriticalSection.KERNEL32(?), ref: 009FCD62

Strings

v, xrefs: 009FCD62

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: v
API String ID: 3991485460-3261393531
Opcode ID: a032a8e2487af9c381fdc8e2ece0810d7eec0bedd4e4339141e1ea5c68e79b69
Instruction ID: 2ef51ec92f7ed1efaee9434066472fe741022b000cf2efa729820f0fd1fca419
Opcode Fuzzy Hash: a032a8e2487af9c381fdc8e2ece0810d7eec0bedd4e4339141e1ea5c68e79b69
Instruction Fuzzy Hash: 322106769042499FCF11CF24C940BEEBF74EB56324F1045A9D859A7381CB325A09CBA0

Function 00B22070 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,?,C310823C,?,?,00000000,Function_001BE7D0,000000FF,?,00B22058,00000000,80004005,?,?,00B0485D,?), ref: 00B220A7
GetExitCodeThread.KERNEL32(00000001,00B22058,?,?,00000000,Function_001BE7D0,000000FF), ref: 00B220C1
TerminateThread.KERNEL32(00000001,00000000,?,?,00000000,Function_001BE7D0,000000FF), ref: 00B220D9
CloseHandle.KERNEL32(00000001,?,?,00000000,Function_001BE7D0,000000FF,?,00B22058,00000000,80004005,?,?,00B0485D,?,C310823C,?), ref: 00B220E2

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: 0103a7f8559f2408872fa5da6696262e423d40ae3aca455696288852b56dacd3
Instruction ID: ae667b5437f2530c261960cd2407a9ffb55acc32802206dd4cc65c395292ba26
Opcode Fuzzy Hash: 0103a7f8559f2408872fa5da6696262e423d40ae3aca455696288852b56dacd3
Instruction Fuzzy Hash: 7D015271500615EFDB208F54EC49B67B7F8FB04710F10866AE869D3AA0DB75AC40CB54

Function 009ED8F0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 009ED966
SendMessageW.USER32(?,00000000,00000000), ref: 009EDA62

Part of subcall function 009EF1A0: SysFreeString.OLEAUT32(00000000), ref: 009EF243

Strings

AtlAxWin140, xrefs: 009ED95E

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140
API String ID: 4045344427-3842940177
Opcode ID: 2ec8d041b70e514c1c7620c5e6388f48c107a4694bfe55f8629a8d4c782226b1
Instruction ID: d391b141bffd933477dbc1637d70c06abc8cb4cbf3431e140b0fdc68d1934787
Opcode Fuzzy Hash: 2ec8d041b70e514c1c7620c5e6388f48c107a4694bfe55f8629a8d4c782226b1
Instruction Fuzzy Hash: 4C912574600249EFDB14CF69C888F6ABBB9FF49714F1085A9F9299B291C771ED01CB50

Function 00A4EF10 Relevance: 5.4, APIs: 4, Instructions: 419memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00A4F126
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00A4F12C

Part of subcall function 00A50AC0: GetProcessHeap.KERNEL32(?,?,C310823C,00000000), ref: 00A50B7A
Part of subcall function 00A50AC0: HeapFree.KERNEL32(00000000,?,?,C310823C,00000000), ref: 00A50B80

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A4F337
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00A4F33D

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: ce9ae7177dc91475ea9765282e98923be0119b90307f2ef038e4fdbaaa791d2e
Instruction ID: 9a5250000cf5362e062bfd373e66cd032c5f64d12199003476ae7b2e9fb54b8e
Opcode Fuzzy Hash: ce9ae7177dc91475ea9765282e98923be0119b90307f2ef038e4fdbaaa791d2e
Instruction Fuzzy Hash: DDF16974D00249DFDB04DFA8C945BEEBBB4FF55314F2042A9E815AB291DB74AE04CB91

Function 00B183E0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 009E9E20: GetProcessHeap.KERNEL32 ref: 009E9E75
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9EA7
Part of subcall function 009E9E20: __Init_thread_footer.LIBCMT ref: 009E9F32

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00BE240F,000000FF), ref: 00B18563
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00BE240F,000000FF), ref: 00B185F1

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00B184CF

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: 495cda73bd144353922c31ef5f681170abdeca17748d9e3c9f1de29438c25394
Instruction ID: b16eea7f1b875725afeb8d3f21d74beff29eb16be959ac8aefe3dd8ea99b7f76
Opcode Fuzzy Hash: 495cda73bd144353922c31ef5f681170abdeca17748d9e3c9f1de29438c25394
Instruction Fuzzy Hash: B361ABB0905685DFDB01CFA8D948B9EBBF4FF45314F2482ADE4049B392EB759A44CB90

Function 00A2D0F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00B77112: EnterCriticalSection.KERNEL32(00C85CD8,-00000010,?,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?), ref: 00B7711D
Part of subcall function 00B77112: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9EC6,00C86904,C310823C,?,?,00B9EF2D,000000FF,?,009F6A8F,C310823C,-00000010,?,?,00000008), ref: 00B7715A

__Init_thread_footer.LIBCMT ref: 00A2D24D

Part of subcall function 00B770C8: EnterCriticalSection.KERNEL32(00C85CD8,?,?,009E9F37,00C86904,00BF7320), ref: 00B770D2
Part of subcall function 00B770C8: LeaveCriticalSection.KERNEL32(00C85CD8,?,009E9F37,00C86904,00BF7320), ref: 00B77105
Part of subcall function 00B770C8: RtlWakeAllConditionVariable.NTDLL ref: 00B7717C

Strings

Windows.UI.Xaml.Controls.ListViewItem, xrefs: 00A2D216
ItemData, xrefs: 00A2D2B2

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: ItemData$Windows.UI.Xaml.Controls.ListViewItem
API String ID: 2296764815-2445763458
Opcode ID: bd2a55999595034746667bd018d5a3831c5441e6c5c90949f233393f464e68f5
Instruction ID: 7e7ad776fc060863b4ffe39dec7b21ba1cf2a0f1b2d89cbce772036aa3302403
Opcode Fuzzy Hash: bd2a55999595034746667bd018d5a3831c5441e6c5c90949f233393f464e68f5
Instruction Fuzzy Hash: A771B3B0905249EFDB01CFA8D9447DEBBF0BF14304F148269E814672D2D7B99B08DBA2

Function 00AD4AB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,C310823C), ref: 00AD4B51

Strings

\\?\UNC\, xrefs: 00AD4B78, 00AD4BD9
\\?\, xrefs: 00AD4C48, 00AD4C73

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: 24739c16d3cf3695f7019d4c4c4ecea4f3b63b9b3ed5bae3024d3f7c82ae22c9
Instruction ID: f5fbb9e4f3588cb9eb1fc037fb0fb50f571288f534a10401d7999b1a14f3126b
Opcode Fuzzy Hash: 24739c16d3cf3695f7019d4c4c4ecea4f3b63b9b3ed5bae3024d3f7c82ae22c9
Instruction Fuzzy Hash: 4F51D470D106049BDB14DF68D885BAEF7F5FF98304F10861ED81667381EB75A948CBA1

Function 009F7200 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,?,00000002,00C0438C,00000000,00000000,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033,C310823C), ref: 009F7370

Part of subcall function 00ACEBE0: GetModuleHandleW.KERNEL32(Advapi32.dll,C310823C,?,?,?,00000000,?,Function_001BEE20,000000FF), ref: 00ACEC23

CloseHandle.KERNEL32(?,C310823C), ref: 009F73A9

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 009F7268

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: CloseHandle$Module
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current
API String ID: 1412095732-2431777889
Opcode ID: 48e980e0dbebb4f2421ab767658eeab87a4e6edad46bf7617269ff4ade8c8036
Instruction ID: 08ff11909160de06f829abaa985ec386d4755d55cd57447c8c2968982d863b9f
Opcode Fuzzy Hash: 48e980e0dbebb4f2421ab767658eeab87a4e6edad46bf7617269ff4ade8c8036
Instruction Fuzzy Hash: 4E514970D04248EBDB20DFA4D959BEEFBB8BF14304F10819DE555A7281DBB46A48CBA1

Function 00AE8250 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,C310823C,00C1A83C), ref: 00AE82A8
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00AE83B2

Part of subcall function 00ADAA10: std::locale::_Init.LIBCPMT ref: 00ADAAED

Part of subcall function 00AD81D0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00AD82A5

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 00AE82C6

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-3373098694
Opcode ID: 32f064fee35af2569cbad6fd2199eb571e8b1e1ca7af8c6c87541e0de82971bf
Instruction ID: 916e2cbd6852d2cc86bbb0c2d24629238703eb54ac9808dacfc37da825f163a2
Opcode Fuzzy Hash: 32f064fee35af2569cbad6fd2199eb571e8b1e1ca7af8c6c87541e0de82971bf
Instruction Fuzzy Hash: B7416F71A003499BDB20DF68C909BAFBBF8FF44704F104559E459AB391DBB89A08CB91

Function 00B32EF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000001,_pbl_evt,00000008,?,?,00C1B440,00000001,C310823C,00000000), ref: 00B32F9E
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00B32FBB

Strings

_pbl_evt, xrefs: 00B32F72

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: dbd7bb049f1d7273c017e7b70f34596b916ab5b473b3ca45758217a35da2c4c7
Instruction ID: 24257aea7fc08a069132692100368675393fe22d16f8d32338b7937d0e0b5dec
Opcode Fuzzy Hash: dbd7bb049f1d7273c017e7b70f34596b916ab5b473b3ca45758217a35da2c4c7
Instruction Fuzzy Hash: 92313A71D04248EFDB11DFA8D955BEEB7B8EF14714F208159E811B7280DB746A09CBA1

Function 00AD7770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00AD779B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00AD77FE

Strings

bad locale name, xrefs: 00AD7821

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: b48442c45eccb518b239e0dca1341c8e4f6b9d18f3a50ea86870ad64bd56b91a
Instruction ID: 5b8fcb4a9a72ff72ab68e8eb5f8f1f352ba51596dd15e226311f3817a7971aec
Opcode Fuzzy Hash: b48442c45eccb518b239e0dca1341c8e4f6b9d18f3a50ea86870ad64bd56b91a
Instruction Fuzzy Hash: AD21BD70A05784DFD720CF68C90474EBFE4AF15714F14869EE49A8BB81E3B5EA04DBA1

Function 00A4E3B0 Relevance: 5.3, APIs: 4, Instructions: 316memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 00A4E62B
HeapFree.KERNEL32(00000000,?,?), ref: 00A4E631
GetProcessHeap.KERNEL32(?,?), ref: 00A4E700
HeapFree.KERNEL32(00000000,?,?), ref: 00A4E706

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 06278bcf23b390710f2648c2d18ce5e0e72a77d54393bc6666519ea4fc573b80
Instruction ID: 6bd6539fabdc14347c39299681a2481cdc443289170cde7d6d44b525ba05049f
Opcode Fuzzy Hash: 06278bcf23b390710f2648c2d18ce5e0e72a77d54393bc6666519ea4fc573b80
Instruction Fuzzy Hash: 10D18A74900248DFDF14DFA8C994BEEBBB5BF94314F2441ADE005AB292DB70AE45CB91

Function 00A014E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetParent.USER32(00000005), ref: 00A01554

Strings

d, xrefs: 00A01520
D:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00A01529

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Parent
String ID: D:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3547446826
Opcode ID: 74ea2a23ab7a59765447df24e1553fdf1307d0a333444cf97de687f62f0509d5
Instruction ID: 7aaa827fa5a79e420e45b33c606504cf9caec81b541c467c34c351ad01d1bba4
Opcode Fuzzy Hash: 74ea2a23ab7a59765447df24e1553fdf1307d0a333444cf97de687f62f0509d5
Instruction Fuzzy Hash: 9E213BB4D05298EFDF00CFE4D9487CEBBB0BF55308F148058E002AB296D7B95A08CB91

Function 009ED349 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 009ED3BA

Strings

D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 009ED395
d, xrefs: 009ED389

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ActiveWindow
String ID: D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4014065217
Opcode ID: 5041a87ad5f679b5b714f5c9ad2e9eec17c328e3d5906c6be7857150f7b40cc2
Instruction ID: e8b9223d807025e053b7af590995a77b36f0bbb0ebf73e5878b03556f81b3e2a
Opcode Fuzzy Hash: 5041a87ad5f679b5b714f5c9ad2e9eec17c328e3d5906c6be7857150f7b40cc2
Instruction Fuzzy Hash: 522138B4D05298EFDF05DFE4E9587DEBBB0BF15304F108058D0016B296D7B85A08CB92

Function 009ECF7B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 009ECFE9

Strings

d, xrefs: 009ECFBB
D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 009ECFC4

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ActiveWindow
String ID: D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4014065217
Opcode ID: cb55ff92efe384fa5ca8dcdf9687d26ebb2524dc6ba5c7e68007b742b5e3f21f
Instruction ID: 1f40623ce9e9024bf22840402283abb95979d1b2691be4afde4c669fe098fa8e
Opcode Fuzzy Hash: cb55ff92efe384fa5ca8dcdf9687d26ebb2524dc6ba5c7e68007b742b5e3f21f
Instruction Fuzzy Hash: 15211AB4D05298EFDF05DFE4E9587DEBBB1BF15304F144058D0016B296D7B95A08CB92

Function 00A015AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000D), ref: 00A0161B

Strings

d, xrefs: 00A015E5
D:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00A015EE

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Parent
String ID: D:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3547446826
Opcode ID: 5485b1f78c2dfc3ae219d2ca9ab53d3b9227fae63f255ec87f42d61750c93e89
Instruction ID: e236ba10d967bb6172edde79e36fd2f0f3f3acab268c4ba273f65550da83b1c3
Opcode Fuzzy Hash: 5485b1f78c2dfc3ae219d2ca9ab53d3b9227fae63f255ec87f42d61750c93e89
Instruction Fuzzy Hash: 742113B4D01288EEDF01DFE4D958BDEBFB0BF15308F148058E0026B296D7B95A09DB92

Function 009ED412 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 009ED480

Strings

d, xrefs: 009ED44D
D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 009ED459

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ActiveWindow
String ID: D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4014065217
Opcode ID: 8c8c6c553e2385ee98c28b08af0b2675e369aabe468074f2bc95e788df4ec03a
Instruction ID: 3bf5a0144da569a2fa2a8ff37764d30287da389210a1bab31f65f800e2caefdd
Opcode Fuzzy Hash: 8c8c6c553e2385ee98c28b08af0b2675e369aabe468074f2bc95e788df4ec03a
Instruction Fuzzy Hash: C32144B0D05298EEDF05DFE4D9987CEBBB0BF54308F108158E0016B296DBB84A09DB92

Function 009ED03F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 009ED0AA

Strings

d, xrefs: 009ED07A
D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 009ED083

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ActiveWindow
String ID: D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4014065217
Opcode ID: f515b098c8d6f2bc0d5c9e7286e93e338e18ef588719a3968eb656ae0fde0ef0
Instruction ID: e59d9f5a86a692120d1f3cbae03c548a4d24fa5445bdedae5f1a07959062d0c4
Opcode Fuzzy Hash: f515b098c8d6f2bc0d5c9e7286e93e338e18ef588719a3968eb656ae0fde0ef0
Instruction Fuzzy Hash: B12114B4D05298EEDF05DFE4E9587DEBFB0BF15308F148058E0016B296DBB94A09DB52

Function 00A41310 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A4136F
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,00A3FEE9,00000000,C310823C,?,?), ref: 00A41388

Strings

tooltips_class32, xrefs: 00A41366

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Window$Create
String ID: tooltips_class32
API String ID: 870168347-1918224756
Opcode ID: 802e200031c1a55ade95bcf93a609e3099b9e5ca047c15fc747bc80d647b35e7
Instruction ID: 2cb83486914b9e830dff80d365bd7b1651c6e3de5953328f5c256e8d18f60bef
Opcode Fuzzy Hash: 802e200031c1a55ade95bcf93a609e3099b9e5ca047c15fc747bc80d647b35e7
Instruction Fuzzy Hash: 5101F0323803127AF7648664DC0AFAA3298D780B41F308238BB04FD0D0D6E6AA10C608

Function 00A01671 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000013), ref: 00A016A4

Strings

Unknown exception, xrefs: 00A01679
D:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00A01689

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Parent
String ID: D:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-3529215713
Opcode ID: bf1378e30c0ee8c3bb0375d225bb2c87ae522ba839770ac6d83e0ed759565df0
Instruction ID: 28bb3acfb45f8186802a44793498c186f4520a034613a32f9323da5a7ab1b099
Opcode Fuzzy Hash: bf1378e30c0ee8c3bb0375d225bb2c87ae522ba839770ac6d83e0ed759565df0
Instruction Fuzzy Hash: 75015E34D0528CEFCB05DBE4D955BDDBBB0AF55304F548098E0026B296D7B55E08DB92

Function 009ED4D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 009ED508

Strings

Unknown exception, xrefs: 009ED4E0
D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 009ED4F3

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ActiveWindow
String ID: D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-1308700304
Opcode ID: b04ce06d6f627c77df2304a5b5cfa1e8425e8b77c375a7501543ddf0e2676d4b
Instruction ID: 7911e34d51c3db7cda17b98f88cc55989581605d548dfd67599e42275ee96fec
Opcode Fuzzy Hash: b04ce06d6f627c77df2304a5b5cfa1e8425e8b77c375a7501543ddf0e2676d4b
Instruction Fuzzy Hash: FB018030D0528CEBCB06EBE4D955BCEBFB56FA5300F148198D1016B386DBB45A08DB92

Function 009ED100 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 009ED12D

Strings

Unknown exception, xrefs: 009ED108
D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 009ED118

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: ActiveWindow
String ID: D:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-1308700304
Opcode ID: b79862c61355628a00277c90b0a6d9d1a21ce7ccab71307d226fca747dba37b2
Instruction ID: 483eb411aa8aa36f34ef10521606a51ce0393f24f5894c57b6c876b88cad5671
Opcode Fuzzy Hash: b79862c61355628a00277c90b0a6d9d1a21ce7ccab71307d226fca747dba37b2
Instruction Fuzzy Hash: 1C019230D0528CEBCF05DBE4D9547DEBFB56F65304F144098D0016B286DBB44A04D792

Function 00A21EB0 Relevance: 5.2, APIs: 4, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 00A220B1
HeapFree.KERNEL32(00000000,?,?), ref: 00A220B7
GetProcessHeap.KERNEL32(?,?), ref: 00A22143
HeapFree.KERNEL32(00000000,?,?), ref: 00A22149

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 60a22f1096a8c0e86c29b3218569a7905d1b54e016e54450414fc4b7fcb6cff8
Instruction ID: e716b54ec3878f7e8c2dd04ade5600c6ce33f392a5f7c7b0cb4602553e37cd6e
Opcode Fuzzy Hash: 60a22f1096a8c0e86c29b3218569a7905d1b54e016e54450414fc4b7fcb6cff8
Instruction Fuzzy Hash: 6791EFB0D05258EFDB15DFA8E944BEEFBB4FF44314F10426AE42167291DB70AA45CBA0

Function 00A20CD0 Relevance: 5.2, APIs: 4, Instructions: 171memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?), ref: 00A20E11
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 00A20E17
GetProcessHeap.KERNEL32(?,?,?,?), ref: 00A20EA3
HeapFree.KERNEL32(00000000,?,?,?,?), ref: 00A20EA9

Memory Dump Source

Source File: 00000000.00000002.1791892865.00000000009E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000000.00000002.1791872045.00000000009E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792072343.0000000000BF9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792130415.0000000000C7F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792154217.0000000000C84000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792173386.0000000000C85000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1792191488.0000000000C88000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9e0000_dK5DtwHlOm.jbxd

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 8f6be33f931e586d723a55a4b9204de4e2022eb256e34bf11fb7dc88c1722d04
Instruction ID: 46b788a407815e6f3d17dea2a1880dc55da8782752a3c5e22fd090894ce7f19e
Opcode Fuzzy Hash: 8f6be33f931e586d723a55a4b9204de4e2022eb256e34bf11fb7dc88c1722d04
Instruction Fuzzy Hash: FA61F0B0D02268EFDF19DFA8E944FDEFBB5AF00310F104569E41167282CB34AA45CBA0

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report dK5DtwHlOm.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSI9977.tmp

C:\Users\user\AppData\Local\Temp\MSI99D6.tmp

C:\Users\user\AppData\Local\Temp\MSIb9e58.LOG

C:\Users\user\AppData\Local\Temp\shi9909.tmp

C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\9629E8B\Installer.msi

C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\decoder.dll

C:\Users\user\AppData\Roaming\Restricted editor savers\EditPro Ai 1.131.2\install\holder0.aiph

C:\Windows\Installer\5b9aaf.msi

C:\Windows\Installer\MSI9D2F.tmp

C:\Windows\Installer\MSI9DCC.tmp

C:\Windows\Installer\MSI9E0C.tmp

C:\Windows\Installer\MSI9E2C.tmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Windows Analysis Report
dK5DtwHlOm.exe

Function 00B1C120 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 550
COMMON

Function 00B0FD20 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Function 00B20560 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 43
libraryCOMMON

Function 00B04F10 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Function 00B1B490 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 161
COMMON

Function 00AE3B70 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Function 00AE3F50 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Function 00B05820 Relevance: 37.0, APIs: 2, Strings: 19, Instructions: 220
COMMON

Function 00AF7360 Relevance: 16.3, APIs: 8, Strings: 1, Instructions: 509
COMMON

Function 00AE4FA0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 324
fileCOMMON

Function 00B7654A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Function 00B21990 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Function 00B036B0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 238
fileCOMMON

Function 00B200C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON