Edit tour

Windows Analysis Report
RIv8fq9APB.exe

Overview

General Information

Sample name:	RIv8fq9APB.exe renamed because original name is a hash value
Original sample name:	895dccfa0aa2a7dfc4be56e0cf045dcbaf40a7ef23849ad30a3af38793fd214c.exe
Analysis ID:	1554995
MD5:	607a6e4ea1d6aa1393f54ad0c3b51dd7
SHA1:	d3eefc0bd98d2d176483a80fa6f9e984d1e66e9a
SHA256:	895dccfa0aa2a7dfc4be56e0cf045dcbaf40a7ef23849ad30a3af38793fd214c
Tags:	ConsolHQLTDexeuser-JAMESWT_MHT
Infos:

Detection

Score:	13
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

RIv8fq9APB.exe (PID: 6688 cmdline: "C:\Users\user\Desktop\RIv8fq9APB.exe" MD5: 607A6E4EA1D6AA1393F54AD0C3B51DD7)

msiexec.exe (PID: 6636 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\RIv8fq9APB.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488877 " AI_EUIMSI="" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6372 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 6420 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 514532DC5754F2DEA5310FF5234A96F5 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1432 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 83139F07849E8D7972AAA3545112F408 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:10:20.237361+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49724	TCP
2024-11-13T10:10:58.949766+0100	2022930	1	A Network Trojan was detected	4.245.163.56	443	192.168.2.7	49947	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: RIv8fq9APB.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: RIv8fq9APB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: RIv8fq9APB.exe, 00000000.00000003.1280440752.0000000005744000.00000004.00000020.00020000.00000000.sdmp, shi44B7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: RIv8fq9APB.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI48C1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI48C1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr
Source:	Binary string: wininet.pdbUGP source: RIv8fq9APB.exe, 00000000.00000003.1280440752.0000000005744000.00000004.00000020.00020000.00000000.sdmp, shi44B7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: RIv8fq9APB.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: RIv8fq9APB.exe

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003243B0 FindFirstFileW,GetLastError,FindClose,	0_2_003243B0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00342380 FindFirstFileW,FindClose,	0_2_00342380
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0023A950 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,	0_2_0023A950
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003414D0 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_003414D0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00323DE0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00323DE0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0032C0B0 FindFirstFileW,FindClose,FindClose,	0_2_0032C0B0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0033E3A0 FindFirstFileW,FindClose,	0_2_0033E3A0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0034E610 FindFirstFileW,FindClose,	0_2_0034E610
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0034B3D0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_0034B3D0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0034B7D0 FindFirstFileW,FindClose,	0_2_0034B7D0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00323A50 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00323A50
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0035FB20 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_0035FB20

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_0034A620 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_0034A620

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49724
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.7:49947

Source: RIv8fq9APB.exe, 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmp, RIv8fq9APB.exe, 00000000.00000000.1234564064.0000000000438000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: 4Shlwapi.dllShell32.dllmsiexec.exebinJavaHomeSoftware\JavaSoft\Java Development Kit\Software\JavaSoft\Java Runtime Environment\FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: RIv8fq9APB.exe	String found in binary or memory: RShlwapi.dllShell32.dllmsiexec.exebinJavaHomeSoftware\JavaSoft\Java Development Kit\Software\JavaSoft\Java Runtime Environment\FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: shi44B7.tmp.0.dr	String found in binary or memory: http://.css
Source: shi44B7.tmp.0.dr	String found in binary or memory: http://.jpg
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shi44B7.tmp.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://t2.symcb.com0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://tl.symcd.com0&
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003615E0 NtdllDefWindowProc_W,	0_2_003615E0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002E1FB0 GetSystemDirectoryW,_wcschr,LoadLibraryExW,NtdllDefWindowProc_W,	0_2_002E1FB0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00280010 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00280010
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00232250 NtdllDefWindowProc_W,	0_2_00232250
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0023C4F0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_0023C4F0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00238720 NtdllDefWindowProc_W,	0_2_00238720
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00238890 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00238890
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00280BAA ShowWindow,ShowWindow,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00280BAA
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0022EBE0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_0022EBE0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00280C22 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00280C22
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00280CE3 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00280CE3
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00276EE0 NtdllDefWindowProc_W,	0_2_00276EE0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0022F190 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	0_2_0022F190
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0024D320 NtdllDefWindowProc_W,	0_2_0024D320
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002415F0 NtdllDefWindowProc_W,	0_2_002415F0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00231670 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_00231670
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0022F7C0 NtdllDefWindowProc_W,	0_2_0022F7C0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00231C90 NtdllDefWindowProc_W,	0_2_00231C90
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002C7F20 NtdllDefWindowProc_W,	0_2_002C7F20

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\5646f9.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4812.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4871.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48A1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48C1.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI4812.tmp

Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0023A950	0_2_0023A950
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0035B350	0_2_0035B350
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00337D70	0_2_00337D70
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00246070	0_2_00246070
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002441B0	0_2_002441B0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003BE2BE	0_2_003BE2BE
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0023E290	0_2_0023E290
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003BE64C	0_2_003BE64C
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00302A50	0_2_00302A50
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003D8B95	0_2_003D8B95
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00238CD0	0_2_00238CD0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00222F40	0_2_00222F40
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002552F0	0_2_002552F0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0039D550	0_2_0039D550
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002435A0	0_2_002435A0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003D3631	0_2_003D3631
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00247630	0_2_00247630
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002FB7A0	0_2_002FB7A0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0027FA40	0_2_0027FA40
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003CDD6A	0_2_003CDD6A
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00293FC0	0_2_00293FC0

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 00227070 appears 53 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 0031E6D0 appears 60 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 00226FF0 appears 46 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 002299C0 appears 69 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 00229390 appears 41 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 0031E770 appears 31 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 00253810 appears 90 times
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: String function: 00228800 appears 223 times

Source: RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1280440752.0000000005744000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameInstaller.exe@ vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe, 00000000.00000003.1236810027.0000000001124000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDecoder.dllF vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe	Binary or memory string: OriginalFileNameInstaller.exe@ vs RIv8fq9APB.exe
Source: RIv8fq9APB.exe	Binary or memory string: OriginalFilenameDecoder.dllF vs RIv8fq9APB.exe

Source: RIv8fq9APB.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: shi44B7.tmp.0.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: clean13.winEXE@8/13@0/0

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_00322230 FormatMessageW,GetLastError,

0_2_00322230

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_0034C990 GetDiskFreeSpaceExW,

0_2_0034C990

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_00366D50 CoCreateInstance,

0_2_00366D50

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_002BAB40 FindResourceW,LoadResource,LockResource,SizeofResource,

0_2_002BAB40

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

File created: C:\Users\user\AppData\Roaming\ConsolHQ LTD

Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

File created: C:\Users\user~1\AppData\Local\Temp\shi44B7.tmp

Jump to behavior

Source: RIv8fq9APB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

File read: C:\Users\user\Desktop\RIv8fq9APB.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\RIv8fq9APB.exe "C:\Users\user\Desktop\RIv8fq9APB.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 514532DC5754F2DEA5310FF5234A96F5 C
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\RIv8fq9APB.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488877 " AI_EUIMSI=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 83139F07849E8D7972AAA3545112F408
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\RIv8fq9APB.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488877 " AI_EUIMSI=""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 514532DC5754F2DEA5310FF5234A96F5 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 83139F07849E8D7972AAA3545112F408	Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: RIv8fq9APB.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: RIv8fq9APB.exe

Static file information: File size 49202888 > 1048576

Source: RIv8fq9APB.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x216e00

Source: RIv8fq9APB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: RIv8fq9APB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: RIv8fq9APB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: RIv8fq9APB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: RIv8fq9APB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: RIv8fq9APB.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: RIv8fq9APB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: RIv8fq9APB.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wininet.pdb source: RIv8fq9APB.exe, 00000000.00000003.1280440752.0000000005744000.00000004.00000020.00020000.00000000.sdmp, shi44B7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: RIv8fq9APB.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI48C1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI48C1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr
Source:	Binary string: wininet.pdbUGP source: RIv8fq9APB.exe, 00000000.00000003.1280440752.0000000005744000.00000004.00000020.00020000.00000000.sdmp, shi44B7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: RIv8fq9APB.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: RIv8fq9APB.exe

Source: RIv8fq9APB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RIv8fq9APB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RIv8fq9APB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RIv8fq9APB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RIv8fq9APB.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: shi44B7.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_00322350 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00322350

Source: shi44B7.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shi44B7.tmp.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA61D push edi; ret	0_3_010EA629
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA61D push edi; ret	0_3_010EA629
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA5A0 push ecx; ret	0_3_010EA5B1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA5A0 push ecx; ret	0_3_010EA5B1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010ECCD4 push esp; ret	0_3_010ECCF5
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010ECCD4 push esp; ret	0_3_010ECCF5
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010E9FE7 push ebx; ret	0_3_010EA011
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010E9FE7 push ebx; ret	0_3_010EA011
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA2E0 push ebp; ret	0_3_010EA2E1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA2E0 push ebp; ret	0_3_010EA2E1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA61D push edi; ret	0_3_010EA629
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA61D push edi; ret	0_3_010EA629
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA5A0 push ecx; ret	0_3_010EA5B1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA5A0 push ecx; ret	0_3_010EA5B1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010ECCD4 push esp; ret	0_3_010ECCF5
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010ECCD4 push esp; ret	0_3_010ECCF5
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010E9FE7 push ebx; ret	0_3_010EA011
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010E9FE7 push ebx; ret	0_3_010EA011
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA2E0 push ebp; ret	0_3_010EA2E1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_3_010EA2E0 push ebp; ret	0_3_010EA2E1
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0028A486 push esi; ret	0_2_0028A488
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003B6C6E push ecx; ret	0_2_003B6C81
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00303330 push ecx; mov dword ptr [esp], 3F800000h	0_2_00303478
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00235BE0 push ecx; mov dword ptr [esp], ecx	0_2_00235BE1

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4871.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48A1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File created: C:\Users\user\AppData\Local\Temp\MSI45D2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4812.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File created: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File created: C:\Users\user\AppData\Local\Temp\MSI4545.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File created: C:\Users\user\AppData\Local\Temp\shi44B7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48C1.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4871.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48A1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4812.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI48C1.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4871.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI48A1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI45D2.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI4812.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI4545.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi44B7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI48C1.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Evaded block: after key decision

graph_0-67221

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-69615

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

API coverage: 9.8 %

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File Volume queried: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File Volume queried: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003243B0 FindFirstFileW,GetLastError,FindClose,	0_2_003243B0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00342380 FindFirstFileW,FindClose,	0_2_00342380
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0023A950 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,	0_2_0023A950
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003414D0 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_003414D0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00323DE0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00323DE0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0032C0B0 FindFirstFileW,FindClose,FindClose,	0_2_0032C0B0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0033E3A0 FindFirstFileW,FindClose,	0_2_0033E3A0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0034E610 FindFirstFileW,FindClose,	0_2_0034E610
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0034B3D0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_0034B3D0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0034B7D0 FindFirstFileW,FindClose,	0_2_0034B7D0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_00323A50 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00323A50
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_0035FB20 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_0035FB20

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_0034A620 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_0034A620

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_003B365A VirtualQuery,GetSystemInfo,

0_2_003B365A

Source: 5646f9.msi.7.dr

Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_003BAD13 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_003BAD13

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_003577C0 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

0_2_003577C0

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_00322350 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00322350

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003CC66D mov ecx, dword ptr fs:[00000030h]	0_2_003CC66D
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003D783E mov eax, dword ptr fs:[00000030h]	0_2_003D783E
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003B5CA1 mov esi, dword ptr fs:[00000030h]	0_2_003B5CA1

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_003B5D0D GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_003B5D0D

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_002521E0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_002521E0
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003B6738 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_003B6738
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: 0_2_003BAD13 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_003BAD13

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\consolhq ltd\consolehq utils 1.14.1\install\0beaf65\installer.msi" ai_setupexepath=c:\users\user\desktop\riv8fq9apb.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488877 " ai_euimsi=""
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\consolhq ltd\consolehq utils 1.14.1\install\0beaf65\installer.msi" ai_setupexepath=c:\users\user\desktop\riv8fq9apb.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488877 " ai_euimsi=""			Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_0034EAB0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

0_2_0034EAB0

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,MsgWaitForMultipleObjectsEx,MsgWaitForMultipleObjectsEx,PeekMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,TranslateMessage,DispatchMessageW,MsgWaitForMultipleObjectsEx,	0_2_00344050
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,	0_2_003D0186
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,	0_2_003D41E6
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_003D430F
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,	0_2_003D4415
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_003D44E4
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_003D3B80
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: EnumSystemLocalesW,	0_2_003CFC09
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,	0_2_003D3D7B
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: EnumSystemLocalesW,	0_2_003D3E22
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: EnumSystemLocalesW,	0_2_003D3E6D
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: EnumSystemLocalesW,	0_2_003D3F08
Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_003D3F93

Source: C:\Users\user\Desktop\RIv8fq9APB.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_0035BB20 CreateNamedPipeW,CreateFileW,

0_2_0035BB20

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_003B72F4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_003B72F4

Source: C:\Users\user\Desktop\RIv8fq9APB.exe

Code function: 0_2_0035A240 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,

0_2_0035A240

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	25 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
RIv8fq9APB.exe	3%	ReversingLabs
RIv8fq9APB.exe	6%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\MSI4545.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI4545.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI45D2.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI45D2.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\shi44B7.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\shi44B7.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\decoder.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\decoder.dll	0%	Virustotal	Browse
C:\Windows\Installer\MSI4812.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI4871.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI48A1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI48C1.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, Installer.msi.0.dr, 5646f9.msi.7.dr	false	high
http://html4/loose.dtd	shi44B7.tmp.0.dr	false	high
https://www.advancedinstaller.com	RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	false	high
https://www.thawte.com/cps0/	RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	false	high
http://.css	shi44B7.tmp.0.dr	false	high
http://.jpg	shi44B7.tmp.0.dr	false	high
https://www.thawte.com/repository0W	RIv8fq9APB.exe, 00000000.00000003.1366518124.0000000004131000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1369141146.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367044116.0000000004139000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004386000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1273242213.0000000004230000.00000004.00001000.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1366470924.000000000417C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000002.1372617670.000000000416C000.00000004.00000020.00020000.00000000.sdmp, RIv8fq9APB.exe, 00000000.00000003.1367090329.0000000004149000.00000004.00000020.00020000.00000000.sdmp, MSI4545.tmp.0.dr, MSI4812.tmp.7.dr, MSI4871.tmp.7.dr, MSI48C1.tmp.7.dr, MSI48A1.tmp.7.dr, Installer.msi.0.dr, MSI45D2.tmp.0.dr, 5646f9.msi.7.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554995
Start date and time:	2024-11-13 10:09:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RIv8fq9APB.exe renamed because original name is a hash value
Original Sample Name:	895dccfa0aa2a7dfc4be56e0cf045dcbaf40a7ef23849ad30a3af38793fd214c.exe
Detection:	CLEAN
Classification:	clean13.winEXE@8/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 58% Number of executed functions: 65 Number of non-executed functions: 242
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\shi44B7.tmp	setup.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	http://downloads.ciscocems.com/downloads/CeDAR/Setup_Cedar%208.05.08.zip	Get hash	malicious	Unknown	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	teracopy.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\MSI4545.tmp	IM-vL5WWvBl.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSI4545.tmp

Download File

Process:	C:\Users\user\Desktop\RIv8fq9APB.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:	6144:PBtBN+l8CKvSHJSTHLntEToqi/9rpiAO+7lMhZeBajAt7fgcY:PB/0l1K7HLnt5DgMlgZ7AtDgcY
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: IM-vL5WWvBl.msi, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI45D2.tmp

Download File

Process:	C:\Users\user\Desktop\RIv8fq9APB.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	919520
Entropy (8bit):	6.451407326378623
Encrypted:	false
SSDEEP:	24576:1x90VXSK4fSa6HXr1iWn8Zlb2h4ntHurpllQ6a:Pq4Fb6HXr1iWnU84ntHurpllQ6a
MD5:	064278F42704CDCE52C8C527CF9AFBC7
SHA1:	007C2A1C946EB62886AC26ADFC7C6B41EECD4D41
SHA-256:	070155314AE1035E0A74729231EA97053744EC3B0D5E8D8AF0D000448924D5A9
SHA-512:	9D7AE27229317F07CFD051AB8A7E4E7AC4071593FB0329BFF21CFB812086CA00CFFEBBC950A4849C233D8B2EE3D306E9A3338415DEB48CEE09C5B94704A01A70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#S..#S..#S]. R..#S].&R;.#S.'R..#S. R..#S.&R..#S].'R..#S]."R..#S.."S..#S2.*R..#S2.#R..#S2..S..#S..S..#S2.!R..#SRich..#S........PE..L...P..b.........."!.....X...................p...............................@......{9....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI648fd.LOG

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	288
Entropy (8bit):	3.4203475049907834
Encrypted:	false
SSDEEP:	6:QmQlfuVBRM7OYrsfc/okjxaaOEqQbr62avKpnKBlv2K84UlUlxqCH:QmQ1u6sc/7aFEVbr62aInKT8Nw
MD5:	2A45DEB14B61E7DCD55E76CAD5D0DA90
SHA1:	7B377F290FF8F029B7E9E56CDC8601BCD024B73C
SHA-256:	D5E2421B7489131C8F688255E6CAF3C0917B85600A28AA24459C5A091647AF03
SHA-512:	418882D9908FB02B38FD98E1EA0BE380E0DF468ED48860FA6D5AC29E69740F884A85BE61877BD1D2C7312429FCB0C9720D65586104B03022DA04DAEB13F1267C
Malicious:	false
Reputation:	low
Preview:	..C.o.n.s.o.l.e.H.Q. .U.t.i.l.s. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .s.y.s.t.e.m.s. .w.i.t.h. .s.c.r.e.e.n. .r.e.s.o.l.u.t.i.o.n. .s.m.a.l.l.e.r. .t.h.a.n. .1.3.6.0. .x. .7.6.8.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.1.1./.2.0.2.4. . .0.4.:.1.0.:.1.3. .=.=.=.....

C:\Users\user\AppData\Local\Temp\shi44B7.tmp

Download File

Process:	C:\Users\user\Desktop\RIv8fq9APB.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: VirtualDesktop.Streamer.Setup.exe, Detection: malicious, Browse Filename: VirtualDesktop.Streamer.Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: teracopy.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65\Installer.msi

Download File

Process:	C:\Users\user\Desktop\RIv8fq9APB.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BE51696F-3A89-48E5-9B33-E41D97E462D1}, Number of Words: 0, Subject: ConsoleHQ Utils, Author: ConsolHQ LTD, Name of Creating Application: ConsoleHQ Utils, Template: ;1033, Comments: This installer database contains the logic and data required to install ConsoleHQ Utils., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2201088
Entropy (8bit):	6.507535009201941
Encrypted:	false
SSDEEP:	49152:iYVYVKjlgZcDgcYrAvq4Fb6HXr1iWnU84ntHurpllQ6aSHCP1N0ZqgJtPAxl:xY4jluAjFnWnq1
MD5:	ABAD180C1B0F0863D91EBDBB6382AE08
SHA1:	E676F91353B4355F8A8D353E80C11EEBCC5164E2
SHA-256:	2BA084FDD89359762102D9AAE37627E5614ACB1079388BF9DDC0699706538445
SHA-512:	1302E9227BB026032191AEFAB7F3DEC438408AF865F59E8D1C8D7CD16D800582BDC5C3E99272930CD1CE679ADD591F684B9BF02FBC9BE05A6A4F3C8721AE9891
Malicious:	false
Preview:	......................>..................."...................................f...............................1...2...3...4...5...6...7...8...9...:...;...<...=...>...C...D...E...F...G...H...I...J...K...................................................................................................................................................................................................................................................................................................................................N...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C.......E...K...G...H...I...J.......L...M...O..._...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^...`......a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\decoder.dll

Download File

Process:	C:\Users\user\Desktop\RIv8fq9APB.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209920
Entropy (8bit):	6.447659228395253
Encrypted:	false
SSDEEP:	3072:tScXkSa4E7uzTK+NbkuO2DcUC1myXxskH9Xq4fa2KbDI0lSmb9D:Q7sO+EZ9LH2j7Mmb9
MD5:	A5FFDCF45D3D123139C49017B22F444E
SHA1:	7B3D3D293F9A34570FC91500A6580496147C7658
SHA-256:	8F49245444B02BF0E103C5A5850A0B2FB1F2880C917261D146E3B8BC3C166E40
SHA-512:	5FF195A70825EFCED761ACEEEC5A6F0D0E18C1A4074482F584EFABEF7166C957C728D71D6185E3487A1405C608D820EFA4E07C584D60A8D51625E5D8A9A89397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..a..2..2..2..3 ..2..3...2x.3...2x.3:..2x.3?..2..3?..2..3-..2..2...2..3v..2..3+..2..^2+..2.62+..2..3+..2Rich..2................PE..L...?..b.........."!.....`...................p............................................@......................... ...........<....p.. .......................0 ......p...........................`...@............p..t............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...dV..........................@....rsrc... ....p......................@..@.reloc..0 ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\RIv8fq9APB.exe
File Type:	data
Category:	dropped
Size (bytes):	162168834
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	0FAA7BE325FA14A48C3D34155EDC1147
SHA1:	6EDDAA42450A6171A444BA703DFD99DE9C880DED
SHA-256:	F169D54249FBB5AA644EF763EE2574DB5A409A8155C833C2991A9604F2823847
SHA-512:	B39A2FE2617B54C890D9D229F850DEE97851CA31F1D3F1A5DF17090A8C26F009D850CDB2C2A2921820DBFFBA55E53AC474D1CF167B01D74E341CEFC45956D12D
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\5646f9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {BE51696F-3A89-48E5-9B33-E41D97E462D1}, Number of Words: 0, Subject: ConsoleHQ Utils, Author: ConsolHQ LTD, Name of Creating Application: ConsoleHQ Utils, Template: ;1033, Comments: This installer database contains the logic and data required to install ConsoleHQ Utils., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2201088
Entropy (8bit):	6.507535009201941
Encrypted:	false
SSDEEP:
MD5:	ABAD180C1B0F0863D91EBDBB6382AE08
SHA1:	E676F91353B4355F8A8D353E80C11EEBCC5164E2
SHA-256:	2BA084FDD89359762102D9AAE37627E5614ACB1079388BF9DDC0699706538445
SHA-512:	1302E9227BB026032191AEFAB7F3DEC438408AF865F59E8D1C8D7CD16D800582BDC5C3E99272930CD1CE679ADD591F684B9BF02FBC9BE05A6A4F3C8721AE9891
Malicious:	false
Preview:	......................>..................."...................................f...............................1...2...3...4...5...6...7...8...9...:...;...<...=...>...C...D...E...F...G...H...I...J...K...................................................................................................................................................................................................................................................................................................................................N...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C.......E...K...G...H...I...J.......L...M...O..._...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^...`......a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI4812.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4871.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI48A1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI48C1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	919520
Entropy (8bit):	6.451407326378623
Encrypted:	false
SSDEEP:
MD5:	064278F42704CDCE52C8C527CF9AFBC7
SHA1:	007C2A1C946EB62886AC26ADFC7C6B41EECD4D41
SHA-256:	070155314AE1035E0A74729231EA97053744EC3B0D5E8D8AF0D000448924D5A9
SHA-512:	9D7AE27229317F07CFD051AB8A7E4E7AC4071593FB0329BFF21CFB812086CA00CFFEBBC950A4849C233D8B2EE3D306E9A3338415DEB48CEE09C5B94704A01A70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#S..#S..#S]. R..#S].&R;.#S.'R..#S. R..#S.&R..#S].'R..#S]."R..#S.."S..#S2.*R..#S2.#R..#S2..S..#S..S..#S2.!R..#SRich..#S........PE..L...P..b.........."!.....X...................p...............................@......{9....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362961300061858
Encrypted:	false
SSDEEP:
MD5:	B4B4EC64B2F3D717A0291116985536D3
SHA1:	2D19DA8BA2467793580C43090B26FC0D6770CD5C
SHA-256:	A04BC196A23F74479062045FDF92FDBB584BE7F25EADDDF6431967C034188C72
SHA-512:	66E7CB6229A7728C0F64791D2419DAC58395BB4878481A55C63219ECBD2F560A2D2F94E699425302F08C2BCC2932E69202024984F6B66122840F07DE98242E0C
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.97662894607415
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	RIv8fq9APB.exe
File size:	49'202'888 bytes
MD5:	607a6e4ea1d6aa1393f54ad0c3b51dd7
SHA1:	d3eefc0bd98d2d176483a80fa6f9e984d1e66e9a
SHA256:	895dccfa0aa2a7dfc4be56e0cf045dcbaf40a7ef23849ad30a3af38793fd214c
SHA512:	0a110b77bef153e208bdae89d5674dbfb7f3c83317a77cf4b8848d5cc7afade851e98f5224fbcdbeac72b3a05597228dcdede4d72231c56bd35ccc3b7b673e97
SSDEEP:	786432:qVbexzYbFwhkPMs2qpGgs5mh+G5OKnqKjhpiQl0dG8ciNRsrOXWn3:hUBowMy40ZO2jhpiQaGhiNZY3
TLSH:	6FB72331364EC52BCA6615B0292C9A9F651C7E750F71A8C7B3CC2E6E5B749C24332E27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{.3.x...{.3.~.X.{.3.}...{.......{...x...{...~...{.3.....{.3.z...{.3.\|...{...z.8.{.\.r...{.\.....{.......{.\.y...{

File Icon


Icon Hash:	9713331b4d3b2f0c

Static PE Info

General

Entrypoint:	0x596c64
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6213B2EE [Mon Feb 21 15:42:38 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	836688c7d21e39394af41ce9a8c2d728

Entrypoint Preview

Instruction
call 00007F426C8C9C1Dh
jmp 00007F426C8C93BFh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F426C8C8A13h
jmp 00007F426C8C9522h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29cb94	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a7000	0x3d574	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e5000	0x256bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x246778	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x246800	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x219f38	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x218000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x299f88	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x216c3f	0x216e00	b670db57563315716440578ee99e5466	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x218000	0x85b8c	0x85c00	59a6fbcfc1f150b26bf16fdd47452e43	False	0.3120947721962617	data	4.605894063170113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29e000	0x89f0	0x6a00	1cea180402edcf39ea7c6193312cce32	False	0.14180424528301888	DOS executable (block device driver 0aY)	2.8670521481443174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2a7000	0x3d574	0x3d600	bcafcb99af5b59c4990dfdae04a1c744	False	0.26359231797352345	data	5.855593973635478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e5000	0x256bc	0x25800	08f0f06260e93e98732bfb4145f07cca	False	0.446171875	data	6.512576488264422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x2a7bf0	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
IMAGE_FILE	0x2a7bf8	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
RTF_FILE	0x2a7c00	0x2e9	Rich Text Format data, version 1, ANSI, code page 1252	English	United States	0.5503355704697986
RTF_FILE	0x2a7eec	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	English	United States	0.906832298136646
RT_BITMAP	0x2a7f90	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x2a80d0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x2a88f8	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x2ad1a0	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x2adc0c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x2add60	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x2ae588	0x7c5a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9958534899792675
RT_ICON	0x2b61e4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.142848692771797
RT_ICON	0x2c6a0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.29470954356846474
RT_ICON	0x2c8fb4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3621013133208255
RT_ICON	0x2ca05c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.45819672131147543
RT_MENU	0x2ca9e4	0x5c	data	English	United States	0.8478260869565217
RT_MENU	0x2caa40	0x2a	data	English	United States	1.0714285714285714
RT_DIALOG	0x2caa6c	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x2cab18	0x2a6	data	English	United States	0.5132743362831859
RT_DIALOG	0x2cadc0	0x3b4	data	English	United States	0.43248945147679324
RT_DIALOG	0x2cb174	0xbc	data	English	United States	0.7180851063829787
RT_DIALOG	0x2cb230	0x204	data	English	United States	0.560077519379845
RT_DIALOG	0x2cb434	0x282	data	English	United States	0.48598130841121495
RT_DIALOG	0x2cb6b8	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x2cb784	0x146	data	English	United States	0.5736196319018405
RT_DIALOG	0x2cb8cc	0x226	data	English	United States	0.4690909090909091
RT_DIALOG	0x2cbaf4	0x388	data	English	United States	0.45464601769911506
RT_DIALOG	0x2cbe7c	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x2cc030	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x2cc168	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x2cc1b4	0x45c	data	English	United States	0.3844086021505376
RT_STRING	0x2cc610	0x344	data	English	United States	0.37320574162679426
RT_STRING	0x2cc954	0x2f8	data	English	United States	0.4039473684210526
RT_STRING	0x2ccc4c	0x598	data	English	United States	0.2807262569832402
RT_STRING	0x2cd1e4	0x3aa	StarOffice Gallery theme i, 1627418368 objects, 1st n	English	United States	0.4211087420042644
RT_STRING	0x2cd590	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x2cdb50	0x568	data	English	United States	0.32875722543352603
RT_STRING	0x2ce0b8	0x164	data	English	United States	0.5421348314606742
RT_STRING	0x2ce21c	0x520	data	English	United States	0.39176829268292684
RT_STRING	0x2ce73c	0x1a0	data	English	United States	0.45913461538461536
RT_STRING	0x2ce8dc	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x2cea68	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x2cec80	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x2cf2a4	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x2cf904	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x2cfbe8	0x4c	data	English	United States	0.7763157894736842
RT_VERSION	0x2cfc34	0x2f4	data	English	United States	0.4417989417989418
RT_HTML	0x2cff28	0x37c8	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08291316526610644
RT_HTML	0x2d36f0	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x2d4a08	0x4fa	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3626373626373626
RT_HTML	0x2d4f04	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x2db9d4	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x2dc078	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x2dd0c4	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x2de678	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x2e06d4	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x2e3d64	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, RemoveDirectoryW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, MoveFileW, GetLastError, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, SetEvent, InitializeCriticalSection, lstrcpynW, CreateThread, WaitForSingleObject, GetProcAddress, LoadLibraryExW, Sleep, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetModuleHandleW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SystemTimeToFileTime, MultiByteToWideChar, WideCharToMultiByte, GetCurrentProcess, GetSystemInfo, WaitForMultipleObjects, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, SetUnhandledExceptionFilter, FormatMessageW, FileTimeToSystemTime, GetEnvironmentVariableW, GetEnvironmentStringsW, LocalFree, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, CreateProcessW, GetExitCodeProcess, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetLocaleInfoW, GetSystemDefaultLangID, GetUserDefaultLangID, GetWindowsDirectoryW, GetSystemTime, GetDateFormatW, GetTimeFormatW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, GetLocalTime, CreateNamedPipeW, ConnectNamedPipe, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, TerminateThread, LocalAlloc, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, GetSystemTimeAsFileTime, CompareStringEx, GetCPInfo, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, WaitForSingleObjectEx, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetFileType, GetTimeZoneInformation, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetConsoleMode, IsValidCodePage, GetACP, GetOEMCP, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:10:00
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\RIv8fq9APB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RIv8fq9APB.exe"
Imagebase:	0x220000
File size:	49'202'888 bytes
MD5 hash:	607A6E4EA1D6AA1393F54AD0C3B51DD7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:10:04
Start date:	13/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6d13b0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:10:05
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 514532DC5754F2DEA5310FF5234A96F5 C
Imagebase:	0x5f0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:10:05
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\RIv8fq9APB.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488877 " AI_EUIMSI=""
Imagebase:	0xac0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:10:05
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 83139F07849E8D7972AAA3545112F408
Imagebase:	0xac0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	22.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	78

Executed Functions

Function 00337D70 Relevance: 45.5, APIs: 2, Strings: 23, Instructions: 1745COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 00337F67
SetEvent.KERNEL32(?), ref: 00337FC5

Part of subcall function 00342AB0: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,79276D7D), ref: 00342ADB

Strings

T`L, xrefs: 003384B0
Advinst_Extract_, xrefs: 00337DC5, 00337DD7, 00337DE1
T`L, xrefs: 00338137
WD, xrefs: 00338761
Code returned to Windows by setup:, xrefs: 00338121
Language selected programatically for UI:, xrefs: 00338552
Languages of setup:, xrefs: 0033907D
A valid language was received from commnad line. This is:, xrefs: 003382AF
}m'y, xrefs: 0033811C, 0033812E, 0033814B, 0033815D
lEhE, xrefs: 00337FAC
Software\Caphyon\Advanced Installer\, xrefs: 00338420
>D, xrefs: 0033880C
hE, xrefs: 00337F8D
%hu, xrefs: 003382DD
h[D, xrefs: 00338EB8
T`L, xrefs: 00338566
Language used for UI:, xrefs: 003385CE
T`L, xrefs: 0033832E
AI_BOOTSTRAPPERLANGS, xrefs: 00338E29, 00338E3B, 00338E45
Language of a related product is:, xrefs: 0033849C
T`L, xrefs: 003390AC
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00338434
T`L, xrefs: 00338615

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EventInit_thread_footer$DeleteFileFindHeapProcessResource
String ID: WD$%hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\$T`L$T`L$T`L$T`L$T`L$T`L$h[D$hE$lEhE$}m'y$>D
API String ID: 4144826820-120009902
Opcode ID: 83464f53d08b21b5f24ce5bab6e46bf7b140d227d969ff84fedc33e86d5a97c8
Instruction ID: 66dabd8c02ee83ed5f61c45d9ba0a991c42cf91f1639385699e4aab4382c5896
Opcode Fuzzy Hash: 83464f53d08b21b5f24ce5bab6e46bf7b140d227d969ff84fedc33e86d5a97c8
Instruction Fuzzy Hash: 16E2D17090060ADFDB01DFA8C889BAEFBB5FF45314F158269E415EB292EB749D04CB91

Function 0035B350 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PackageCode, xrefs: 0035B69B
SELECT `Value` FROM `Property` WHERE `Property` = '%s', xrefs: 0035B3BE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: PackageCode$SELECT `Value` FROM `Property` WHERE `Property` = '%s'
API String ID: 0-2409377028
Opcode ID: bc4fbf20363c9da86182066754ad03ac8f5145aab214bde6bfb01dd41911ad37
Instruction ID: c2318e324d605178ff84a0a0c8a7bf40d33be439388b6ac0a31eddefaf9c6272
Opcode Fuzzy Hash: bc4fbf20363c9da86182066754ad03ac8f5145aab214bde6bfb01dd41911ad37
Instruction Fuzzy Hash: 5612FF71A00205AFDB11DFA8DC49FAEFBB8EF84311F154169F905AB2A1DB759904CBA0

Function 0023A950 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 877fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 0023AA5F
PathIsUNCW.SHLWAPI(00000001,*.*), ref: 0023AAC3
FindFirstFileW.KERNEL32(00000001,?,*.*), ref: 0023AD0C
GetFullPathNameW.KERNEL32(00000001,00000000,00000000,00000000), ref: 0023AD26
GetFullPathNameW.KERNEL32(00000001,00000000,00000000,00000000), ref: 0023AD5A
FindClose.KERNEL32(00000000), ref: 0023ADCB
SetLastError.KERNEL32(0000007B), ref: 0023ADD5
PathIsUNCW.SHLWAPI(?,?,79276D7D,?,00000000), ref: 0023B00E

Strings

*.*, xrefs: 0023AA8A, 0023AA94
\\?\UNC\, xrefs: 0023AAE3, 0023ABFF, 0023B02E, 0023B13A
\\?\, xrefs: 0023AC1A, 0023ACD0, 0023B155, 0023B209

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Path$Find$CloseFullName$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 2310598285-1700010636
Opcode ID: 30abc0e2adbad6279d89f503ec71bce3c42b22d96fab01527c364b1bfc4e9ee5
Instruction ID: 16fecf4fe98073b4075a640b768df8a432c981fc3f4dcfb2407253c8aab51437
Opcode Fuzzy Hash: 30abc0e2adbad6279d89f503ec71bce3c42b22d96fab01527c364b1bfc4e9ee5
Instruction Fuzzy Hash: 896234B1A106169FDB14DF68C889BAEF7B5FF84310F148278E955DB2A1DB31AD10CB90

Function 0034EAB0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0034EAF8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 0034EB05
GetLastError.KERNEL32 ref: 0034EB0F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 0034EB39
GetLastError.KERNEL32 ref: 0034EB3F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,?,?,?), ref: 0034EB65
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 0034EB98
EqualSid.ADVAPI32(00000000,?), ref: 0034EBA7
FreeSid.ADVAPI32(?), ref: 0034EBB6
CloseHandle.KERNEL32(00000000), ref: 0034EBF0

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: 019598b4363889f36414737645e3e58c0093175681485fe0c483fea27647c1cc
Instruction ID: b72bc3afdc60c433e50bbec8926b8b5963efb816e7fcc811e8cf8f5f8aa835fc
Opcode Fuzzy Hash: 019598b4363889f36414737645e3e58c0093175681485fe0c483fea27647c1cc
Instruction Fuzzy Hash: 2F413B71904219EFDF119FA4CD59BEEBBB8FF08314F144029E411B6290DB79AA04CB68

Function 003414D0 Relevance: 15.7, APIs: 10, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: bbd6fb35390964f5cdf5915b0fee2f352c5c059fb7735caa98394b6b3058560f
Instruction ID: 478258bb447899a5345a783487bd516fda209f51cd763fe080bf2041d0f9b333
Opcode Fuzzy Hash: bbd6fb35390964f5cdf5915b0fee2f352c5c059fb7735caa98394b6b3058560f
Instruction Fuzzy Hash: 8162BF70A00649DFDB11CFA8C884B9EFBF5BF45314F1582A9E415AF291DB70AE89CB50

Function 00344050 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

GetLocaleInfoW.KERNEL32(?,00000002,0044337C,00000000), ref: 003440C1
GetLocaleInfoW.KERNEL32(?,00000002,00343B85,-00000001,00000078,-00000001), ref: 003440FD
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 00344181
PeekMessageW.USER32(?,00000000), ref: 003441C7
TranslateMessage.USER32(00000000), ref: 003441D2
DispatchMessageW.USER32(00000000), ref: 003441D9
MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 003441EB

Strings

%d-%s, xrefs: 00344107

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Message$InfoInit_thread_footerLocaleMultipleObjectsWait$DispatchHeapPeekProcessTranslate
String ID: %d-%s
API String ID: 445213441-1781338863
Opcode ID: 012461787df68664b101614bd35352b0c7b81de9f0339827ee5a36578ef87a27
Instruction ID: 1f4a3093f624ba0ba788ace93f61f2843fccf07431a928c4734a0334d23e1a05
Opcode Fuzzy Hash: 012461787df68664b101614bd35352b0c7b81de9f0339827ee5a36578ef87a27
Instruction Fuzzy Hash: 55511271A40315ABE710DF94DC45FAEBBE8EF48724F104629F614AB2C1DB71A944CBA0

Function 00322350 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,79276D7D,00000000,?,00000000), ref: 0032238E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 003223B1
FreeLibrary.KERNEL32(00000000), ref: 0032242F

Strings

=-;, xrefs: 003223DD
ComCtl32.dll, xrefs: 00322382
LoadIconMetric, xrefs: 003223AB
,(E, xrefs: 00322423

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ,(E$=-;$ComCtl32.dll$LoadIconMetric
API String ID: 145871493-4103588746
Opcode ID: 5cf10f3ff9e1de1894823654c655421e06cff950970ef9fe5d609bb2d049a9b1
Instruction ID: f69f6a85d54679387378743ce7447f7266244a4b350d714542b81940730b0689
Opcode Fuzzy Hash: 5cf10f3ff9e1de1894823654c655421e06cff950970ef9fe5d609bb2d049a9b1
Instruction Fuzzy Hash: 3B31D571A00218ABDF158FA5DC44BAFBFF8EB48720F01412EF915A7280D7B98D04CB94

Function 0035A240 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 0035A2CE
GetLastError.KERNEL32 ref: 0035A2D4
GetUserNameW.ADVAPI32(00000000,?), ref: 0035A31C
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 0035A352
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 0035A39C

Strings

UserDomain, xrefs: 0035A34D, 0035A397

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EnvironmentNameUserVariable$ErrorLast
String ID: UserDomain
API String ID: 3567734997-2275544873
Opcode ID: f306a9fab76091b8b4f52157e9ae0e648f15e2cf0ba5b05f8a8b5a57f08ada78
Instruction ID: 0984600ceb759ad57396fa3d8a5e4d06d277b436067eeba69a92beb6e5fae44a
Opcode Fuzzy Hash: f306a9fab76091b8b4f52157e9ae0e648f15e2cf0ba5b05f8a8b5a57f08ada78
Instruction Fuzzy Hash: 7C612771A10219DFDF14DFA8C855BEEBBB4FF08305F24412DE401A7290DB75AA49CBA5

Function 002E1FB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 002E1FF1

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

_wcschr.LIBVCRUNTIME ref: 002E20AF

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

LoadLibraryExW.KERNEL32(?,00000000,00000000,-00000010), ref: 002E20C4

Strings

Kernel32.dll, xrefs: 002E1FCC, 002E209F, 002E20A0, 002E2134

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem_wcschr
String ID: Kernel32.dll
API String ID: 1122257418-1926710522
Opcode ID: 35d7ec51df9b4282dc2fef9fa0c5505a8d43fdae512ef074a2527918bff7cf03
Instruction ID: 1d1520cec29b8243f365313ad0a4322c91f94ccbecb15f2d8b4dffc48906ad29
Opcode Fuzzy Hash: 35d7ec51df9b4282dc2fef9fa0c5505a8d43fdae512ef074a2527918bff7cf03
Instruction Fuzzy Hash: 45A18CB0500645EFE714CF65C818B9ABBF4FF04318F20825DE8199B6C1D7BAA618CF90

Function 0034C990 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0034CA6A

Strings

\, xrefs: 0034C9EC
\, xrefs: 0034C9E4
\, xrefs: 0034CA0E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 504ee9cf0d24fce0c16b516b749b36f6d78e1179864e1d3498d0efb818aaff70
Instruction ID: 8710638e5202de761bc3c370ef5a406f9defaecf5f0e2ee82f6936d13c1ac90d
Opcode Fuzzy Hash: 504ee9cf0d24fce0c16b516b749b36f6d78e1179864e1d3498d0efb818aaff70
Instruction Fuzzy Hash: 1A41F732D253598BCBB1DF2484416ABB3F4FF95354F166A2EE8D89B140E730AD8583C6

Function 0035BB20 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,}m'y,79276D7D,?,?,?,00000000,00426015), ref: 0035BBA8
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,}m'y,79276D7D,?,?,?,00000000,00426015,000000FF), ref: 0035BBCA

Strings

}m'y, xrefs: 0035BB3C, 0035BB4E
}m'y, xrefs: 0035BB67

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID: }m'y$}m'y
API String ID: 1328467360-2486897750
Opcode ID: b5ade0ac5867b400b5e45006bfc8735ee1437bf317b27e012a2f8fc34b6705d1
Instruction ID: a0d81e5ede32a9e65f4e3349d542fb6b157b8c7acaccb1074d94d024a537b6fa
Opcode Fuzzy Hash: b5ade0ac5867b400b5e45006bfc8735ee1437bf317b27e012a2f8fc34b6705d1
Instruction Fuzzy Hash: 9131B631684745AFD721CF14CC01FA6FBA4EB05720F10866EFDA55B6D0DB75A904CB54

Function 003B5D0D Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,00230DC7,?,?,00230B74,?), ref: 003B5D12
HeapAlloc.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5D19
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00230B74,?), ref: 003B5D5F
HeapFree.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5D66

Part of subcall function 003B5BAB: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,003B5D55,00000000,?,?,00230B74,?), ref: 003B5BCF
Part of subcall function 003B5BAB: HeapAlloc.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5BD6

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 3f7dd3d97d0c6ca75e9b0e21bf6bedd9972978fe5a7eca3849dfc687cd1a9fdc
Instruction ID: 1a4682e13a02f8adf4c6fd6543e36b167e6a1b2d604a2be893b360b6e15390db
Opcode Fuzzy Hash: 3f7dd3d97d0c6ca75e9b0e21bf6bedd9972978fe5a7eca3849dfc687cd1a9fdc
Instruction Fuzzy Hash: 4FF0B436A04F1257C7672BB8BC0CB9B6B79AF84765713512CF206C6554DF20C8014B64

Function 003243B0 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 0032444F
FindClose.KERNEL32(00000000), ref: 003244AE

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID:
API String ID: 2507753907-0
Opcode ID: f285f729637149022b48ba033a06466ead1f6eaa6317b13c4bb86c5908bfbde6
Instruction ID: ec8b4ae6555f8f5499b8354312df393b1be4262cada088ed0c68bec1e10f23f4
Opcode Fuzzy Hash: f285f729637149022b48ba033a06466ead1f6eaa6317b13c4bb86c5908bfbde6
Instruction Fuzzy Hash: E1310130905228CBCB29EF56E848BAAB7B4FB44728F20826EE91997780D7715D44CF90

Function 00342380 Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 1d487762a135128d9df2800a826c16f92f0f54c55a77ef521c0e80d408fcf2a2
Instruction ID: 638a3f4b7d5a63a384245be4ce2f745929009bace0865ff2f425e9c308c8b921
Opcode Fuzzy Hash: 1d487762a135128d9df2800a826c16f92f0f54c55a77ef521c0e80d408fcf2a2
Instruction Fuzzy Hash: A8E17D30A00649DFDB15CFA8CC84BAEBBF4FF44324F558269E815BB292DB74A945CB50

Function 00323DE0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f844551d38be4a5361f7bc6d482e04e26fcdad745c0263898cd4642d499755
Instruction ID: 43d3c30239a3e39c7cc4a8f17047050f514040e0c944de5c36e920f5df168837
Opcode Fuzzy Hash: 69f844551d38be4a5361f7bc6d482e04e26fcdad745c0263898cd4642d499755
Instruction Fuzzy Hash: A741A031A01659EBDB25DF68ED55BEEB3B4FF10310F158229E8159B2D1EB349E04CB50

Function 002521E0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 002521F8
SetUnhandledExceptionFilter.KERNEL32(00320760), ref: 0025220E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: d7bd6590b3a210c114ff602f195b603321a888f39b32b8eb339c41979f153ff9
Instruction ID: aa446b758205609377a192789863a60b622fe4470ad9a51734ed7e81e58c5325
Opcode Fuzzy Hash: d7bd6590b3a210c114ff602f195b603321a888f39b32b8eb339c41979f153ff9
Instruction Fuzzy Hash: 14E0263A9003106EC7435B54AC0AF8A3F20AB92712F094029F70857193CB7064088761

Function 00366D50 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 00322890: __Init_thread_footer.LIBCMT ref: 00322970

CoCreateInstance.COMBASE(004431D8,00000000,00000001,0045F490,000000B0), ref: 00366DCE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: 5ff6d17bcc02e06b126fdb3304cdd62baebc284af7538168e49ff9fab8ff3f9e
Instruction ID: 144671e479cd84866ef853ab3361893a125bdee9d31267174593a941f72b3f71
Opcode Fuzzy Hash: 5ff6d17bcc02e06b126fdb3304cdd62baebc284af7538168e49ff9fab8ff3f9e
Instruction Fuzzy Hash: A011AD71604745EBD720DF59D805B9ABBF8EB45B10F10466EF8159B7C0C7BAA504CB90

Function 003615E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$CreateHeapInstanceProcess
String ID:
API String ID: 3807588171-0
Opcode ID: 081100779804c42074acd52f3e9c9b5ea629ec69382fee8b541923bfc4ac355a
Instruction ID: b37b6d1194776ee68b0c881988260e1edd67eabf97ddfe279090bf47de8ad369
Opcode Fuzzy Hash: 081100779804c42074acd52f3e9c9b5ea629ec69382fee8b541923bfc4ac355a
Instruction Fuzzy Hash: 856157B1500B04DFE721CF64C54838ABBE0FF04308F148A5ED88A9B782D7B9A609CF95

Function 00322BA0 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00322C0E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00322C55
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00322C74
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00322CA3
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00322D18
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 00322D81
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00322DE4
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00322E36
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00322ED3
GetProcAddress.KERNEL32(00000000), ref: 00322EDA
__Init_thread_footer.LIBCMT ref: 00322EEE
GetCurrentProcess.KERNEL32(?), ref: 00322F11
IsWow64Process.KERNEL32(00000000), ref: 00322F18
RegCloseKey.ADVAPI32(00000000), ref: 00322F52

Strings

CSDVersion, xrefs: 00322E2B
kernel32, xrefs: 00322ECE
CurrentBuildNumber, xrefs: 00322D0D
ReleaseId, xrefs: 00322DD9
IsWow64Process, xrefs: 00322EC9
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00322C04
CurrentMinorVersionNumber, xrefs: 00322C69
co_release, xrefs: 00322D89
BuildBranch, xrefs: 00322D76
CurrentVersion, xrefs: 00322C98
rs_prerelease, xrefs: 00322DA1
CurrentMajorVersionNumber, xrefs: 00322C4A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 1906320730-525127412
Opcode ID: b11d04d71d6379991f830e20db5ca35345c49cd474b420ce2523c5f953f700f1
Instruction ID: bc2a40ebf92ad413f9a6b63538fa22ccfec8fee7b4f31e866068d3309afffa98
Opcode Fuzzy Hash: b11d04d71d6379991f830e20db5ca35345c49cd474b420ce2523c5f953f700f1
Instruction Fuzzy Hash: 8AA19371900328EEDB61CF10DD45FDAB7F8FB04705F1181AAE948A6191EB785E88CF94

Function 00344960 Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 003449DC

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Part of subcall function 00232970: RaiseException.KERNEL32(?,?,00000000,00000000,003B5A3C,C000008C,00000001,?,003B5A6D,00000000,?,002291C7,00000000,79276D7D,00000001,?), ref: 0023297C

__Init_thread_footer.LIBCMT ref: 00344A2C

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

Strings

ProgramFiles64Folder, xrefs: 00346008
ProgramFiles, xrefs: 00346960, 00346975, 0034697D
hiL, xrefs: 003466F3
TempFolder, xrefs: 003464BF
System32Folder, xrefs: 0034625D, 00346272, 0034627C
YL, xrefs: 00346584, 003465FC, 00346606
`iL, xrefs: 00344BE4
APPDATA, xrefs: 00346A57, 00346A5F
SHGetFolderPathW, xrefs: 00346707
ProgramFilesFolder, xrefs: 003468E7
WindowsFolder, xrefs: 00346344, 00346359, 00346363
ProgramW6432, xrefs: 00346064
AppDataFolder, xrefs: 003469C8, 00346A05
XiL, xrefs: 00344BCB
Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64, xrefs: 00344A64
Shlwapi.dll, xrefs: 00346877
SETUPEXEDIR, xrefs: 0034654C
PROGRAMFILES, xrefs: 00346A3D
Shell32.dll, xrefs: 003468A3
SystemFolder, xrefs: 0034613F, 00346154, 0034615E
WindowsVolume, xrefs: 00346424, 00346439, 00346443
Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86, xrefs: 00344B03
shfolder.dll, xrefs: 003466D6

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AllocConditionExceptionHeapRaiseVariableWake
String ID: YL$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFiles64Folder$ProgramFilesFolder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$Shell32.dll$Shlwapi.dll$System32Folder$SystemFolder$TempFolder$Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86$Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64$WindowsFolder$WindowsVolume$XiL$`iL$hiL$shfolder.dll
API String ID: 4172833244-868295239
Opcode ID: 90b5034877f2f7d942b81ac381d338906b69b185afb2f1fa86337f1420396daf
Instruction ID: b33d39d91dec0fac1e5598fc721847b44afbe79cdc82313de587c46fae8444e3
Opcode Fuzzy Hash: 90b5034877f2f7d942b81ac381d338906b69b185afb2f1fa86337f1420396daf
Instruction Fuzzy Hash: 907117B09002069BDB12EBA8D846BBAB3E1EF20314F268679E5519F391E735ED04CB55

Function 00322F80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00322FF0
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 0032302B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 003230A6
RegCloseKey.KERNEL32(00000000), ref: 0032327E

Strings

Personal, xrefs: 003231A9
BackOffice, xrefs: 00323112
ProductType, xrefs: 00323020
Terminal Server, xrefs: 00323144
EmbeddedNT, xrefs: 00323176
Small Business(Restricted), xrefs: 0032315D
Security Appliance, xrefs: 003231EE
Enterprise, xrefs: 003230F9
Storage Server, xrefs: 00323205
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00322FE6
Blade, xrefs: 003231C0
ServerNT, xrefs: 00323054
ProductSuite, xrefs: 0032309B
DataCenter, xrefs: 0032318F
Compute Server, xrefs: 0032321C
CommunicationServer, xrefs: 0032312B
Small Business, xrefs: 003230E0
WinNT, xrefs: 00323031
Embedded(Restricted), xrefs: 003231D7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: d892376ea692c36bcae282193b8ec776b31366814e6e7a77c5518dfb62b3e950
Instruction ID: e584966a22b0968b8f4ea89ca5e30296704500f6cf325e3e1be009f67f0d7c41
Opcode Fuzzy Hash: d892376ea692c36bcae282193b8ec776b31366814e6e7a77c5518dfb62b3e950
Instruction Fuzzy Hash: 4F710A3070033997EB129B25FC45BAA7269FF40740F1185B6DD06AB682EB3CDE59CB46

Function 003364D0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

GetTickCount.KERNEL32 ref: 00336554
__Xtime_get_ticks.LIBCPMT ref: 0033655C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003365A6
__Init_thread_footer.LIBCMT ref: 003367A1
GetCurrentProcess.KERNEL32 ref: 00336B06
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00336B16
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00336B42
CloseHandle.KERNEL32(00000000), ref: 00336B83

Strings

tiL, xrefs: 0033675C
\/:*?"<>|, xrefs: 00336763
tiL, xrefs: 003367F7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footerProcess$Token$CloseCountCurrentHandleHeapInformationOpenTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|$tiL$tiL
API String ID: 3363527671-3440277428
Opcode ID: e112e24bcfa948a4e34e962a0142ebd7337fb99aa21a3c8ae7d454039fc8816d
Instruction ID: f51873b9c90492231db4bed48c6c66b94fb0d051477400dcef442e68e9cf75b1
Opcode Fuzzy Hash: e112e24bcfa948a4e34e962a0142ebd7337fb99aa21a3c8ae7d454039fc8816d
Instruction Fuzzy Hash: E5229170900258DFDB11DFA8CC95BEEBBB4BF44304F1581A9E409AB292DB749E45CFA1

Function 0035F7B0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?,0034181B,?,?,?,?,?), ref: 0035F7C5

Strings

GetTotalFilesSize, xrefs: 0035F805
ExtractAllFiles, xrefs: 0035F817
InitExtraction, xrefs: 0035F7FD
EndExtraction, xrefs: 0035F829
,(E, xrefs: 0035F7D7, 0035F7DD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: LibraryLoad
String ID: ,(E$EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-3295565804
Opcode ID: 0c56ac286b8dcdf1b8d3a90da037029dd67a417d0297db86c06e4ea2c267af2a
Instruction ID: d817ab351d705d48a91ee41e8e4fd360ee67e6754dff1e93590f6d099e0db917
Opcode Fuzzy Hash: 0c56ac286b8dcdf1b8d3a90da037029dd67a417d0297db86c06e4ea2c267af2a
Instruction Fuzzy Hash: 7B015E7A9007119FCB549F28AC48D4B7FA1B728356301823BE91783372CB38589DCF98

Function 0030DDA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,79276D7D,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 0030DDE3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 0030DE0C
RegCreateKeyExW.KERNEL32(?,)r#,00000000,00000000,00000000,?,00000000,00000000,?,79276D7D,?,?,?,00000000,?,Function_001BDD00), ref: 0030DE59
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 0030DE6C

Strings

)r#, xrefs: 0030DE53, 0030DE2B
RegCreateKeyTransactedW, xrefs: 0030DE06
)r#, xrefs: 0030DDBD, 0030DDF2
Advapi32.dll, xrefs: 0030DDDE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: )r#$)r#$Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-3663824583
Opcode ID: 811413da54eb5139953b867d21aa384bcd11ff7712066c405567ad3436e6a883
Instruction ID: ad248a03c4454feba542effee72ae9fc37141fd0c8a4d9856c8ac6eb53ce6d05
Opcode Fuzzy Hash: 811413da54eb5139953b867d21aa384bcd11ff7712066c405567ad3436e6a883
Instruction Fuzzy Hash: CB319372640209FFEB258F85DC55FA7BBA8FB54B50F10412AF905DB6C0E775A810CB98

Function 003B5A9F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,003B5DE5,004C4C90,?,?,?,002800E6,?,79276D7D,?,?,?,002C81B7), ref: 003B5AB1
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,003B5DE5,004C4C90,?,?,?,002800E6,?,79276D7D,?,?), ref: 003B5AC6
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,002C81B7), ref: 003B5B42

Strings

AtlThunk_DataToCode, xrefs: 003B5B05
AtlThunk_InitData, xrefs: 003B5AEE
AtlThunk_FreeData, xrefs: 003B5B1C
AtlThunk_AllocateData, xrefs: 003B5AD7
atlthunk.dll, xrefs: 003B5AC1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 40b68a3d7920127d743b8a7c33a7df8ee215486f4d5fdb351de241c3a99ef001
Instruction ID: 9212e5122b2051c4180c666dd3b9e620d9630afd6fbde9ea7faa8e68d5f04ae0
Opcode Fuzzy Hash: 40b68a3d7920127d743b8a7c33a7df8ee215486f4d5fdb351de241c3a99ef001
Instruction Fuzzy Hash: C40104316027007ACB63DB609D13FCA77555B91B0FF160065B9067B6E2EAA98908819D

Function 00342810 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 224
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 003429D1
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 00342A30
SetEndOfFile.KERNEL32(?), ref: 00342A39
CloseHandle.KERNEL32(?), ref: 00342A52

Strings

Not enough disk space to extract file:, xrefs: 003428DB
T`L, xrefs: 0034290C
%sholder%d.aiph, xrefs: 003429AD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:$T`L
API String ID: 22866420-1364400410
Opcode ID: 05bf9a0075b7be8a51e588b29912b2b9302795346b63ca98095cddbda4c90e80
Instruction ID: 5e48915be846d3aa1f9e81618bd6c5d39062fc162c9744f32267e70e91d996bb
Opcode Fuzzy Hash: 05bf9a0075b7be8a51e588b29912b2b9302795346b63ca98095cddbda4c90e80
Instruction Fuzzy Hash: C3819D71A002099FDB11DF68CC45BAFB7E5EF48320F158629F925EB291DB31AD11CB94

Function 00360BE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003229D0: __Init_thread_footer.LIBCMT ref: 00322AA2

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,79276D7D,00000000,00000000), ref: 00360C34
GetTempPathW.KERNEL32(00000104,?), ref: 00360CC9
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00360CFA
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00360D2D
CopyFileW.KERNEL32(?,?,00000000), ref: 00360D4F
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00360D7E

Strings

shim_clone, xrefs: 00360CEE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderInit_thread_footerNameRevert
String ID: shim_clone
API String ID: 4264308349-3944563459
Opcode ID: 8051803dddb9515ca00e04cb799e426bbd6c897af194803918cf6acb1c907f4d
Instruction ID: ba082029737f0c26ff2dd165f69a54aceca4f0ebb8d6fb5626a90d81d554f89f
Opcode Fuzzy Hash: 8051803dddb9515ca00e04cb799e426bbd6c897af194803918cf6acb1c907f4d
Instruction Fuzzy Hash: 2E513730A402189EDB29DF64CC56BEEB7B9EF84700F1081A9F505AB1C1DB75AF44CB94

Function 0035F2F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,-00000400,?,00000002,00000400,79276D7D,?,?,?,?,?), ref: 0035F396
GetLastError.KERNEL32(?,?,?,?), ref: 0035F3A4
ReadFile.KERNEL32(?,00000000,00000400,000000FF,00000000,?,?,?,?), ref: 0035F3BF

Strings

ADVINSTSFX, xrefs: 0035F3F3, 0035F4AE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: b331fd2de4ddc0569138bd1d3331d23c9aab0c5295512b4777967db9b50245b1
Instruction ID: 61aba9ee3d42f7aed1c3baec051eed9ae006f076e582f8396e2d742bbf26b1b7
Opcode Fuzzy Hash: b331fd2de4ddc0569138bd1d3331d23c9aab0c5295512b4777967db9b50245b1
Instruction Fuzzy Hash: 4461C1B1A002088FDB12CF69C880FBFBBB9FB44315F654265E915AB2A1D7349D49CB64

Function 002327B1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,00000024), ref: 00232850
GetWindowLongW.USER32(?,000000FC), ref: 00232865
CallWindowProcW.USER32(?,?,00000082,?,00000024), ref: 0023287B
GetWindowLongW.USER32(?,000000FC), ref: 00232895
SetWindowLongW.USER32(?,000000FC,?), ref: 002328A5

Strings

$, xrefs: 002327F9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 8f9c7c55f79d0393c45fcf6bac12e1fa06908f74ffed39ed5a8ecd2b9deab70f
Instruction ID: f29fa4eb56776bd5c8c52d0a6f9760392f3b57c8977405c8da5a8f26c8ea6684
Opcode Fuzzy Hash: 8f9c7c55f79d0393c45fcf6bac12e1fa06908f74ffed39ed5a8ecd2b9deab70f
Instruction Fuzzy Hash: EB4112B1508700AFC360DF19D984A1BBBF5FF88720F504A2EF596836A0D772E8588F61

Function 002ED900 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,79276D7D,?,?,?,?,?,Function_001BDD00,000000FF,?,0031EE1C,?,?,000000FF), ref: 002ED943
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 002ED96C
RegOpenKeyExW.KERNEL32(?,79276D7D,00000000,?,00000000,79276D7D,?,?,?,?,?,Function_001BDD00,000000FF,?,0031EE1C,?), ref: 002ED9A5
RegCloseKey.ADVAPI32(00000000,?,?,?,Function_001BDD00,000000FF,?,0031EE1C,?,?,000000FF), ref: 002ED9B8

Strings

Advapi32.dll, xrefs: 002ED93E
RegOpenKeyTransactedW, xrefs: 002ED966

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: aca892a681e4c6f802fa3bba7d8a63b40cb1a162a2bd3b7dc912ab5f174f7dd1
Instruction ID: ea65882a65ebbb9ac83651cfc204a957597e672bb4a5412df8b0f1110f326bbe
Opcode Fuzzy Hash: aca892a681e4c6f802fa3bba7d8a63b40cb1a162a2bd3b7dc912ab5f174f7dd1
Instruction Fuzzy Hash: 8B21E232644246EFDB148F4ADC44FAAFBB8FB44750F00813AF819D7280D775A820CB54

Function 0033D210 Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 0033D230
GetWindowRect.USER32(00000000,?), ref: 0033D246
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0033CFF7,?,00000000), ref: 0033D25F
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0033CFF7,?), ref: 0033D26A
GetDlgItem.USER32(?,000003E9), ref: 0033D27C
GetWindowRect.USER32(00000000,?), ref: 0033D292
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206), ref: 0033D2D8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: fd8083072efde5e1fdaa34313e885bca9c36efa51866501bc481a7f0a92ac35f
Instruction ID: e6e9964266cfa6549b3afd99f4e581a754e751dd8f961c1795d129ba89dd8f78
Opcode Fuzzy Hash: fd8083072efde5e1fdaa34313e885bca9c36efa51866501bc481a7f0a92ac35f
Instruction Fuzzy Hash: A2217A70614300AFD344DF24DD89F6BBBE8EF89304F108629F859DA291D770E945CB5A

Function 00340FF0 Relevance: 9.4, APIs: 6, Instructions: 354fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,79276D7D,?,?,00000002,?,?,?,?,?,?,00000000,00420932), ref: 00341047
GetLastError.KERNEL32(?,00000002), ref: 003412D9
GetLastError.KERNEL32(?,00000002), ref: 00341383
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,00420932,000000FF,?,0033FF4A,00000010), ref: 00341056

Part of subcall function 00322230: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,79276D7D,00000008,00000000), ref: 0032227B
Part of subcall function 00322230: GetLastError.KERNEL32 ref: 00322285

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 00341118
ReadFile.KERNEL32(?,79276D7D,00000000,00000000,00000000,00000001,?,00000002), ref: 00341195

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: 359543162ee803dc7fb54518e2694176548261a986d32a63dff1fab831eb3e13
Instruction ID: e6265faec1ef4f7842e1336fd8cec385dd9d86ba3e30320c7720cc8c87576993
Opcode Fuzzy Hash: 359543162ee803dc7fb54518e2694176548261a986d32a63dff1fab831eb3e13
Instruction Fuzzy Hash: 32D1CF71D00609DFDB01DFA8D885BAEF7B5FF44314F148269E825EB292EB70A945CB90

Function 0033DCC0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 326COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,79276D7D,?,00000010,?), ref: 0033DF8A

Part of subcall function 0034EAB0: GetCurrentProcess.KERNEL32 ref: 0034EAF8
Part of subcall function 0034EAB0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 0034EB05
Part of subcall function 0034EAB0: GetLastError.KERNEL32 ref: 0034EB0F
Part of subcall function 0034EAB0: CloseHandle.KERNEL32(00000000), ref: 0034EBF0

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

Strings

Extraction path set to:, xrefs: 0033DFDD
[WindowsVolume], xrefs: 0033DD50, 0033DD62, 0033DD6C
\\?\, xrefs: 0033DF97
T`L, xrefs: 0033E00E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Process$Init_thread_footer$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$T`L$[WindowsVolume]$\\?\
API String ID: 699919280-3428966347
Opcode ID: f13f2d713c27feb48237e9ff2bd8a73cdd2d59f0dba1878d956709b3068e66d0
Instruction ID: f4a84661bc2539a3271e81fdb52b50c8f4ff7a37714e5b462dc6b8d69c4258ea
Opcode Fuzzy Hash: f13f2d713c27feb48237e9ff2bd8a73cdd2d59f0dba1878d956709b3068e66d0
Instruction Fuzzy Hash: 1CC1D070A0060A9FDB15DFA9C884BAEFBB4FF44314F158268E415AB2A2DB70DD45CF91

Function 0035C240 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,79276D7D,?,000000FF,?,00000000,004262A6,000000FF,?,0035C45A,000000FF,?,00000001), ref: 0035C27A
GetLastError.KERNEL32(?,0035C45A,000000FF,?,00000001), ref: 0035C284

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

ReadFile.KERNEL32(?,?,00007F90,00000000,00000000,79276D7D,?,000000FF,?,00000000,004262A6,000000FF,?,0035C45A,000000FF,?), ref: 0035C2C7

Strings

}m'y, xrefs: 0035C490
\\.\pipe\ToServer, xrefs: 0035C4E4, 0035C4F5, 0035C4FF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer$}m'y
API String ID: 2973225359-328139405
Opcode ID: ced02200ef0c8923f53233b65837a63063f1720996badb9ca6bd4d0a09aa6fcf
Instruction ID: 3a3d3c87d0d9aa0a1a81f5456c5e3d3093703ad9692b0b64672693fe48dbcf9f
Opcode Fuzzy Hash: ced02200ef0c8923f53233b65837a63063f1720996badb9ca6bd4d0a09aa6fcf
Instruction Fuzzy Hash: 1571C071610208EFDB15CF58D804BAEB7B8FF44728F10862EF8259B390DBB5A904CB90

Function 00361080 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 208COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,79276D7D,79276D7D,?,004C4C50,?,?,00343989,?,79276D7D,?,?,?,00000000,004210D5), ref: 003610E5
GetFileVersionInfoW.KERNELBASE(?,?,00000000,?,00000000,?,004C4C50,?,?,00343989,?,79276D7D,?,?,?,00000000), ref: 00361133

Strings

\VarFileInfo\Translation, xrefs: 00361167
ProductName, xrefs: 00361193
\StringFileInfo\%04x%04x\%s, xrefs: 0036119D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: a0075042b6464ec0f44314a5b2fb36f7fff844c0c3f5765884a658c7b24bff50
Instruction ID: 05a284ea178d8c76db25cdf461b3c5672e5a81e95d58b51ccf276e73ecfc50b6
Opcode Fuzzy Hash: a0075042b6464ec0f44314a5b2fb36f7fff844c0c3f5765884a658c7b24bff50
Instruction Fuzzy Hash: E971DC71A00119AFDB11DFA8DC59AEFB7F8EF05310F19852AE911E7291EB349D04CBA0

Function 00360F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00360BE0: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,79276D7D,00000000,00000000), ref: 00360C34
Part of subcall function 00360BE0: GetTempPathW.KERNEL32(00000104,?), ref: 00360CC9
Part of subcall function 00360BE0: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00360CFA
Part of subcall function 00360BE0: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00360D2D

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,79276D7D,00000000,?,?,00000000,004270A5,000000FF,Shlwapi.dll,00360F26,?,?,00000010), ref: 00360FBD
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,00000010), ref: 00360FE9
GetLastError.KERNEL32(?,00000010), ref: 0036102E
DeleteFileW.KERNEL32(?), ref: 00361041

Strings

Shlwapi.dll, xrefs: 00360F70, 00360FA8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$InfoPathTempVersionWow64$DeleteDisableErrorFolderLastNameRedirectionSize
String ID: Shlwapi.dll
API String ID: 1841109139-1687636465
Opcode ID: 0f45131d72274255242882955636f849fe35ee4c905e04f8e9c1ce9729e46dde
Instruction ID: 67890628119e0921c388cead7cb4172b2fc454d5f10aa0da159c2cc339769bc7
Opcode Fuzzy Hash: 0f45131d72274255242882955636f849fe35ee4c905e04f8e9c1ce9729e46dde
Instruction Fuzzy Hash: F73174B1A00249ABDF15CFA5D945BEFFBB8FF05350F14812AE801A7240D7359A44CBA5

Function 00360810 Relevance: 7.7, APIs: 5, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,79276D7D,?,?,00000000,?,?,?,?,00426FED,000000FF,?,00341C3D), ref: 00360850
CreateThread.KERNEL32(00000000,00000000,00360BD0,?,00000000,?), ref: 00360886
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0036098F
GetExitCodeThread.KERNEL32(00000000,?), ref: 0036099A
CloseHandle.KERNEL32(00000000), ref: 003609BA

Part of subcall function 00232970: RaiseException.KERNEL32(?,?,00000000,00000000,003B5A3C,C000008C,00000001,?,003B5A6D,00000000,?,002291C7,00000000,79276D7D,00000001,?), ref: 0023297C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateThread$CloseCodeEventExceptionExitHandleObjectRaiseSingleWait
String ID:
API String ID: 3595790897-0
Opcode ID: cb800ce9b69a426a3780e22019f69c9d87144384248e0d96620594300bdef3b2
Instruction ID: 3d884c8072fcad9299558bb64031f6ae2e06f65b8f800146e1be40e7af73d705
Opcode Fuzzy Hash: cb800ce9b69a426a3780e22019f69c9d87144384248e0d96620594300bdef3b2
Instruction Fuzzy Hash: 6F516971A007099FDB18CF68C885BAEB7F5FF48714F258669E916AB7A1D730A840CF50

Function 003245A0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

PathIsUNCW.SHLWAPI(?,?), ref: 00324736
_wcschr.LIBVCRUNTIME ref: 00324752

Strings

\\?\, xrefs: 00324718, 0032471E
\\?\UNC\, xrefs: 00324631, 003246A9, 003246AF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$HeapPathProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 660126660-3019864461
Opcode ID: da9d5c01a73cdb71ff69ced7a1a87dbc9e0ae908e467d6e61e157904e76f9de2
Instruction ID: a359c4f276ad0019e1bb41bc0984f2d39cc1092d2b40bc2fc238f95970bbd248
Opcode Fuzzy Hash: da9d5c01a73cdb71ff69ced7a1a87dbc9e0ae908e467d6e61e157904e76f9de2
Instruction Fuzzy Hash: C3C1CF71A006199FDB01DBA8CC85BAEF7F8FF45310F158269E425EB2D1EB749904CBA0

Function 00336660 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

Part of subcall function 003364D0: GetTickCount.KERNEL32 ref: 00336554
Part of subcall function 003364D0: __Xtime_get_ticks.LIBCPMT ref: 0033655C
Part of subcall function 003364D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003365A6

Part of subcall function 0035A240: GetUserNameW.ADVAPI32(00000000,?), ref: 0035A2CE
Part of subcall function 0035A240: GetLastError.KERNEL32 ref: 0035A2D4
Part of subcall function 0035A240: GetUserNameW.ADVAPI32(00000000,?), ref: 0035A31C
Part of subcall function 0035A240: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 0035A352
Part of subcall function 0035A240: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 0035A39C

__Init_thread_footer.LIBCMT ref: 003367A1

Strings

tiL, xrefs: 0033675C
\/:*?"<>|, xrefs: 00336763
tiL, xrefs: 003367F7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EnvironmentNameUserVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|$tiL$tiL
API String ID: 2099558200-3440277428
Opcode ID: 4f711e78595527e0a0ba82d256171b9d07dacc93ae79da035a69efde7ae7b629
Instruction ID: 7120b29210235620dc1b61328665e1e49b245c061581633e29ad508d0cdd986a
Opcode Fuzzy Hash: 4f711e78595527e0a0ba82d256171b9d07dacc93ae79da035a69efde7ae7b629
Instruction Fuzzy Hash: 7FD1BF70904258DFDB25DFA4C895BEDBBB0BF14308F1581ADD409AB282DB755E48CFA1

Function 003CEF42 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 003CF0F1

Part of subcall function 003CDC17: RtlAllocateHeap.NTDLL(00000000,00000000,003CD0E1,?,003CEE85,?,00000000,?,003BF625,00000000,003CD0E1,?,?,?,?,003CCEDB), ref: 003CDC49

__freea.LIBCMT ref: 003CF106
__freea.LIBCMT ref: 003CF116

Strings

`&#, xrefs: 003CEF44, 003CF0BD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID: `&#
API String ID: 2243444508-3593461860
Opcode ID: 420da26ef3bc4adff54cab171c34077eb40c7daffb19ccb093ccedad588df0d9
Instruction ID: 57f8706770ea741f2e6bcd023f949b37542366b656655cdd7bd03ce8b6314046
Opcode Fuzzy Hash: 420da26ef3bc4adff54cab171c34077eb40c7daffb19ccb093ccedad588df0d9
Instruction Fuzzy Hash: 19519272600216AFEB265F64DC41FBB7AAAEB04754F1A013DFD04DB251EB75CD109760

Function 00336200 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,79276D7D,?,00000010,?,00339550,?), ref: 00336266
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 003362AF
ReadFile.KERNEL32(00000000,79276D7D,?,?,00000000,00000078,?), ref: 003362ED
CloseHandle.KERNEL32(00000000), ref: 00336339

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: e1b562ba69018b985f67906f579c2ac16d588f1a20cd3df027515c3794f5f961
Instruction ID: 431e42e7ee72942105108cd67215a5751ed4e498598073474604111840419d1b
Opcode Fuzzy Hash: e1b562ba69018b985f67906f579c2ac16d588f1a20cd3df027515c3794f5f961
Instruction Fuzzy Hash: E1416B70900609AFDB12CF98CC89BEEFBB8EF45724F148269E421AB2D1D7749D44CB64

Function 003D327C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003D2DAC: GetOEMCP.KERNEL32(00000000,?,?,?,00000104), ref: 003D2DD7

IsValidCodePage.KERNEL32(-00000030,00000000,?,`&#,?,?,?,?,?,`&#,003D30C3,?,00000000,?,?,00000104), ref: 003D32DD
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,`&#,003D30C3,?,00000000,?,?,00000104), ref: 003D331F

Strings

`&#, xrefs: 003D327E, 003D328E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: `&#
API String ID: 546120528-3593461860
Opcode ID: f54d4ac9d8cf9aef6be7e78db860e4ac58b49119bdbd9744eca68a2724629719
Instruction ID: 3b679c791fcdbfab821ed3fcd08945390afdbb3f43612615d68473ee5071cfbc
Opcode Fuzzy Hash: f54d4ac9d8cf9aef6be7e78db860e4ac58b49119bdbd9744eca68a2724629719
Instruction Fuzzy Hash: 82513476A006448EDB23DF36D9806AAFBF5EF80300F15446FD0928B352DA789E06CB51

Function 0033CFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0033C783,00000000), ref: 0033CFA0
DestroyWindow.USER32(?), ref: 0033D057

Strings

(0;, xrefs: 0033D031

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID: (0;
API String ID: 1182162058-2807173533
Opcode ID: 0b90125ed86f6eb9de5fb9877a8321bac4cc3e366ce77e9f634fa00d047dac89
Instruction ID: 721244a41ba15f6625299e8b924d9dc030f7723d437986107d823c2832b6abcc
Opcode Fuzzy Hash: 0b90125ed86f6eb9de5fb9877a8321bac4cc3e366ce77e9f634fa00d047dac89
Instruction Fuzzy Hash: F92106B16101199BD725AF18FC41BAA77A4EB94320F004266FD04CB791D776EC61CBF5

Function 003D0308 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,E8458D00,00000100,?,E8458D00,00000000), ref: 003D033C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,`&#,003CF030,?,?,00000000,?,00000000), ref: 003D035A

Strings

`&#, xrefs: 003D030A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: String
String ID: `&#
API String ID: 2568140703-3593461860
Opcode ID: c1e20b955dcb26bcec5615a5add710e819f66307126da30d3866eca1e30cbde5
Instruction ID: 08233b75d30578802180403a234cc4ba2b8c84bc71f9b813f7542641a5901b16
Opcode Fuzzy Hash: c1e20b955dcb26bcec5615a5add710e819f66307126da30d3866eca1e30cbde5
Instruction Fuzzy Hash: 58F07A3610061ABBCF135F91EC05EDE7F26FF48760F054125FA1869120CB32D971AB94

Function 00340B10 Relevance: 4.7, APIs: 3, Instructions: 196fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,79276D7D,?,?), ref: 00340B77
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00340C84

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: e84f5e63a6d5183a0b2c2c0c33a389479c90ccff2b8875a350a49d69bf047f44
Instruction ID: 13ee1de54da511aa270a435a3181aa62c598f96f1cb9794003c10bf71d018a4b
Opcode Fuzzy Hash: e84f5e63a6d5183a0b2c2c0c33a389479c90ccff2b8875a350a49d69bf047f44
Instruction Fuzzy Hash: 9C618071E00609EFDB15DFA8D845B9DFBB4FF05320F10826AE924AB391DB75A914CB90

Function 0033E0A0 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,79276D7D,?,?,?,80004005,?,00000000), ref: 0033E13E
GetLastError.KERNEL32(?,?,?,80004005,?,00000000), ref: 0033E176
GetLastError.KERNEL32(?,?,?,?,80004005,?,00000000), ref: 0033E20F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 8ba2685b6f7cce3da5f358c80ecb5dce7febdcdca86e3b943b99252443e9c6b0
Instruction ID: 34db1b676966508acbf1516f8fdf3400ea02e234a59649980602d67a7f636110
Opcode Fuzzy Hash: 8ba2685b6f7cce3da5f358c80ecb5dce7febdcdca86e3b943b99252443e9c6b0
Instruction Fuzzy Hash: 1E51E171A006059FDB21DF68DC81BAAF7B5FF44320F108629E915D73E1EB31A905CB90

Function 00324920 Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,79276D7D,?,?,771AE010,00000000,0041AAC5,000000FF,?,003632A7,00000000,.part,00000005), ref: 0032496B
CreateDirectoryW.KERNEL32(000000FF,00000000,?,?,00452A4C,00000001,?), ref: 00324A2A
GetLastError.KERNEL32 ref: 00324A38

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: e79a02bd84b3a9818e1c4bca0512938faa7751f8e2c4a88c9528237ab7294e21
Instruction ID: 1634f8f98adb7a8ece5a8417316e80668ad04b89ec7329cfcbb9007a2bc971e2
Opcode Fuzzy Hash: e79a02bd84b3a9818e1c4bca0512938faa7751f8e2c4a88c9528237ab7294e21
Instruction Fuzzy Hash: BC61EE31A00219DFDB11DFA8D885BADFBF4EF19320F258269E814A72D1EB749904CF90

Function 003CC63C Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,003CC636,?,003BAD12,?,?,79276D7D,003BAD12,?), ref: 003CC64D
TerminateProcess.KERNEL32(00000000,?,003CC636,?,003BAD12,?,?,79276D7D,003BAD12,?), ref: 003CC654
ExitProcess.KERNEL32 ref: 003CC666

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 634e006eb2c8736b8d2ece96bd71ee6accd348706960c3bf66cc91f337e2edda
Instruction ID: ea221013ba5c67f768ee378b9dcdc16824bd9ad3020d4ebad930afa4de21dc04
Opcode Fuzzy Hash: 634e006eb2c8736b8d2ece96bd71ee6accd348706960c3bf66cc91f337e2edda
Instruction Fuzzy Hash: FAD06731010604ABCF022F60DD09D597F25AB443417157068F90A8A032CF719DA29B98

Function 00324C60 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,79276D7D), ref: 00324E00

Part of subcall function 00324EC0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 00324ECD

Strings

USERPROFILE, xrefs: 00324CAE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: cf68b1c223af0217718a79f8c0adc896af1f3ae1c5318021a252a4fc1544f1cb
Instruction ID: 9d7b9dd9d69e70843569f2ff737a652de344c378c979648f9bc5dfa7472b8122
Opcode Fuzzy Hash: cf68b1c223af0217718a79f8c0adc896af1f3ae1c5318021a252a4fc1544f1cb
Instruction Fuzzy Hash: 4C61BF71A00629DFDB14DFA8D859BAEB7B8FF44710F11866DE819DB392DB309900CB91

Function 00343E40 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,00344020,?), ref: 00343E8B

Strings

}m'y, xrefs: 00344020, 00344035, 00344039

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EnumLanguagesResource
String ID: }m'y
API String ID: 4141015960-184714451
Opcode ID: ce33c77c717e637e550956d7ce160b4e801a3f986fcaa032da1367200997f632
Instruction ID: a1476b5af371d6d6157390864b55131075e1abd944296e3968b53789c7f75a80
Opcode Fuzzy Hash: ce33c77c717e637e550956d7ce160b4e801a3f986fcaa032da1367200997f632
Instruction Fuzzy Hash: 15617E71A0161A9FDB15DF68C885B9AF7F4FF08304F110269E914AF681E771EA588BA0

Function 003D2E80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,003D30CF,003D30C3,00000000), ref: 003D2EB2

Strings

`&#, xrefs: 003D2E82

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Info
String ID: `&#
API String ID: 1807457897-3593461860
Opcode ID: 152e5559819ec85831974c86becaf83349f9e6ad2dea5d507f418cf18e6b6cce
Instruction ID: 0ba348581a21a92e55109711e593fc9217d1857ccd2ddafd82b8984801447e53
Opcode Fuzzy Hash: 152e5559819ec85831974c86becaf83349f9e6ad2dea5d507f418cf18e6b6cce
Instruction Fuzzy Hash: 60513B725041589EDB238B28DD84BE77BBCEB65704F2409EEE49AC7242D2359E46DF20

Function 00284BF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 00284CC1

Strings

$, xrefs: 00284C2D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: LongWindow
String ID: $
API String ID: 1378638983-3993045852
Opcode ID: 2c6ae0ed7bfc5ffd0a3df1d111d2f5b927d17f8b9e8d5da4fbe1029b9e6c6706
Instruction ID: 5286dbd59b317bf3db5178d328ba13d0bd67187e814bef68120c408889d96774
Opcode Fuzzy Hash: 2c6ae0ed7bfc5ffd0a3df1d111d2f5b927d17f8b9e8d5da4fbe1029b9e6c6706
Instruction Fuzzy Hash: C831DC75106341DFCB54AF08C884B1AFBF4BF88310F04855EF9458B295D3B5E964CB91

Function 00307FE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

__Init_thread_footer.LIBCMT ref: 00308052

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

Strings

XaL, xrefs: 0030805C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: XaL
API String ID: 2296764815-2657284423
Opcode ID: a88a8cfa886a50adbb1285dceec270dfbf1570802016d4b82ad28b82d00ba78b
Instruction ID: 1794a3f4b59e6a0db3bb3fdcbbff809dd5642608bf206ea1d2bd4d0cff1eb3d0
Opcode Fuzzy Hash: a88a8cfa886a50adbb1285dceec270dfbf1570802016d4b82ad28b82d00ba78b
Instruction Fuzzy Hash: FA0147B1A04644EFCB65CF18D842F85B3A0EB04721F21837EF415877C2DF39A8049619

Function 003618E0 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00361931
EndDialog.USER32(00000000,00000001), ref: 00361940

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: 24c01b0fe9170d38da7ee2480c2abea5f17fad4e128cbfdc501bd1d315569342
Instruction ID: 4f4d7dd78be2b03f3735d8b669ec15f45eff28470898293966d48600a201760f
Opcode Fuzzy Hash: 24c01b0fe9170d38da7ee2480c2abea5f17fad4e128cbfdc501bd1d315569342
Instruction Fuzzy Hash: E6517930A01A45DFD711CF69C948B8AFBF4EF49310F18C2ADE4599B2A5D774AA04CB91

Function 0035F6D0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 0035F735
CloseHandle.KERNEL32(?), ref: 0035F789

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID:
API String ID: 10933145-0
Opcode ID: 75441038ef30604f3c28842fc43962cba980de48bcb3777e1c8a35664a26d037
Instruction ID: 5240658b585e327dbe71d689de0ab19104220328c6e668405099cda5cf5b654b
Opcode Fuzzy Hash: 75441038ef30604f3c28842fc43962cba980de48bcb3777e1c8a35664a26d037
Instruction Fuzzy Hash: 57211A71604B019FD744DF19EC88F9ABBF8FB04755F018229E426C72A0DB79A948CB98

Function 00320F40 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00322350: LoadLibraryW.KERNEL32(ComCtl32.dll,79276D7D,00000000,?,00000000), ref: 0032238E
Part of subcall function 00322350: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 003223B1
Part of subcall function 00322350: FreeLibrary.KERNEL32(00000000), ref: 0032242F

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00320F84
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00320F8F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: 977e8648611b9fa0bd21b311870245fede1de8cb5046dd4c05fca518b7f9f1e4
Instruction ID: 55cd7573abdd75851aa93e4a454f92af6e6d398ff1327142cf3d7e187bf7c7cb
Opcode Fuzzy Hash: 977e8648611b9fa0bd21b311870245fede1de8cb5046dd4c05fca518b7f9f1e4
Instruction Fuzzy Hash: B2F030327812283BF66021596C57F67B64DD785B64F144276FB98AF2C2ECD77C1102D8

Function 003CDBDD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,003D221D,?,00000000,?,?,003D24BE,?,00000007,?,?,003D2B18,?,?), ref: 003CDBF3
GetLastError.KERNEL32(?,?,003D221D,?,00000000,?,?,003D24BE,?,00000007,?,?,003D2B18,?,?), ref: 003CDBFE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 4db3482101b3025b8b1415f78486c9e4e1759c212baa3f5db47ec1ab86a9f895
Instruction ID: d6581b4f420deecc0061db3a9f54e5e9433ed2cee61b5a76b46ee7db18bc985a
Opcode Fuzzy Hash: 4db3482101b3025b8b1415f78486c9e4e1759c212baa3f5db47ec1ab86a9f895
Instruction Fuzzy Hash: E1E08631104714ABCB123FA4ED0DBA97B78AB00355F059038F608CA061DB719C94CBA4

Function 00342AB0 Relevance: 1.6, APIs: 1, Instructions: 138fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,79276D7D), ref: 00342ADB

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 31c4425fd229533cff97333e625d74775a80d11666d84119a01d741204d73d08
Instruction ID: ff79a79a0d9d09e3ef3103169df55f5c3b088f31eb9bc5176c91839ade927b72
Opcode Fuzzy Hash: 31c4425fd229533cff97333e625d74775a80d11666d84119a01d741204d73d08
Instruction Fuzzy Hash: 4241DD71A00614DFDB12DF58C885B9ABBF4FB04710F1686A9FD14AF282DB71A904CBA0

Function 00322890 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00322B00: __Init_thread_footer.LIBCMT ref: 00322B76

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

__Init_thread_footer.LIBCMT ref: 00322970

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: 4aef82c7bb73dbe84dead5ff8ddb72660d26733131c14c77550008392bff87e3
Instruction ID: 2d3531844258719b0465d33f77635440cd163b1baa7515c872b0bcbaeadd2cd1
Opcode Fuzzy Hash: 4aef82c7bb73dbe84dead5ff8ddb72660d26733131c14c77550008392bff87e3
Instruction Fuzzy Hash: 9A31D1B1A00A50EFD752DF04FC86F9AB3A4F700718F228629E8514B7D0D7BAA954CB4D

Function 0035F850 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,00341B50,?,00000000,00000000,?,?), ref: 0035F86D

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Part of subcall function 0035F940: WaitForSingleObject.KERNEL32(?,000000FF,79276D7D,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 0035F974

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AllocCreateFileHeapObjectSingleWait
String ID:
API String ID: 2723504993-0
Opcode ID: 7d984b7292bf14a2c5be01d6b4b02084454d111a98c2555898ff9db3a1135783
Instruction ID: 9dd05d261a2bfe7d0d6d0815ac48ec05a0fe5539de3333f9833b090fe5f0e710
Opcode Fuzzy Hash: 7d984b7292bf14a2c5be01d6b4b02084454d111a98c2555898ff9db3a1135783
Instruction Fuzzy Hash: FC310434604B009FD325DF28D888F1ABBE0FF88304F20896DE99ADB360D731A994CB55

Function 003CEE70 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 003CDC17: RtlAllocateHeap.NTDLL(00000000,00000000,003CD0E1,?,003CEE85,?,00000000,?,003BF625,00000000,003CD0E1,?,?,?,?,003CCEDB), ref: 003CDC49

RtlReAllocateHeap.NTDLL(00000000,00000000,?,003CD0E1,00000000,?,003BF625,00000000,003CD0E1,?,?,?,?,003CCEDB,?,?), ref: 003CEECD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c33278481566e88dfa7829e2f8fca4646385f2fbd37859072032a5d4df200201
Instruction ID: 5fb4ad22cab4dbf1a069113a81aa0089338a6f67172007cf1d4a23260c824812
Opcode Fuzzy Hash: c33278481566e88dfa7829e2f8fca4646385f2fbd37859072032a5d4df200201
Instruction Fuzzy Hash: 7EF062325002156A9B233A35AC01FAB7BA99F817F0B16012DF868DE191DF219C4097A1

Function 00322B00 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

Part of subcall function 00322BA0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00322C0E
Part of subcall function 00322BA0: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00322C55
Part of subcall function 00322BA0: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00322C74
Part of subcall function 00322BA0: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00322CA3
Part of subcall function 00322BA0: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00322D18

__Init_thread_footer.LIBCMT ref: 00322B76

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 30e39c970cd81947d43c6a8897918723c70b46f354b19c5b8badc9c9edcfb2fb
Instruction ID: fbe3e4283066bba1f7f56256ae69fa3890d2995e87e7f608dbd22c7e5330ca81
Opcode Fuzzy Hash: 30e39c970cd81947d43c6a8897918723c70b46f354b19c5b8badc9c9edcfb2fb
Instruction Fuzzy Hash: 2B01F2B5A00604FBC711DF58EC42F5A73A4E704720F31833EE9259B7C5D738A9008649

Function 003CDC17 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,003CD0E1,?,003CEE85,?,00000000,?,003BF625,00000000,003CD0E1,?,?,?,?,003CCEDB), ref: 003CDC49

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 9ae41b0d40ae948dae08dd2f88349da2cb7f34ee3398419b3ed5330db909aab1
Instruction ID: e4e4300849da2e3052d67e94c3f9ce6de11045d2ec66edb3c4994b10ea4c01a7
Opcode Fuzzy Hash: 9ae41b0d40ae948dae08dd2f88349da2cb7f34ee3398419b3ed5330db909aab1
Instruction Fuzzy Hash: 8FE0ED315002205ADB233AA59D05FAB768C9B413A0F0A8038FC46DA090EBE0EC40D3A0

Function 003CD049 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003CD050

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 0564ba2cac5a3ef8b5ee78c355d0c53d9637b8e5312d9c4ddb9492affe39cbde
Instruction ID: d0ec5d53c13f4d4767ed315ff6117ac670fb959ef9845284f69b7dde325b0e51
Opcode Fuzzy Hash: 0564ba2cac5a3ef8b5ee78c355d0c53d9637b8e5312d9c4ddb9492affe39cbde
Instruction Fuzzy Hash: DDE09AB2C0020EAADB01DFD4C456BEFBBB8EB08314F509427E245EB141EB7857448BA1

Function 00228750 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0022875B

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d76278e01b045bf7c5ab22e1ce2ca2a81a42c6464236dc2e2c957549e6a02276
Instruction ID: fbac263f640c3b43717560f1809f6ac5059ca991adfc62d5993a6a930e504ff3
Opcode Fuzzy Hash: d76278e01b045bf7c5ab22e1ce2ca2a81a42c6464236dc2e2c957549e6a02276
Instruction Fuzzy Hash: 2BC08C702017204BC7305F18BA08742B2EC5B04704F01441DB409C3200CA70DC008A58

Non-executed Functions

Function 00222F40 Relevance: 210.0, Strings: 166, Instructions: 2486COMMON

Download Yara Rule

Strings

800, xrefs: 0022390D
ODBCTranslator, xrefs: 0022419B, 002252A8
InstallServices, xrefs: 00225517
AI_AppSearchEx, xrefs: 00225EA6, 00225ECC
P$L, xrefs: 002262AE
StopServices, xrefs: 00223ED7, 00223F5D
10000, xrefs: 002256BC, 002262B3
IniFile, xrefs: 002246D7, 00225099
RemoveExistingProducts, xrefs: 00222F64
PL, xrefs: 00224BB9
3000, xrefs: 00223AEF, 00223DDE, 00223E64, 00223FF6, 0022431A, 002243A0, 00224426, 002244AC, 00224532, 002245B8, 002247D0, 00224E06, 00224F7D, 002253A1, 002254A4
InstallInitialize, xrefs: 00225829
UnpublishFeatures, xrefs: 00223E4C
12000, xrefs: 00224102, 00224188, 0022420E, 00224856, 002248DC, 00224962, 002249DF, 00224A65, 00224D80, 0022520F, 00225295, 0022531B
AI_ProcessTasks, xrefs: 0022601D
@L, xrefs: 00224F0E
ProcessComponents, xrefs: 00223AA0
1500, xrefs: 00224639, 002246C4, 00225BCB, 00226133
CostInitialize, xrefs: 0022332D
AI_InstallPostPrerequisite, xrefs: 00225AB5
@!L, xrefs: 00226018
#L, xrefs: 002261B4
Options, xrefs: 00225A8F, 00225B10
RegisterClassInfo, xrefs: 00224DF3
RegisterComPlus, xrefs: 0022548C
PublishComponent, xrefs: 00223DF1, 002256CF
AI_XmlElement, xrefs: 00225B61, 002260C0
1500000, xrefs: 0022552A
AI_GxUninstall, xrefs: 00225E29
( L, xrefs: 00225F31
PublishComponents, xrefs: 002256A9
3000000, xrefs: 0022510C
8000, xrefs: 0022407C, 00224294, 00225192, 00225427
MsiPublishAssemblies, xrefs: 0022572F
MIME, xrefs: 002245CB, 00224F90
RegisterMIMEInfo, xrefs: 00224F6A
PublishFeatures, xrefs: 002257AC
RemoveDuplicateFiles, xrefs: 00224843
WriteIniValues, xrefs: 00225073
8#L, xrefs: 002261C7
AI_PreRequisite, xrefs: 00225949, 002259CF, 00225A55, 00225ADB
$L, xrefs: 0022628D
CreateFolders, xrefs: 00224A52
File, xrefs: 00223598, 002248EF, 00224B7F
UnregisterComPlus, xrefs: 00223FE3
UnregisterProgIdInfo, xrefs: 0022451F
5000, xrefs: 00224D03
ODBCDriver, xrefs: 00224221, 0022532E
Registry, xrefs: 0022432D, 00225013
FileCost, xrefs: 00223514
WriteEnvironmentStrings, xrefs: 002250F9
6000, xrefs: 00225000
(L, xrefs: 00224EFB
PatchSize, xrefs: 00224C44
RemoveIniValues, xrefs: 0022462B, 002246B1
xL, xrefs: 00224F3F
Extension, xrefs: 002244BF, 00224E96
RegisterProgIdInfo, xrefs: 00224EED
SelfRegModules, xrefs: 00225414
TypeLib, xrefs: 002253B4
MsiAssembly, xrefs: 00225755
8$L, xrefs: 0022629B
Environment, xrefs: 002247E3, 0022511F
ServiceControl, xrefs: 00223EFD, 00223F83, 00225649
(!L, xrefs: 00226005
AI_UserAccounts, xrefs: 00225CD8, 00225FC6
h$L, xrefs: 002262C1
@"L, xrefs: 002260F5
DuplicateFile, xrefs: 00224869, 00224C90
InstallFinalize, xrefs: 002258A6
RemoveIniFile, xrefs: 00224651
CostFinalize, xrefs: 002236DC
PatchFiles, xrefs: 00224BE4
RemoveEnvironmentStrings, xrefs: 002247BD
p"L, xrefs: 0022611B
@ L, xrefs: 00225F44
0L, xrefs: 00224C78
RegisterTypeLibraries, xrefs: 0022538E
AI_ProcessAccounts, xrefs: 00225FA0
hL, xrefs: 00224C9E
L, xrefs: 00224C3F
Patch, xrefs: 00224C0A
Feature, xrefs: 00223E77, 002257D2
RemoveFiles, xrefs: 002248C9, 0022494F
AI_XmlAttribute, xrefs: 00225BDE, 00226141
RegisterFonts, xrefs: 0022517F
p#L, xrefs: 002261F8
Font, xrefs: 002242A7, 002251A5
L, xrefs: 00224D11
x L, xrefs: 00225F75
8L, xrefs: 00224B92
StartServices, xrefs: 00225623
AI_ExtractPrereq, xrefs: 002259A9
Component, xrefs: 002233B6, 0022377A, 0022395C, 00223B3E
CreateShortcuts, xrefs: 00224D6D
InstallODBC, xrefs: 002251FC, 00225282, 00225308
200000, xrefs: 0022583C
MoveFile, xrefs: 00224AFE
MsiConfigureServices, xrefs: 0022559D, 002255C3
RemoveRegistry, xrefs: 002243B3
Complus, xrefs: 00224009, 002254B7
UnregisterClassInfo, xrefs: 00224413
AI_UninstallGroups, xrefs: 00225D2F
ServiceInstall, xrefs: 0022553D
Component_, xrefs: 00223E04, 00223F10, 00223FA5, 0022401C, 00224128, 002241AE, 00224248, 00224340, 002243C6, 00224664, 002246EA, 00224770, 002247F6, 0022487C, 00224902, 00224A05, 00224A8B, 00224B11, 00224B97, 00224CA3, 00224DA6, 00225026, 002250AC, 00225132, 00225235, 002252BB, 00225346, 002253C7, 002254CA, 00225550, 002255E5, 0022565C, 002256E2
X#L, xrefs: 002261E2
AI_CountRowAction, xrefs: 00226223
AI_DefaultActionCost, xrefs: 002262A0
AI_GxInstall, xrefs: 00225C35
ProgId, xrefs: 00224545, 00224F13
Location, xrefs: 00225983, 00225A09
100, xrefs: 00224BF7, 00224F00, 00225E3C
MsiUnpublishAssemblies, xrefs: 00223C82
MoveFiles, xrefs: 00224AD8
RemoveFolders, xrefs: 002249CC
500, xrefs: 00225EB9
AI_InstallPrerequisite, xrefs: 00225A2F
AI_UninstallTasks, xrefs: 00225DAC
InstallFiles, xrefs: 00224B5E
2000, xrefs: 00223185, 00225C48, 00225CC5, 00225D42, 00225DBF, 00225F36, 00225FB3, 00226030
`L, xrefs: 00224F29
RemoveShortcuts, xrefs: 00224737
hL, xrefs: 00224BCC
HL, xrefs: 00224C8B
Shortcut, xrefs: 0022475D, 00224D93
AI_Game, xrefs: 00225C5B, 00225E4F
` L, xrefs: 00225F5F
AI_ChainProductsPseudo, xrefs: 002261A6
SelfUnregModules, xrefs: 00224069
AI_UserGroups, xrefs: 00225D55, 00225F49
Feature_, xrefs: 00223D20, 002244D2, 00224EA7, 00225766, 0022595C, 002259E2, 00225A68, 00225AEE
~, xrefs: 00225A99
DuplicateFiles, xrefs: 00224C6A
100000, xrefs: 002258B9
UnregisterFonts, xrefs: 00224281
FileSize, xrefs: 00224BBE
1800, xrefs: 00225B4E, 002260AD
UnregisterMIMEInfo, xrefs: 002245A5
UnpublishComponents, xrefs: 00223DCB
AI_XmlUninstall, xrefs: 0022609A, 00226120
RemoveODBC, xrefs: 002240EF, 00224175, 002241FB
15000, xrefs: 00223EEA, 00223F70, 00224AEB, 00224C7D, 00224E83, 002255B0, 002257BF
p!L, xrefs: 0022603E
CreateFolder, xrefs: 002249F2, 00224A78
AI_DownloadPrereq, xrefs: 00225923
InstallValidate, xrefs: 002238BE
AI_XmlInstall, xrefs: 00225B3B, 00225BB8
30000, xrefs: 00223CD1, 00225086, 00225742
AI_ScheduledTasks, xrefs: 00226043
X"L, xrefs: 00226108
AppSearch, xrefs: 0022314B, 002231D4
BindImage, xrefs: 00224CF0, 00224D16
RemoveFile, xrefs: 00224975
RegisterExtensionInfo, xrefs: 00224E70
WriteRegistryValues, xrefs: 00224FED
RemoveRegistryValues, xrefs: 00224307, 0022438D
X!L, xrefs: 0022602B
SelfReg, xrefs: 0022408F, 0022543A
AppId, xrefs: 00224439, 00224E19
20000, xrefs: 00225636
AI_UninstallAccounts, xrefs: 00225CB2
AI_ProcessGroups, xrefs: 00225F23
120000, xrefs: 0022474A
UnregisterExtensionInfo, xrefs: 00224499
("L, xrefs: 002260CE
ODBCDataSource, xrefs: 00224115, 00225222

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: #L$ $L$(L$( L$(!L$("L$0L$100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$8L$8#L$8$L$800$8000$@L$@ L$@!L$@"L$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$HL$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$PL$P$L$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$X!L$X"L$X#L$`L$` L$hL$hL$h$L$p!L$p"L$p#L$xL$x L$~$L$L
API String ID: 0-224244478
Opcode ID: 8d1f98fdc8fa6335621077fc5b660ce343dfad0da86a5f04e95f324a737cb3ed
Instruction ID: 7e0ebf24912d67b15e91d974eadf607580d9e3e2d70f0206f90b7facc4c37377
Opcode Fuzzy Hash: 8d1f98fdc8fa6335621077fc5b660ce343dfad0da86a5f04e95f324a737cb3ed
Instruction Fuzzy Hash: 2233EA20A563C8FAD740EFF4AD15B5D29509B52705F6083AEE1452B2E2CFBC4B18876F

Function 002441B0 Relevance: 48.2, APIs: 16, Strings: 11, Instructions: 961memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0024420A
VariantClear.OLEAUT32(?), ref: 0024423C
VariantClear.OLEAUT32(?), ref: 0024435F
VariantClear.OLEAUT32(?), ref: 0024438E
SysFreeString.OLEAUT32(00000000), ref: 00244395
SysAllocString.OLEAUT32(00000000), ref: 002443E8
VariantClear.OLEAUT32(?), ref: 00244476
VariantClear.OLEAUT32(?), ref: 002444A8
VariantClear.OLEAUT32(?), ref: 00244609
VariantClear.OLEAUT32(?), ref: 0024463C
SysFreeString.OLEAUT32(00000000), ref: 00244647
SysAllocString.OLEAUT32(00000000), ref: 0024468A
SysFreeString.OLEAUT32(00000000), ref: 00244845

Part of subcall function 00245120: VariantClear.OLEAUT32(?), ref: 00245129

VariantClear.OLEAUT32(?), ref: 002447FB
VariantClear.OLEAUT32(?), ref: 00244837
SysAllocString.OLEAUT32(00000000), ref: 00244869

Strings

MsiGetBinaryPath, xrefs: 00244BAA
MsiResolveFormatted, xrefs: 00244AF7
GetFontHeight, xrefs: 00245054
MsiEvaluateCondition, xrefs: 00244A5C
MsiGetBinaryPathIndirect, xrefs: 00244C6C
MsiPublishEvents, xrefs: 00244D34
MsiSetProperty, xrefs: 002448F0
MsiGetProperty, xrefs: 0024499D
MsiGetBytesCountText, xrefs: 00244EC4
MessageBox, xrefs: 00244DFC
MsiGetFormattedError, xrefs: 00244FA1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 1305860026-3153392536
Opcode ID: 5a6f649ba8635d8a6615370a0c16db0dbb7684dfb497c72cfcb3894d573b499f
Instruction ID: 44d1fb10673c184563ee8499e4aab8abd8c4a275bbfba942cede99755a98f64f
Opcode Fuzzy Hash: 5a6f649ba8635d8a6615370a0c16db0dbb7684dfb497c72cfcb3894d573b499f
Instruction Fuzzy Hash: 54925970D10258DFDB24DFA4CC84BDEBBB4BF49314F104299E449A7281EB74AA95CF94

Function 003577C0 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 514fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(004C6078,C0000000,00000003,00000000,00000004,00000080,00000000,79276D7D,004C6054,004C606C,?), ref: 00357837
GetLastError.KERNEL32 ref: 00357854
OutputDebugStringW.KERNEL32(00000000,00000020), ref: 003578CF
OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 003579CB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 00357A3C
WriteFile.KERNEL32(00000000,004C5920,00000000,00000000,00000000,?,0000001C), ref: 00357A6C
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,004458A8,00000002), ref: 00357B17
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00357B20
FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 00357A71

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 00357C12
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,0000001D), ref: 00357C98
FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 00357CA3
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,004458A8,00000002,?,?,CPU: ,00000005), ref: 00357D17
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00357D20
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,004458A8,00000002), ref: 00357DA5
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00357DAE

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Strings

x86, xrefs: 00357AA8
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00357AE7
server, xrefs: 00357AC3, 00357ACB
CPU: , xrefs: 00357B68, 00357B7E, 00357CAC
workstation, xrefs: 00357ABE
LOGGER->Creating LOG file at:, xrefs: 00357BBA, 00357BCC, 00357BD6
LOGGER->failed to create LOG at:, xrefs: 0035788A, 0035789C, 003578A6
x64, xrefs: 00357AB1, 00357ABD
LOGGER->Reusing LOG file at:, xrefs: 00357973, 00357985, 0035798F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$Init_thread_footer$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 4051163352-1312762833
Opcode ID: a5ec3b0cc2cf38f611f915c61d99e3adcf519bf4487edee2f8cccb98a7463144
Instruction ID: 0149543c07f1ca7b5fca387c915d7aa7f8004d3ff2624a54c0ee6b825816a3eb
Opcode Fuzzy Hash: a5ec3b0cc2cf38f611f915c61d99e3adcf519bf4487edee2f8cccb98a7463144
Instruction Fuzzy Hash: FA129E70A012099FEB01DF68DC49BAEBBB5FF44311F1582A9E815AB2A2DB34DD45CB50

Function 002435A0 Relevance: 33.7, APIs: 22, Instructions: 727memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002435FA
VariantClear.OLEAUT32(?), ref: 0024362C
VariantClear.OLEAUT32(?), ref: 00243726
VariantClear.OLEAUT32(?), ref: 00243755
SysFreeString.OLEAUT32(00000000), ref: 0024375C
SysAllocString.OLEAUT32(00000000), ref: 002437A3
VariantClear.OLEAUT32(?), ref: 00243827
VariantClear.OLEAUT32(?), ref: 00243859
VariantClear.OLEAUT32(?), ref: 00243959
VariantClear.OLEAUT32(?), ref: 0024398C
SysFreeString.OLEAUT32(00000000), ref: 00243997
SysAllocString.OLEAUT32(00000000), ref: 002439DD
VariantClear.OLEAUT32(?), ref: 00243A5A
VariantClear.OLEAUT32(?), ref: 00243A8C
VariantClear.OLEAUT32(?), ref: 00243BAC
VariantClear.OLEAUT32(?), ref: 00243BDB
SysFreeString.OLEAUT32(00000000), ref: 00243BE2
SysAllocString.OLEAUT32(00000000), ref: 00243C35
VariantClear.OLEAUT32(?), ref: 00243CBA
VariantClear.OLEAUT32(?), ref: 00243CEC
VariantClear.OLEAUT32(?), ref: 00243DDD
VariantClear.OLEAUT32(?), ref: 00243E0A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: 86af3882dbb9762dd86f5fe1bbaa247caf5b80ddb1daffd82f1ea0d2c4dc0297
Instruction ID: ebad41bd11e573b39f769afa4d424adbdf073e4fb6136dbda8b46b49ecbb099e
Opcode Fuzzy Hash: 86af3882dbb9762dd86f5fe1bbaa247caf5b80ddb1daffd82f1ea0d2c4dc0297
Instruction Fuzzy Hash: DE42B071910259EFCB04DFA8C844BDEFBB4FF48314F148269E805EB291E7789A15CBA5

Function 0022F190 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 374memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0022F5F0: EnterCriticalSection.KERNEL32(004C6250,79276D7D,00000000,?,?,?,?,?,?,0022EE50,003DF68D,000000FF), ref: 0022F62D
Part of subcall function 0022F5F0: LoadCursorW.USER32(00000000,00007F00), ref: 0022F6A8
Part of subcall function 0022F5F0: LoadCursorW.USER32(00000000,00007F00), ref: 0022F74E

SysFreeString.OLEAUT32(00000000), ref: 0022F233
SysAllocString.OLEAUT32(00000000), ref: 0022F264
GetWindowLongW.USER32(?,000000EC), ref: 0022F33B
GetWindowLongW.USER32(?,000000EC), ref: 0022F34B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0022F356
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 0022F364
GetWindowLongW.USER32(?,000000EB), ref: 0022F372
SetWindowTextW.USER32(?,0044337C), ref: 0022F411
GlobalAlloc.KERNEL32(00000042,00000000), ref: 0022F448
GlobalLock.KERNEL32(00000000), ref: 0022F456
GlobalUnlock.KERNEL32(?), ref: 0022F47A
SetWindowLongW.USER32(?,000000EB,00000000), ref: 0022F501
SysFreeString.OLEAUT32(00000000), ref: 0022F516
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 0022F55D
SysFreeString.OLEAUT32(00000000), ref: 0022F585

Strings

~4;, xrefs: 0022F382
L4;, xrefs: 0022F487

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID: L4;$~4;
API String ID: 4180125975-751004607
Opcode ID: dddf7320f5003aa568ae5c56d4bf8d6a42dc718d8da4cc761a36d33cc5669bf3
Instruction ID: c7a9c9c69f35e482a763beb345b26b9ad66213f0ceede4ab76f297ea243415f0
Opcode Fuzzy Hash: dddf7320f5003aa568ae5c56d4bf8d6a42dc718d8da4cc761a36d33cc5669bf3
Instruction Fuzzy Hash: EED1C07190021AEFDB11DFE4DE48BAEBBB8EF45314F244178F911A7290D7789A10CBA5

Function 00238CD0 Relevance: 26.8, APIs: 14, Strings: 1, Instructions: 520windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00238D83
ShowWindow.USER32(00000000,?), ref: 00238DA2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00238DB0
GetWindowRect.USER32(00000000,?), ref: 00238DC7
ShowWindow.USER32(00000000,?), ref: 00238DE8
SetWindowLongW.USER32(?,000000EB,?), ref: 00238DFF

Part of subcall function 00232970: RaiseException.KERNEL32(?,?,00000000,00000000,003B5A3C,C000008C,00000001,?,003B5A6D,00000000,?,002291C7,00000000,79276D7D,00000001,?), ref: 0023297C

ShowWindow.USER32(?,?), ref: 00238F43
GetWindowLongW.USER32(?,000000EB), ref: 00238F79
ShowWindow.USER32(?,?), ref: 00238F96
GetWindowRect.USER32(?,?), ref: 00238FBB
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 002390F8
GetWindowRect.USER32(?,?), ref: 002391B5
GetWindowRect.USER32(?,?), ref: 00239207
SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 00239243

Strings

L/;, xrefs: 002390CE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$LongRectShow$MessageSend$ExceptionRaise
String ID: L/;
API String ID: 1022490566-634813695
Opcode ID: c9beb9bf4b2f27f0962ed8edcd415cfa8d7502ebd5349c13f2a7c1d5ab413ef6
Instruction ID: eb79849bc36a88dceed4b094baa8beeb95ea47184add1cb9dc2c49b7f0febbc9
Opcode Fuzzy Hash: c9beb9bf4b2f27f0962ed8edcd415cfa8d7502ebd5349c13f2a7c1d5ab413ef6
Instruction Fuzzy Hash: C212BBB1614705AFDB25CF68C844BAABBF5FF89304F10491DF886AB260DB70E895CB51

Function 0022EBE0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 293nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0022ECCB
GetWindowLongW.USER32(00000004,000000EC), ref: 0022ECDB
SetWindowLongW.USER32(00000004,000000EC,00000000), ref: 0022ECE6
NtdllDefWindowProc_W.NTDLL(00000004,?,00000001,?), ref: 0022ECF4
GetWindowLongW.USER32(00000004,000000EB), ref: 0022ED02
SetWindowTextW.USER32(00000004,0044337C), ref: 0022EDA1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 0022EDD8
GlobalLock.KERNEL32(00000000), ref: 0022EDE6
GlobalUnlock.KERNEL32(?), ref: 0022EE0A
SetWindowLongW.USER32(00000004,000000EB,00000000), ref: 0022EE6F
NtdllDefWindowProc_W.NTDLL(00000004,?,00000000,00000000), ref: 0022EEBD

Strings

~4;, xrefs: 0022ED12
L4;, xrefs: 0022EE17

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID: L4;$~4;
API String ID: 3555041256-751004607
Opcode ID: d40fb2a69c60c87a40557eb0b52e4b2e61b09f1bf9741c0b425eb76d966447ac
Instruction ID: ece4afebe51261755e75e3aae98d58940a6d563a18b151aefd08bd88c4f5eb9c
Opcode Fuzzy Hash: d40fb2a69c60c87a40557eb0b52e4b2e61b09f1bf9741c0b425eb76d966447ac
Instruction Fuzzy Hash: CAA10871910226EBDF10DFA4DD48FAFBBB9EF45310F260129F811A7291DB349910DBA5

Function 0032C0B0 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 0032C452
FindClose.KERNEL32(00000000), ref: 0032C480
FindClose.KERNEL32(00000000), ref: 0032C509

Strings

No acceptable version found. It must be downloaded., xrefs: 0032C8DD
No acceptable version found. It is already downloaded and it will be installed., xrefs: 0032C8F2
Not selected for install., xrefs: 0032C900
No acceptable version found. It must be installed from package., xrefs: 0032C8D6
An acceptable version was found., xrefs: 0032C8CF
No acceptable version found., xrefs: 0032C8F9
No acceptable version found. It must be downloaded manually from a site., xrefs: 0032C8E4
No acceptable version found. Operating System not supported., xrefs: 0032C8EB

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: 630acd7a6aa1c1a5f05aae15d4dafa1d24a8349e81a2a912654d356b443a99ec
Instruction ID: f4f59a5bb5b1444a1f665048012aa0ddf1936a6e690f3c0167a56269143ebd79
Opcode Fuzzy Hash: 630acd7a6aa1c1a5f05aae15d4dafa1d24a8349e81a2a912654d356b443a99ec
Instruction Fuzzy Hash: C6F1BE30900619CFDB11DF69C8487AEFBB1EF45310F258699D8199B392EB34EA44CF90

Function 0027FA40 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 253windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0027FC1B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 0027FC2B
SendMessageW.USER32(00000000,00000421,?,?), ref: 0027FC40
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 0027FC51
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 0027FC64
GetWindowRect.USER32(?,?), ref: 0027FC92

Part of subcall function 002812B0: CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0028130F
Part of subcall function 002812B0: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,0027FDEC,00000000,79276D7D,?,?), ref: 00281328

Part of subcall function 00230DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00230DE6

SendMessageW.USER32(00000000,00000412,00000000), ref: 0027FCF4
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 0027FD04

Strings

,, xrefs: 0027FBC1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,
API String ID: 1954517558-3772416878
Opcode ID: 439b09c89c51030816b8e0e2017cca8cebaa504a7671682fb9d60346dbcf52b8
Instruction ID: 3698abccdb74a17c5b8b46879c7b403cf0a197c7444e3ae622ef331af3250d75
Opcode Fuzzy Hash: 439b09c89c51030816b8e0e2017cca8cebaa504a7671682fb9d60346dbcf52b8
Instruction Fuzzy Hash: A1A11871A002099FDB14CFA9CD95BAEBBF9FF48300F50462AE516EB291D774A914CF50

Function 00246070 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 512windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00246143

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

__Init_thread_footer.LIBCMT ref: 0024610F

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

SendMessageW.USER32(?,0000104D,00000000,?), ref: 0024643F
SendMessageW.USER32(?,0000102B,?,?), ref: 002464CF
SendMessageW.USER32(?,00001003,00000001,?), ref: 00246555
SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 00246695

Part of subcall function 0022C3F0: __floor_pentium4.LIBCMT ref: 0022C40D

Strings

AiFeatIco, xrefs: 0024636D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake__floor_pentium4
String ID: AiFeatIco
API String ID: 4294328693-859831556
Opcode ID: 5c28561622231441a7331a0ad8f7fcdb724f50005960ff9f8d0abd87c0e5426c
Instruction ID: 32eb4ce3c95cd625d18d9c8b8f3afde6f548d7e6cd2f4251595c05061303b24d
Opcode Fuzzy Hash: 5c28561622231441a7331a0ad8f7fcdb724f50005960ff9f8d0abd87c0e5426c
Instruction Fuzzy Hash: 8A22D271910249DFDF14DFA8C989BEDBBB5FF49300F144169E805AF292DB70AA44CBA1

Function 00302A50 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 313windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00302C80
SendMessageW.USER32(?,00000443,00000000), ref: 00302CEA
MulDiv.KERNEL32(?,00000000), ref: 00302D21

Strings

NumberValidationTipMsg, xrefs: 00302B8B
;3;, xrefs: 00302D46
NumberValidationTipTitle, xrefs: 00302AC4
Segoe UI, xrefs: 00302CF8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSendWindow
String ID: ;3;$NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 701072176-1972730380
Opcode ID: 8dff1bcbac30af60d68c237ec149ec4add73134f2a7e37be86d88cde3f55b358
Instruction ID: 8886af76d4233d738af55356c810ef0f8414c1cfc335e32d6e7aeaeb069a1d88
Opcode Fuzzy Hash: 8dff1bcbac30af60d68c237ec149ec4add73134f2a7e37be86d88cde3f55b358
Instruction Fuzzy Hash: 8CC1CD71A00708AFEB14CF64CC55BEAB7B1FF89300F108299E556AB2D1DB746A49CF90

Function 003D8B95 Relevance: 11.9, APIs: 1, Strings: 5, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 003D8D79

Strings

1#QNAN, xrefs: 003D8CA8
1#SNAN, xrefs: 003D8CA1
1#INF, xrefs: 003D8CCB
`&#, xrefs: 003D8B97
1#IND, xrefs: 003D8C9A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$`&#
API String ID: 4168288129-3538739984
Opcode ID: f0fa4c7e1e21d81a0ba19b59874998aea6034c6c6c9353e8f82601b571147da4
Instruction ID: dc2c2e2b36d53abe31944f5f7b03929b8199600068e20fa8db0385c24f8aa583
Opcode Fuzzy Hash: f0fa4c7e1e21d81a0ba19b59874998aea6034c6c6c9353e8f82601b571147da4
Instruction Fuzzy Hash: DCD20772E182288BDB66CF28ED407EAB7B9EB44305F1545EBD40DE7240DB35AE858F41

Function 0034A620 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

_wcschr.LIBVCRUNTIME ref: 0034A6D9
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 0034A82E
GetDriveTypeW.KERNEL32(?), ref: 0034A84A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 0034AA37
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 0034AAC1

Strings

]%!, xrefs: 0034A7C9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection$DisableHeapLogicalProcessRevertStringsType_wcschr
String ID: ]%!
API String ID: 2638324580-1069524040
Opcode ID: 45381a48149843bc65d3733d5185c6a87e81f82f9d2c8a407e0dda0ac97f952b
Instruction ID: e41aeffbf4297f4d01e75e9990ffe30e3e37dc82edc8af087c213bd032854a18
Opcode Fuzzy Hash: 45381a48149843bc65d3733d5185c6a87e81f82f9d2c8a407e0dda0ac97f952b
Instruction Fuzzy Hash: 40F1B170940569DFDB26CB68C844BADF7F4EF04310F1582E9E459AB291DB70AE84CF91

Function 003D3B80 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

GetACP.KERNEL32(?,?,?,?,?,?,003C93AE,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003D3C41
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,003C93AE,?,?,?,00000055,?,-00000050,?,?), ref: 003D3C6C
_wcschr.LIBVCRUNTIME ref: 003D3D00
_wcschr.LIBVCRUNTIME ref: 003D3D0E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003D3DCF

Strings

utf8, xrefs: 003D3D3E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: fc53d8aa6b60334b34c9fe3fccd076d6a5702392af19a6ab27dad9250ec6a798
Instruction ID: 042b2caff007576d1943484f0fa982de31cfec9358a64c6080a8c6c33c78b2ca
Opcode Fuzzy Hash: fc53d8aa6b60334b34c9fe3fccd076d6a5702392af19a6ab27dad9250ec6a798
Instruction Fuzzy Hash: B771E873A40305AADB26AB39EC42BA773A9EF44700F15442BF505DB781EB74EF408762

Function 0035FB20 Relevance: 9.2, APIs: 6, Instructions: 196fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,79276D7D,?,00000000,00000000), ref: 0035FBF1
FindNextFileW.KERNEL32(?,00000000), ref: 0035FC0C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 6ae6dc66b3c8edb16f3cbb01c1f58722c45b2435d8dac97d13743b06028f8598
Instruction ID: 531d90ece0546a05ec5a21743cc8e895a44dcf0f3c71b4e430fb4bc230cf3b90
Opcode Fuzzy Hash: 6ae6dc66b3c8edb16f3cbb01c1f58722c45b2435d8dac97d13743b06028f8598
Instruction Fuzzy Hash: 1D719B71901249DFDB15DFA8CD49BEEBBB8FF08314F158169E815AB291DB349E08CB50

Function 003CDD6A Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003CDDF7

Strings

`&#, xrefs: 003CDD6C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: _strrchr
String ID: `&#
API String ID: 3213747228-3593461860
Opcode ID: 61616e26537ace8c997b701a72d866b1042ed0193a591e10dac063b8da873d44
Instruction ID: 419ed915f52db10454951955f93381e8806cf72617c0f122bf6033ebecaea1e5
Opcode Fuzzy Hash: 61616e26537ace8c997b701a72d866b1042ed0193a591e10dac063b8da873d44
Instruction Fuzzy Hash: 21B10472A042569FDB268F68C881FEEBBA5EF59350F15817EF805EF241D2749D01CBA0

Function 00323A50 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 321fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 00323BA8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00000000), ref: 00323C45
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00323C6B
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00323CB5

Strings

P3D, xrefs: 00323B4D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer$HeapProcess
String ID: P3D
API String ID: 3625725927-371660571
Opcode ID: 843081275cf9e99a7f76c57895b6c10a19824b2d69d2196fab9a3a8527efb0a8
Instruction ID: 4c5bcf748fd6932a444259b08453a37b02e750581a0c5cfd7dd03207ac947efd
Opcode Fuzzy Hash: 843081275cf9e99a7f76c57895b6c10a19824b2d69d2196fab9a3a8527efb0a8
Instruction Fuzzy Hash: 95A1E571A002299FDB15DF68DC45BAEB7F4FF44324F14862EE815D7381E7B99A048B90

Function 00280BAA Relevance: 9.1, APIs: 6, Instructions: 70nativeCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00280B67
ShowWindow.USER32(?,00000005), ref: 00280B93
GetWindowLongW.USER32(?,000000F0), ref: 00280BC5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00280BE3
NtdllDefWindowProc_W.NTDLL(?,0000000C,?,?), ref: 00280BF6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00280C0D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$Show$NtdllProc_
String ID:
API String ID: 3227303085-0
Opcode ID: 51268bf6f4c0c75ecd1e59301879ea59c32a90a7fb17501943cd91a20645d528
Instruction ID: 9caf14e1735cbb6588eadb3bcaa52ff0ddc10d919e6c44e691ff04e7650f7301
Opcode Fuzzy Hash: 51268bf6f4c0c75ecd1e59301879ea59c32a90a7fb17501943cd91a20645d528
Instruction Fuzzy Hash: E4215C75605204DFDB55AF58DC94B6DBBB1FF89321F20026AE416973E1CB325814DF44

Function 003B5CA1 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,003B5BBD,00000000,?,003B5D55,00000000,?,?,00230B74,?), ref: 003B5CA3
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,00230B74,?), ref: 003B5CCA
HeapAlloc.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5CD1
InitializeSListHead.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5CDE
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00230B74,?), ref: 003B5CF3
HeapFree.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5CFA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: bbe07d6cea1fa08771b652d8715cacd7733a5d5fb51ec0e806b03dd31d3d370a
Instruction ID: 2510d7400c72af1025ed7b0f3995514ce77a752f3ebd0f80630fdaa368d71581
Opcode Fuzzy Hash: bbe07d6cea1fa08771b652d8715cacd7733a5d5fb51ec0e806b03dd31d3d370a
Instruction Fuzzy Hash: B6F0C232601B019BD7529F29AC18B0AB7F8BB88726F06453CFA42C3260DF70C8008B64

Function 003D430F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,003D462D,00000002,00000000,?,?,?,003D462D,?,00000000), ref: 003D43A8
GetLocaleInfoW.KERNEL32(?,20001004,003D462D,00000002,00000000,?,?,?,003D462D,?,00000000), ref: 003D43D1
GetACP.KERNEL32(?,?,003D462D,?,00000000), ref: 003D43E6

Strings

ACP, xrefs: 003D432D
OCP, xrefs: 003D4363

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: f0a32ba0887fc52c9326d12065f279a61b53de7eb4d1b323033abcb606be9b94
Instruction ID: 95f38082a28bb2b88c49d5a1a8e9293236e5de70696ba137ecba06058f2706a5
Opcode Fuzzy Hash: f0a32ba0887fc52c9326d12065f279a61b53de7eb4d1b323033abcb606be9b94
Instruction Fuzzy Hash: 0921B33BA00100A7DB379F5CE941A9BB3AAEB54B54B5B8536F90AD7304E732DD60C790

Function 003D44E4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 003D45F0
IsValidCodePage.KERNEL32(00000000), ref: 003D4639
IsValidLocale.KERNEL32(?,00000001), ref: 003D4648
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 003D4690
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 003D46AF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: b7e9b39a141476d9acba6141548539e74a93ea965a55b9036d8d1ba64d386d7e
Instruction ID: 52863b2c129a23543f7c849b344cc92d1aa4450e9fb7feb8740d74b0f9b969e1
Opcode Fuzzy Hash: b7e9b39a141476d9acba6141548539e74a93ea965a55b9036d8d1ba64d386d7e
Instruction Fuzzy Hash: 88518173900205ABDF12DFA9EC41ABAB7B9FF05700F15446AF515EB290EB70DE148B61

Function 0023C4F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000003,000000FC), ref: 0023C546
SetWindowLongW.USER32(00000003,000000FC,?), ref: 0023C558
DeleteCriticalSection.KERNEL32(?,79276D7D,?,?,?,?,003E19C4,000000FF), ref: 0023C583

Strings

PVD, xrefs: 0023C5AA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: LongWindow$CriticalDeleteSection
String ID: PVD
API String ID: 1978754570-246253817
Opcode ID: 8754b1876523392528203276924fbf4610af82082a105f382063c0e741524876
Instruction ID: e34bed09d9a3b64e21984f8f3a610b9737aab38fe364efe69e5754790e3dc0d1
Opcode Fuzzy Hash: 8754b1876523392528203276924fbf4610af82082a105f382063c0e741524876
Instruction Fuzzy Hash: 4E31D2B0A00646EBCF11DF24CD44B9AFBF8BF05310F204229E814A76D2D775EA20CB90

Function 0034B3D0 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9af53a3b10d2ff13d2b91a9777b691cc440267b92a885064deeed78792015c0b
Instruction ID: 1feac662d5897f4bc995f3da330a503da6649fdf97fdb4e8642b98709fb58a64
Opcode Fuzzy Hash: 9af53a3b10d2ff13d2b91a9777b691cc440267b92a885064deeed78792015c0b
Instruction Fuzzy Hash: 3B817C719012189FDB50DF68CC49B99FBF8EF45314F1482D9E818AB292DB74AE84CF91

Function 002BAB40 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,79276D7D,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 002BAB88
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 002BAB9B
LockResource.KERNEL32(00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 002BABAA
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 002BABBA

Part of subcall function 00321480: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,00000000,79276D7D,00000000,00000000), ref: 003214D4

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Resource$ByteCharFindLoadLockMultiSizeofWide
String ID:
API String ID: 203124936-0
Opcode ID: 598b0cc2d7e76ad7628e72c76bf66392de80f17f11aaf86c5bb181e8fe2646ff
Instruction ID: cd1b6c4c5b4acc997cb854d3a79647d741ddc68b82b03666dcb3657588d74c05
Opcode Fuzzy Hash: 598b0cc2d7e76ad7628e72c76bf66392de80f17f11aaf86c5bb181e8fe2646ff
Instruction Fuzzy Hash: 0E31E371D14705ABD7209F64ED45BAAFBB4EB44B50F00462AE855972C0EB70A914C7A1

Function 00280CE3 Relevance: 6.1, APIs: 4, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00280D3E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00280D5C
NtdllDefWindowProc_W.NTDLL(?,00000086,?,00000000), ref: 00280D6E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00280D80

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: e81f7a1695ea0c8764226f78968e3b6ff7d4444aa36781dc4dfaa93ecd5215b1
Instruction ID: a2509cb419fc1d64c0a5f757b82217b30145a10f437d590f9596b4178684505d
Opcode Fuzzy Hash: e81f7a1695ea0c8764226f78968e3b6ff7d4444aa36781dc4dfaa93ecd5215b1
Instruction Fuzzy Hash: 1931AC70A04215AFDB11CF68DD95B5DBBF1EF86320F2042AAE811AB3E1CB756D14DB50

Function 00280C22 Relevance: 6.0, APIs: 4, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00280C3C
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00280C5A
NtdllDefWindowProc_W.NTDLL(?,00000080,?,?), ref: 00280C70
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00280C87

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: 033dc6497ed82bc85f23160243432fdbb306ac24c6be78974e121be993a5f3a3
Instruction ID: cfd86b8c88ea88273a528596d642e00cc074a4247a1445dcbbdfa5af4e8050cf
Opcode Fuzzy Hash: 033dc6497ed82bc85f23160243432fdbb306ac24c6be78974e121be993a5f3a3
Instruction Fuzzy Hash: 8F112772A04218AFDB659F98DD54B9DBBB1FB48320F21032AF965A33E0CB7219149B44

Function 0039D550 Relevance: 5.5, Strings: 4, Instructions: 529COMMON

Download Yara Rule

Strings

yxxx, xrefs: 0039D91D
yxxx, xrefs: 0039D944
yxxx, xrefs: 0039D904
yxxx, xrefs: 0039DA08

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: yxxx$yxxx$yxxx$yxxx
API String ID: 0-3504637693
Opcode ID: c198a6b8ac3e86705d8dc48583845a6d86b486eca4f2e5d9db160bb58a474a4f
Instruction ID: 8040a563abf81c35d522b1a35011aadeecd87bceec98302b577dcc55fc266fd5
Opcode Fuzzy Hash: c198a6b8ac3e86705d8dc48583845a6d86b486eca4f2e5d9db160bb58a474a4f
Instruction Fuzzy Hash: 3F02A6B2A005059FCF19DF5DC982AAEB7F5EF88300F148629E916EB395D774E901CB90

Function 0034B7D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 0034B88C
FindClose.KERNEL32(00000000), ref: 0034B9D7

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Strings

%d.%d.%d.%d, xrefs: 0034B969

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 2507753907-3491811756
Opcode ID: f28a486a064d2392efac255ec05caec64376b5e62b9703e26204e7f340a769c4
Instruction ID: 9262508d2d9df5c6ddd725d316abe64f9ec0dc82456ee82e62228ebc47792061
Opcode Fuzzy Hash: f28a486a064d2392efac255ec05caec64376b5e62b9703e26204e7f340a769c4
Instruction Fuzzy Hash: 68616D71905219DFDF21DF68C849B9DFBB4EF44314F108299E819AB291DB35AA84CF90

Function 0023E290 Relevance: 5.3, Strings: 4, Instructions: 346COMMON

Download Yara Rule

Strings

AI_NO_BORDER_NORMAL, xrefs: 0023E360
AI_NO_BORDER_HOVER, xrefs: 0023E3DB
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 0023E5B8
AI_CONTROL_VISUAL_STYLE, xrefs: 0023E2F8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: 8a885373e1a72f5cb5caeb3a8d4bdf7e416321d1f1350985638f3917de65396f
Instruction ID: c2d1ee9932efe55730a5e0834ed2aae060d5070d8188c5d3c7c5ff55c533304f
Opcode Fuzzy Hash: 8a885373e1a72f5cb5caeb3a8d4bdf7e416321d1f1350985638f3917de65396f
Instruction Fuzzy Hash: 29D1C3B0D10268DFEF04CFA9C845BADBBB5FF44304F108159E455AB286D778AA19CFA1

Function 00238890 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 002388DE
GetWindowLongW.USER32(00000004,000000FC), ref: 002388F7
SetWindowLongW.USER32(00000004,000000FC,?), ref: 00238909

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 110b65bf6143fd27d211bbb2fe51fb35a2f5eeee0d67872fa042abab5e11330c
Instruction ID: ffe97a27aa89decf4cc18f0885a014b78da9e6b9fde86460afee062bfea9eb1f
Opcode Fuzzy Hash: 110b65bf6143fd27d211bbb2fe51fb35a2f5eeee0d67872fa042abab5e11330c
Instruction Fuzzy Hash: 1C418CB0600B46EFDB14CF65D908B5AFBB4FF05314F104269E4149BB90DBB6E924CB91

Function 003BAD13 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 003BAE0B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 003BAE15
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 003BAE22

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e87079af81a149d9bcd0f4e419dc4ca101f5a70c3c054da00cb770bc30f72c77
Instruction ID: 2d74db654d7d0c274e5092a1b4e1fdc1aac2070fc6342fb0dead7212b8273eca
Opcode Fuzzy Hash: e87079af81a149d9bcd0f4e419dc4ca101f5a70c3c054da00cb770bc30f72c77
Instruction Fuzzy Hash: F431D4749012289BCB22DF64DC897CDBBB8BF08314F5045EAE50CAB250EB709B858F45

Function 00231670 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000FC), ref: 00231689
SetWindowLongW.USER32(?,000000FC,?), ref: 00231697
DestroyWindow.USER32(?,?,?,?,?,?,80004003,?,00000001,?,?,00000001,?,?,0044383C), ref: 002316C3

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: d768684199f9891130d3e9ccfd7476766cd0c27cc0a64883ffe4bb27744e0ab0
Instruction ID: c8b6e1609204bff9e1b687d8c6ee1dd4aa39623f66a7c3b6baf614acdfa5fea6
Opcode Fuzzy Hash: d768684199f9891130d3e9ccfd7476766cd0c27cc0a64883ffe4bb27744e0ab0
Instruction Fuzzy Hash: 74F03070004F119BD7A15F68EE09F827BE4BF44721F144B2CE4AA825F0C730E850DB08

Function 00247630 Relevance: 3.3, APIs: 2, Instructions: 252windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,?), ref: 0024774D
SendMessageW.USER32(?,0000102B,0000009B,?), ref: 00247932

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ada4dfdedc0b455610f3137ba63c8f79440d8c706f4bc4e6a79dbdd6297dee1b
Instruction ID: 4cc7838ca1449fd3ba4d27c704c878e0e345c34953d8f0d5e14d97d6e7446f01
Opcode Fuzzy Hash: ada4dfdedc0b455610f3137ba63c8f79440d8c706f4bc4e6a79dbdd6297dee1b
Instruction Fuzzy Hash: A1A1F371A14606AFDB1CCF24C995BEAFBF5FB04304F14826AE469DB281D734EA11CB90

Function 0033E3A0 Relevance: 3.1, APIs: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000003,79276D7D,00000000,?,00000000), ref: 0033E48E
FindClose.KERNEL32(00000000,?,00000000), ref: 0033E4D9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 4392ab18197ac125cdbc6545466d219417d287f37b8aa6136f5db1be6921e139
Instruction ID: fcc01dc2e856652493007dd0879442ad804206f8e2a371373bc0493846503f60
Opcode Fuzzy Hash: 4392ab18197ac125cdbc6545466d219417d287f37b8aa6136f5db1be6921e139
Instruction Fuzzy Hash: 79519F71900609DFEB21DFA8C888BAEB7F4FF48318F104559E915AB381D774AA05CF91

Function 00322230 Relevance: 3.1, APIs: 2, Instructions: 105windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,79276D7D,00000008,00000000), ref: 0032227B
GetLastError.KERNEL32 ref: 00322285

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: a57ddae29aff76f452a963dbf44b0f6052170dea9b61aa8db1f6b2b36bbd667f
Instruction ID: 0bc0a4bfccb4955b810ab0d10bf0f5397af1017e77022a443e900ccc57b03e5a
Opcode Fuzzy Hash: a57ddae29aff76f452a963dbf44b0f6052170dea9b61aa8db1f6b2b36bbd667f
Instruction Fuzzy Hash: CD318171A00329EBDB10DF99DC05BAEB7F8EB44714F21052EF918E7380DBB699048B95

Function 00280010 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 0028007F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 0028008D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 00f054ab12e201d5f7cfa3665995d477cdc816fbd559664a26a767ab975b416d
Instruction ID: dd0e235347f04e8eff0d785cd30802ea63bd9e0a80121d0d4d83125ad05f5094
Opcode Fuzzy Hash: 00f054ab12e201d5f7cfa3665995d477cdc816fbd559664a26a767ab975b416d
Instruction Fuzzy Hash: D8318F71901606EFCB50DF69C984B9AFBF4FB04320F208369E424A77D1D735A924CB90

Function 0034E610 Relevance: 3.1, APIs: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,79276D7D,?,00000000,00000000,00000000,0042351D,000000FF), ref: 0034E678
FindClose.KERNEL32(00000000,?,79276D7D,?,00000000,00000000,00000000,0042351D,000000FF), ref: 0034E6C2

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 30ac2c05c16a174b0f96f0fc9a3d81a524e8ffc6f06c981e9b77e092dec53b46
Instruction ID: cc3a9197bda2cff07996817cb3986f6833c91c3baf3572bd68bed4e3fca5e5e6
Opcode Fuzzy Hash: 30ac2c05c16a174b0f96f0fc9a3d81a524e8ffc6f06c981e9b77e092dec53b46
Instruction Fuzzy Hash: AD21B2719005589FD710DF68DC49BEEF7B8FF84324F10422AE9259B2D1DB345A08CB94

Function 0024D320 Relevance: 2.5, Strings: 2, Instructions: 37COMMON

Download Yara Rule

Strings

}m'y, xrefs: 0024D33C, 0024D3A2
}m'y, xrefs: 0024D38D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: }m'y$}m'y
API String ID: 0-2486897750
Opcode ID: 3e898025e61e46448137762ebf24600c41ca2701638ba517f3fdb731d90de2dd
Instruction ID: 8e8a1f1167a358bebba4f0ea97be5902a02c6e1938fc39175052905bf5401c85
Opcode Fuzzy Hash: 3e898025e61e46448137762ebf24600c41ca2701638ba517f3fdb731d90de2dd
Instruction Fuzzy Hash: 941100B1904648DFDB44CF59C544789BBF4FB09728F2082AEE8189B381D37A9A06CF84

Function 002552F0 Relevance: 1.9, Strings: 1, Instructions: 617COMMON

Download Yara Rule

Strings

2, xrefs: 00255576

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: c14bcd43fa9ddfa4a3b15dc059687c2e16b6e912b40007daab1de7762bc8dab9
Instruction ID: a52c8a34fbe98a90f88836a23e62ca2f4fec971876349d1c79a99404470a02f0
Opcode Fuzzy Hash: c14bcd43fa9ddfa4a3b15dc059687c2e16b6e912b40007daab1de7762bc8dab9
Instruction Fuzzy Hash: 3832C2B1A047128BCB14CF25D95056BB7E5AF88305F048E3EF9C6CB285EA34E958C797

Function 003BE64C Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

`&#, xrefs: 003BE64E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: `&#
API String ID: 0-3593461860
Opcode ID: 22250e1d73a1b518c95db2a9a6cef9bb979d30c338af83592f4fafbf8e19f867
Instruction ID: 6cd7e7cb80e650ea40897fcca76d5c8f7d3087df7eb063f3244879b39dc27ea5
Opcode Fuzzy Hash: 22250e1d73a1b518c95db2a9a6cef9bb979d30c338af83592f4fafbf8e19f867
Instruction Fuzzy Hash: E0E1DB34A006058FCB26CF6CC481AEEB7F1FF49718B218A19D656DBA91DB30ED46CB51

Function 003D41E6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 003D423A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 4f1e85a0eda4bc3aaf98089ea88eeaeee1efde767035dc951684d19d0a729d8b
Instruction ID: f8c1e3f3a72aaf291df77d8a7dae514b4d8f3b40b999bbda5218c90145f9b100
Opcode Fuzzy Hash: 4f1e85a0eda4bc3aaf98089ea88eeaeee1efde767035dc951684d19d0a729d8b
Instruction Fuzzy Hash: 1B218E73610206ABDB2A9F29EC42ABA77ACEF45310B10447AFD05CA741EB74ED418B60

Function 003D3E6D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

EnumSystemLocalesW.KERNEL32(003D3F93,00000001,00000000,?,-00000050,?,003D45C4,00000000,?,?,?,00000055,?), ref: 003D3EDF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 896f09c2e08a6f715896078c653c4278529dcc61abc6718f506d70a34e3d535b
Instruction ID: d91ae35734fdb881aa605d22a19dd116a6e7f6ecb36c12deab2a1f8d10642ffe
Opcode Fuzzy Hash: 896f09c2e08a6f715896078c653c4278529dcc61abc6718f506d70a34e3d535b
Instruction Fuzzy Hash: 7F11E9376047059FDB189F39D8956BABBA1FF80368B15443EE98787B40E7716E42C740

Function 003D4415 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,003D41AF,00000000,00000000,?), ref: 003D4441

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 0c0dba7b6fdc02e3cc87f3f4c65fad1143ecb4ecd8fa844f52859222c6758fa3
Instruction ID: 30317d53f7a173dd0606a0f1a28b22ff21297d600b5ae79e874c32f49380c395
Opcode Fuzzy Hash: 0c0dba7b6fdc02e3cc87f3f4c65fad1143ecb4ecd8fa844f52859222c6758fa3
Instruction Fuzzy Hash: A8F02D339102117BDF255726ED05BBA7778EB40754F06442AED95A3240EB34FE82C6E0

Function 003D3D7B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 003D3DCF

Strings

utf8, xrefs: 003D3D3E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: c7f904c9a5594f027330b2bb2ab05029d51c5f12049e0046608fb30da9d95920
Instruction ID: 6bcc1b0991936d6858ad4a8b3ee1c8abad277a12a8dc38e95693356faa1df4ea
Opcode Fuzzy Hash: c7f904c9a5594f027330b2bb2ab05029d51c5f12049e0046608fb30da9d95920
Instruction Fuzzy Hash: DFF0C833A11205ABC725AF39EC46EFA73ECDB45324F11017EBA06DB381EA78AD058750

Function 003D3F08 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

EnumSystemLocalesW.KERNEL32(003D41E6,00000001,?,?,-00000050,?,003D4588,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 003D3F52

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 09734f7e868fa8e0b9f01da8f4d2a8db11a99be1fae51d15ef568decd4091381
Instruction ID: 7bac23281b93cee86f0a00d108161177a85f55c0b733b07d19624d0c139ca4ca
Opcode Fuzzy Hash: 09734f7e868fa8e0b9f01da8f4d2a8db11a99be1fae51d15ef568decd4091381
Instruction Fuzzy Hash: CCF0F6376043086FDB255F39AC81A7A7BA9FF80768F09447EF9458B780D6B19E42C710

Function 003CFC09 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CA89A: EnterCriticalSection.KERNEL32(-004C5108,?,003CCE16,00229F56,004B9668,0000000C,003CD0E1,?), ref: 003CA8A9

EnumSystemLocalesW.KERNEL32(003CFBFC,00000001,004B97A8,0000000C,003D002B,00000000), ref: 003CFC41

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2c9086548669de8eb0be77e4296cf443981f613ac75c77f1478989d3a75bf904
Instruction ID: eafd9c7fba16b6820dba7968e7d71135f93edf55eda818678b178c3905724c73
Opcode Fuzzy Hash: 2c9086548669de8eb0be77e4296cf443981f613ac75c77f1478989d3a75bf904
Instruction Fuzzy Hash: 73F04976A10318DFD705EFA8E842F9DBBF0FB44720F10816AF404DB2A1CB7A99418B54

Function 003D3E22 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CD836: GetLastError.KERNEL32(?,00000008,003CF453), ref: 003CD83A
Part of subcall function 003CD836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 003CD8DC

EnumSystemLocalesW.KERNEL32(003D3D7B,00000001,?,?,?,003D45E6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 003D3E59

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: a345da12a47e6c2f6f8a083cb0f9a71d9bc60327694d5971d251a05803271b7b
Instruction ID: 8f4ad8c02dccf577c4b54c1063186ac6aafd5303a3214a85baef00f70948276c
Opcode Fuzzy Hash: a345da12a47e6c2f6f8a083cb0f9a71d9bc60327694d5971d251a05803271b7b
Instruction Fuzzy Hash: E9F0553770020557CB059F39E845A6ABF90EFC1720B0B006EFA0A8B290C6719E43C750

Function 002415F0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,0023FD16,?,?,?,?,?,?,?,?,0023FB78,?,?), ref: 00241640

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 68407077eb6fc3b8876e71d6ad7478da54a5a598d88da46d487b6bf853b38022
Instruction ID: 12890a414a571eea7bb468c0188a1062f39f13162936b33b184e646fcef60bfd
Opcode Fuzzy Hash: 68407077eb6fc3b8876e71d6ad7478da54a5a598d88da46d487b6bf853b38022
Instruction Fuzzy Hash: D6F05834014186DEE3098F14E8A8A69FBAAFB45346F4945F5E158C5461C339CEB4DA10

Function 003D0186 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,003C9F14,?,20001004,00000000,00000002,?,?,003C9516), ref: 003D01BA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 596d79e37cf1a2a96b9d5890af2874496e99f716a7fff3e7362ebe02c154fe67
Instruction ID: 44bf110ddd441b2b15d9857c9b9cb31cf9316163ab471aed02e59dd3298454d9
Opcode Fuzzy Hash: 596d79e37cf1a2a96b9d5890af2874496e99f716a7fff3e7362ebe02c154fe67
Instruction Fuzzy Hash: 2DE04F36500618BBCF172F61EC09FAEBE2AFF44B60F004025FD0565225CB328D21AAD8

Function 00276EE0 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

1, xrefs: 002772E7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 21d85792d2fd01848d659fe8936d92cfe80d22e65b348c8d3280df7b7b3c4a6e
Instruction ID: b71d3c4739b312a23e12af736bc5a037862b97aaf96a8551f3693b637dd00fdb
Opcode Fuzzy Hash: 21d85792d2fd01848d659fe8936d92cfe80d22e65b348c8d3280df7b7b3c4a6e
Instruction Fuzzy Hash: C0D112B0905B8AEFE749CF64C55878AFBF4BF05308F14825DD4685B281D3BAA618CBD1

Function 002C7F20 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

{D, xrefs: 002C7F8C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: {D
API String ID: 0-1498132776
Opcode ID: 31029d75fca1d393882dc38c95a5933147dbdd720a19dcc0de5e5e8820888d3d
Instruction ID: 1324961fb8e51453aaaafaec5820b23fe69415617f6fc2cc1bf758f793251128
Opcode Fuzzy Hash: 31029d75fca1d393882dc38c95a5933147dbdd720a19dcc0de5e5e8820888d3d
Instruction Fuzzy Hash: 8641F5B0905B45EEE704CF69C51878AFBF0BB09318F20825EC4589B781D3BAA619CFD5

Function 00238720 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

`VD, xrefs: 0023878D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: `VD
API String ID: 0-717647209
Opcode ID: 3235631094c44e75faf79087d882e0a2ca3c0a2e42f7e931d2d16ee7241bd6fc
Instruction ID: 73c69736750e42f401c235ee63548a7ef4eb0798363054cd94f0ed95b2d28924
Opcode Fuzzy Hash: 3235631094c44e75faf79087d882e0a2ca3c0a2e42f7e931d2d16ee7241bd6fc
Instruction Fuzzy Hash: 3831D0B0405B84CFE721CF29C658787BFF0BB15718F108A5DD4A64BB91D3BAA508CB91

Function 002FB7A0 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65c3304a3a26542b534971aeb7251065fdd1c0549c76c39a2a7bf003cf404ff
Instruction ID: a03db6b485c53a24d299b9edca1781acb4d595dcbbd146b782320e20a6a4ee2d
Opcode Fuzzy Hash: b65c3304a3a26542b534971aeb7251065fdd1c0549c76c39a2a7bf003cf404ff
Instruction Fuzzy Hash: E102F772E102199FDB19DF6CC881AAEF7B5EB48350F15823EE91597391EB30AD14CB90

Function 003BE2BE Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55280e19b77ebbe551c1a25c0a7998fd69e3b579fffd7f2d4987d2a4cadfd53a
Instruction ID: 39898e8f7f15103bb41cb9508aaf73588ffc1db8d1080f55d612fd05b372acd2
Opcode Fuzzy Hash: 55280e19b77ebbe551c1a25c0a7998fd69e3b579fffd7f2d4987d2a4cadfd53a
Instruction Fuzzy Hash: C4C1EE38A00606CFCB26CF6DC4906EEBBE5AF0530CF15461AD69A9BE92D730ED45CB51

Function 003D3631 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 824019bd926e7eb66fba7a639239fb80584ebb45f1e9dae74bfa45165e47a434
Instruction ID: cdb16a5142fdca7e1231af54111a9503da6ed81e40de2d2fc0e3f3abbd59eee2
Opcode Fuzzy Hash: 824019bd926e7eb66fba7a639239fb80584ebb45f1e9dae74bfa45165e47a434
Instruction Fuzzy Hash: E9B117775007419BCB399B28DC92BB7B3A8EF44308F54452EE943CA780EA75EE85D711

Function 0022F7C0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57d5f2ec01f4b7e44245c7f25d5bb9fa0b0f49db207aede57124e6d0645b9e59
Instruction ID: e46a49ef6b6b5b4c033a439961d130b5edab96751ac4c889a44e89a9c5683106
Opcode Fuzzy Hash: 57d5f2ec01f4b7e44245c7f25d5bb9fa0b0f49db207aede57124e6d0645b9e59
Instruction Fuzzy Hash: 0871F8B0805B48DFE761CF68C95478ABFF0BB05314F108A5EC4A99B391D3B96648DF91

Function 00232250 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0977c94b5fd7894b852e285ea8236cde98acdb08ca10c3a225f5e766a10b8a85
Instruction ID: 79727ecf89da7fca445f279b39955c41f79c90a6d733e0b6849b2789c46e34b5
Opcode Fuzzy Hash: 0977c94b5fd7894b852e285ea8236cde98acdb08ca10c3a225f5e766a10b8a85
Instruction Fuzzy Hash: 09215BB1804748CFD710CF58C944B8ABBF4FB09714F1186AED4559B791D3B9AA44CF94

Function 00231C90 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48cc1f76cdb65e987a5a9f512b026bfdc393fb7ad1533864809439c848677de
Instruction ID: 6ec588918b4180e7e9a6e07f91007c65954ad3e0808906ace7bb32a5f073c8bd
Opcode Fuzzy Hash: d48cc1f76cdb65e987a5a9f512b026bfdc393fb7ad1533864809439c848677de
Instruction Fuzzy Hash: BA216DB1804748DFD710CF58C944B8ABBF4FB09314F1186AED455AB791D3B9AA44CF94

Function 003D783E Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction ID: e524a43005c7b7ae9c8399a517fbfdcc0cf8764132df4e8733f4a8e1fb7ce4f7
Opcode Fuzzy Hash: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction Fuzzy Hash: 9BE0EC7391522CEBCB26DB99D949D8AF3ECEB45B50B1544AAF501D7311D270DE00D7D0

Function 003CC66D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144c5401b694974f51f95ed054cfd58255e5e3608f4b0faf65206ff88c737fe7
Instruction ID: f0ad5095f6b49df33ffb4511ea62cf4c2d96594543650462c3aa29dd55c5c7a8
Opcode Fuzzy Hash: 144c5401b694974f51f95ed054cfd58255e5e3608f4b0faf65206ff88c737fe7
Instruction Fuzzy Hash: C2C08C76811A0057CE2B89248372BA43354B3A1786F9A348CC40A8BB42C51E9C82E780

Function 0030A2B0 Relevance: 56.2, APIs: 7, Strings: 25, Instructions: 238libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

GetModuleHandleW.KERNEL32(kernel32,79276D7D,?,?,00000000), ref: 0030A3B3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0030A3FB
__Init_thread_footer.LIBCMT ref: 0030A40E
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 0030A456
__Init_thread_footer.LIBCMT ref: 0030A469
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0030A4B1
__Init_thread_footer.LIBCMT ref: 0030A4C4

Part of subcall function 002E1FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 002E1FF1
Part of subcall function 002E1FB0: _wcschr.LIBVCRUNTIME ref: 002E20AF

Strings

SetDefaultDllDirectories, xrefs: 0030A4AB
0|E, xrefs: 0030A5F8
|E, xrefs: 0030A55A
0}E, xrefs: 0030A550
x}E, xrefs: 0030A56E
@|E, xrefs: 0030A50A
P*E, xrefs: 0030A582
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 0030A347
0|E, xrefs: 0030A500
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 0030A327, 0030A32F
$~E, xrefs: 0030A61B
H}E, xrefs: 0030A596
l~E, xrefs: 0030A630
kernel32.dll, xrefs: 0030A60D
<~E, xrefs: 0030A5DC
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 0030A322
T|E, xrefs: 0030A4EC
d}E, xrefs: 0030A5A0
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 0030A340, 0030A34F
T~E, xrefs: 0030A5E3
x|E, xrefs: 0030A4F6
kernel32, xrefs: 0030A3AE
SetSearchPathMode, xrefs: 0030A3F5
~E, xrefs: 0030A653
SetDllDirectory, xrefs: 0030A450

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$DirectoryHandleHeapModuleProcessSystem_wcschr
String ID: $~E$0|E$0|E$0}E$<~E$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@|E$H}E$P*E$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$T|E$T~E$d}E$kernel32$kernel32.dll$l~E$x|E$x}E$|E$~E
API String ID: 1258094593-1965052767
Opcode ID: 8affb3ccd86e6b82deb9760525644f81eb270d5b8e077ce83d347379ddfa22b2
Instruction ID: c9372d43b0bb015b796f23400fa49f57fbed1712d76674675533faa72b7347c8
Opcode Fuzzy Hash: 8affb3ccd86e6b82deb9760525644f81eb270d5b8e077ce83d347379ddfa22b2
Instruction Fuzzy Hash: 99A180B09043189BDB11CF55E849B9EBBB4FF01316F11C1AAE8186B382DBB8594CCF59

Function 00362F90 Relevance: 51.2, APIs: 26, Strings: 3, Instructions: 487timefilememoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,00000000,00000000,0000005C,Everyone,10000000,00000000,?,00000000), ref: 00362FA9
LocalFree.KERNEL32(?,00000000,00000000,0000005C,Everyone,10000000,00000000,?,00000000), ref: 00362FB9
GetLastError.KERNEL32(?,00000000), ref: 00362FF7
LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 00363036
GetLastError.KERNEL32(?,00000000), ref: 00363050
LocalFree.KERNEL32(?,?,00000000), ref: 00363061
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,79276D7D,771AF530,?,?), ref: 00363100
GetLastError.KERNEL32 ref: 0036311E
GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 0036314B
GetLastError.KERNEL32 ref: 00363155
FileTimeToSystemTime.KERNEL32(?,?), ref: 003631DA
GetLastError.KERNEL32 ref: 003631E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 0036321C
SystemTimeToFileTime.KERNEL32(00000000,0044341C), ref: 0036323D
CompareFileTime.KERNEL32(0044341C,?), ref: 0036324F
PathFileExistsW.SHLWAPI(?,00000005), ref: 003632EC
CreateFileW.KERNEL32(?,C0000000,00000000,0000000C,00000002,00000080,00000000,00000001,S-1-1-0,10000000,00000001), ref: 00363387
GetLastError.KERNEL32 ref: 00363397
CloseHandle.KERNEL32(00000000), ref: 0036339F

Strings

.part, xrefs: 00363291
S-1-1-0, xrefs: 00363341
S-1-5-18, xrefs: 00363352

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FileTime$ErrorLast$Local$FreeSystem$Create$AllocCloseCompareExistsHandlePath
String ID: .part$S-1-1-0$S-1-5-18
API String ID: 1123205858-2727065896
Opcode ID: a32e0d8e5177eb76fa6897119123f9386a2d11e5636014404f191fec3f86b503
Instruction ID: 07ad97708d18cb2ea3b29212e8d287dc4eb0db1e518e75d53465a190fb0ccaa7
Opcode Fuzzy Hash: a32e0d8e5177eb76fa6897119123f9386a2d11e5636014404f191fec3f86b503
Instruction Fuzzy Hash: 02128A70A007049FDB22CFA9C948BAABBF4FF44304F15852DE546976A0DBB0EA48CB55

Function 0032DB40 Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 167COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(?,79276D7D,?,?,?,0041C4C5,000000FF,?,003604CF,?,?,?,00000000), ref: 0032DCD8
GetActiveWindow.USER32 ref: 0032DC3A

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Strings

bL, xrefs: 0032E2E7
AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 0032EB95
MSINEWINSTANCE=1 , xrefs: 0032E8E6
|3D, xrefs: 0032E992
TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 0032E910
%s , xrefs: 0032EA4C, 0032ED81
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 0032E7B2
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 0032E818
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 0032ECDF
|3D, xrefs: 0032EA9F
T`L, xrefs: 0032DBC6
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 0032ED93
.msi, xrefs: 0032E747, 0032EC40
.mst, xrefs: 0032E797, 0032E7FE, 0032ECBE
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 0032E8FF
majorupgrade-content.mst, xrefs: 0032E756, 0032EC4F
TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 0032E8B7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$ActiveDebugHeapOutputProcessStringWindow
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $.msi$.mst$T`L$majorupgrade-content.mst$|3D$|3D$bL
API String ID: 758407959-3149313761
Opcode ID: 9ccbcc5bc0957cb10a52a48057c152e750fc5e1d82850f79804db2e6b300e579
Instruction ID: 390c3773938e36dfd9d343bc8cc1ae10ad07280e9e68aa0a1f7067d3150ee120
Opcode Fuzzy Hash: 9ccbcc5bc0957cb10a52a48057c152e750fc5e1d82850f79804db2e6b300e579
Instruction Fuzzy Hash: A751DC71A002159FDB15DF6CD858BAEBBB4EF45320F1582ADE819AB2A1DB309D00CF91

Function 00354B10 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 335COMMON

Download Yara Rule

Strings

Unable to find file , xrefs: 00354B43
Unable to retrieve exit code from process., xrefs: 00354E92
Unable to get a temp file for script output, temp path: , xrefs: 00354C1F
Unable to retrieve PowerShell output from file: , xrefs: 00354E6F
powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 00354C6F
ps1, xrefs: 00354BB6, 00354BC8, 00354BD2
Unable to create process: , xrefs: 00354D15
txt, xrefs: 00354BE3

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: f6b1966c3e7933d083c7bd360b33fb40ce56f2562fd9e7f839552f2d0243fbcb
Instruction ID: f4a9e0c4bec22e4e960548f4ee20150799c3235e3ee7e4d77acc2f534b71591d
Opcode Fuzzy Hash: f6b1966c3e7933d083c7bd360b33fb40ce56f2562fd9e7f839552f2d0243fbcb
Instruction Fuzzy Hash: D5C1A070900649EFDB15DFA8CD45FAEBBB4BF04315F108259F814AB2A1DB74AA98CF50

Function 002316D0 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 359stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00231770
GetParent.USER32(?), ref: 002317B1
lstrcmpW.KERNEL32(?,#32770), ref: 002317D1
GetWindowLongW.USER32(?,000000F0), ref: 00231871

Strings

L4;, xrefs: 002319B9
#32770, xrefs: 002317C8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$LongParentlstrcmp
String ID: #32770$L4;
API String ID: 4031819654-517946083
Opcode ID: 37629c6dded8872dda9d06f2106997ad09fd3c8f48968ac4a3420310f7d79100
Instruction ID: d931437955410812053ef5a14cdf3f9ec50c048509b4578a23d02f1afac19032
Opcode Fuzzy Hash: 37629c6dded8872dda9d06f2106997ad09fd3c8f48968ac4a3420310f7d79100
Instruction Fuzzy Hash: E8E1CFB0A1021AEFDB14CFA4C958FADBBB5FF49711F148129F801AB290D774AD64CB64

Function 0025D6E0 Relevance: 26.5, APIs: 7, Strings: 8, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,79276D7D,?,?,00000000,?,?,?,?,?,?,}m'y,003E8E95,000000FF), ref: 0025D74D
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 0025D753
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,}m'y,003E8E95,000000FF,?,002745FA,0044B84C,}m'y,79276D7D), ref: 0025D783
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 0025D789

Strings

|3D, xrefs: 0025D81D
RoGetActivationFactory, xrefs: 0025D743
}m'y, xrefs: 0025D71B, 0025D72C, 0025D76A
combase.dll, xrefs: 0025D748, 0025D77E
CoIncrementMTAUsage, xrefs: 0025D779
}m'y, xrefs: 0025D6F0
DllGetActivationFactory, xrefs: 0025D902
.dll, xrefs: 0025D8A6

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$|3D$}m'y$}m'y
API String ID: 2574300362-2766852522
Opcode ID: 56d33267b049981eae163263c8db6f349bc4cc68e2d4b76496fdbefddf3155aa
Instruction ID: 8045bcfd46ed7a4b5a2b35d0b8b729a351c226d39da7420a0f1ef17c7f7022f2
Opcode Fuzzy Hash: 56d33267b049981eae163263c8db6f349bc4cc68e2d4b76496fdbefddf3155aa
Instruction Fuzzy Hash: 0DA1BE7192020AEFDF25DFA8C885BEEBBB4EF08311F144129E811A7290DB749A59CB54

Function 00329E90 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000001F6), ref: 00329EDE
GetDlgItem.USER32(?,000001F8), ref: 00329EEB
GetDlgItem.USER32(?,000001F7), ref: 00329F38
SetWindowTextW.USER32(00000000,00000000), ref: 00329F47
ShowWindow.USER32(?,00000005), ref: 00329F67

Part of subcall function 003293B0: GetWindowLongW.USER32(?,000000F0), ref: 003293EF
Part of subcall function 003293B0: GetWindowLongW.USER32(?,000000F0), ref: 00329400
Part of subcall function 003293B0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00329412
Part of subcall function 003293B0: GetWindowLongW.USER32(?,000000EC), ref: 00329425
Part of subcall function 003293B0: SetWindowLongW.USER32(?,000000EC,00000000), ref: 00329434
Part of subcall function 003293B0: SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 00329448
Part of subcall function 003293B0: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00329457

GetDlgItem.USER32(?,000001F7), ref: 00329F86
SetWindowTextW.USER32(00000000,00000000), ref: 00329F95
ShowWindow.USER32(?,00000000), ref: 00329FB5
ShowWindow.USER32(?,00000000), ref: 00329FBC
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 0032A005
GetDlgItem.USER32(00000000,00000000), ref: 0032A039
IsWindow.USER32(00000000), ref: 0032A043
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,00000616), ref: 0032A090

Strings

Details >>, xrefs: 00329F6D
Details <<, xrefs: 00329F1F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$ItemLong$Show$MessageSendText
String ID: Details <<$Details >>
API String ID: 1573988680-3763984547
Opcode ID: 37911a3aa3ae6c51f9dd27334d325cdc6b7090bfc39d1ef3c8149f7b57bc28dc
Instruction ID: f7e32be79d1039b2f11c5e4fa1258352d8b191f96dbe4aabfc76ced410b38849
Opcode Fuzzy Hash: 37911a3aa3ae6c51f9dd27334d325cdc6b7090bfc39d1ef3c8149f7b57bc28dc
Instruction Fuzzy Hash: 5E71DE71900608ABDB25DFA9ED56FAEFBF4EF98704F20822DF501A7291D731A841CB54

Function 00252860 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 404memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

CreateThread.KERNEL32(00000000,00000000,002529B0,00447458,00000000,?), ref: 0025292A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00252943
CloseHandle.KERNEL32(00000000), ref: 00252959
CoInitializeEx.COMBASE(00000000,00000000), ref: 00252A09
GetProcessHeap.KERNEL32(?,00000000), ref: 00252B0B
HeapFree.KERNEL32(00000000,?,00000000), ref: 00252B11
GetProcessHeap.KERNEL32(?,00000000), ref: 00252B90
HeapFree.KERNEL32(00000000,?,00000000), ref: 00252B96
CoUninitialize.COMBASE ref: 00252CEA
Concurrency::cancel_current_task.LIBCPMT ref: 00252D6B

Strings

|3D, xrefs: 00252AE5
$tD, xrefs: 00252BCE
XtD, xrefs: 00252902
|3D, xrefs: 00252B69

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseConcurrency::cancel_current_taskCreateHandleInitializeObjectSingleThreadUninitializeWait
String ID: $tD$XtD$|3D$|3D
API String ID: 1779960141-1879253227
Opcode ID: cc9c06f44031cd4b7269fd95cdea85e1e33208612f6389bf36ef067af332bb80
Instruction ID: db24f425f6fcc12a3dd0c8e906f5789072c66f39c41de0e7ef5ee255149d9302
Opcode Fuzzy Hash: cc9c06f44031cd4b7269fd95cdea85e1e33208612f6389bf36ef067af332bb80
Instruction Fuzzy Hash: 00F18C70D01209DFDB10CFA8C945BEEBBB8BF45305F248199E805AB2D1DB749A48CBA4

Function 00362A10 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 390libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,79276D7D,00000000,00000000), ref: 00362AA1
GetLastError.KERNEL32 ref: 00362ACF

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00362AE5
FreeLibrary.KERNEL32(00000000), ref: 00362AFE
GetLastError.KERNEL32 ref: 00362B0B
GetLastError.KERNEL32 ref: 00362CF9
GetLastError.KERNEL32 ref: 00362D5E

Strings

Advapi32.dll, xrefs: 00362A9C
ConvertStringSidToSidW, xrefs: 00362ADF
,(E, xrefs: 00362B30

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLast$Library$AddressAllocFreeHeapLoadProc
String ID: ,(E$Advapi32.dll$ConvertStringSidToSidW
API String ID: 1560807876-3461186169
Opcode ID: 9455110f4f83ea188dfd3d774de1c306c2cdd39f5f2bf6b4d7a7537f1a7c2518
Instruction ID: 37786a8eec694f2df3e5ef1cb23fbcb04d79ff0f385db9d6dc20cccddf401279
Opcode Fuzzy Hash: 9455110f4f83ea188dfd3d774de1c306c2cdd39f5f2bf6b4d7a7537f1a7c2518
Instruction Fuzzy Hash: 86F18CB1C01609AFDF01CF94C945BEEBBB4FF05314F228229E915BB280D775AA55CBA1

Function 0022F5F0 Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004C6250,79276D7D,00000000,?,?,?,?,?,?,0022EE50,003DF68D,000000FF), ref: 0022F62D
LoadCursorW.USER32(00000000,00007F00), ref: 0022F6A8
LoadCursorW.USER32(00000000,00007F00), ref: 0022F74E
LeaveCriticalSection.KERNEL32(004C6250), ref: 0022F7A3

Strings

AtlAxWinLic140, xrefs: 0022F70F, 0022F765
lbL, xrefs: 0022F6E9
WM_ATLGETCONTROL, xrefs: 0022F644
PbL, xrefs: 0022F616
f.;, xrefs: 0022F6D1, 0022F76F
rw, xrefs: 0022F7A3
WM_ATLGETHOST, xrefs: 0022F639
p.;, xrefs: 0022F650
lbL, xrefs: 0022F783
AtlAxWin140, xrefs: 0022F65F, 0022F6C3

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: rw$AtlAxWin140$AtlAxWinLic140$PbL$WM_ATLGETCONTROL$WM_ATLGETHOST$f.;$lbL$lbL$p.;
API String ID: 3727441302-1631689028
Opcode ID: 1c3c7005473ee4fa0fbfd63e23db2bfd4a7a66ba2270025fd3bcc23dffb7bc46
Instruction ID: 5203137a517b4a0091589e62d8bff8823e6d2afc286dce72acf2b82ed79cf29a
Opcode Fuzzy Hash: 1c3c7005473ee4fa0fbfd63e23db2bfd4a7a66ba2270025fd3bcc23dffb7bc46
Instruction Fuzzy Hash: 4B5137B5C11219AFDB91DFD4D954BDEBFF8EB08714F11412AE804B7290DBB856048FA8

Function 00328440 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 223threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004C611C,79276D7D,?,?,00000000,?,?,?,?,?,00000000,0041B407,000000FF), ref: 003284B3
EnterCriticalSection.KERNEL32(?,79276D7D,?,?,00000000,?,?,?,?,?,00000000,0041B407,000000FF), ref: 003284C5
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,0041B407,000000FF), ref: 003284D2
GetCurrentThread.KERNEL32 ref: 003284DD
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,00000000,?,0044337C,00000000,?,?,?,?,?,00000000,0041B407,000000FF), ref: 003286BE
LeaveCriticalSection.KERNEL32(?,0044337C,00000000,?,?,?,?,?,00000000,0041B407,000000FF), ref: 0032879A

Strings

MODULE_BASE_ADDRESS, xrefs: 0032870B
<--------------------MORE--FRAMES-------------------->, xrefs: 00328662
{t;, xrefs: 00328502
rw, xrefs: 0032879A
[0x%.8Ix] , xrefs: 003286C5
*** Stack Trace (x86) ***, xrefs: 003285B7
4aL, xrefs: 003284BB

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ rw$4aL$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix] ${t;
API String ID: 3051236879-650202802
Opcode ID: 86c780ebc6c40f935e0d26c1c1eece3b709e53b3f39fde9cb5d6b55cd5109dee
Instruction ID: bd5896703ad2e2bbae578277e6521a9309578db9068bbf4586b8c38d7ebc9fd6
Opcode Fuzzy Hash: 86c780ebc6c40f935e0d26c1c1eece3b709e53b3f39fde9cb5d6b55cd5109dee
Instruction Fuzzy Hash: 8CA1AA71601388AFDF22DFA4DC55BEE7BB8BF05308F104128E909AB291DB795B08CB51

Function 00253400 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 222libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,79276D7D,?,?,?,?,?,?,?,79276D7D,003E64A5,000000FF,?,0025371A,004474D0), ref: 00253467
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 0025346D
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,79276D7D,003E64A5,000000FF,?,0025371A,004474D0,79276D7D,79276D7D), ref: 0025349E
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002534A4

Strings

RoGetActivationFactory, xrefs: 0025345D
|3D, xrefs: 0025353A
combase.dll, xrefs: 00253462, 00253499
CoIncrementMTAUsage, xrefs: 00253494
DllGetActivationFactory, xrefs: 002535E9
.dll, xrefs: 002535A9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$|3D
API String ID: 2574300362-1671736940
Opcode ID: 82b0cc639a6f4ddc541d4e599a6d05c68561e247ddbcd849bcf36e258dd7c893
Instruction ID: 380c866825aa3174e2126d5e6784f61a5403e73ae8c7f6ee4cb5e77d2bb66c61
Opcode Fuzzy Hash: 82b0cc639a6f4ddc541d4e599a6d05c68561e247ddbcd849bcf36e258dd7c893
Instruction Fuzzy Hash: B281D070920209EFDB15DFA8C881BEEFBB4EF08350F14516DE811B7290DB749A58CB68

Function 003574C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004C6054,79276D7D,?,00000010), ref: 003574FC

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

EnterCriticalSection.KERNEL32(00000010,79276D7D,?,00000010), ref: 00357509
WriteFile.KERNEL32(00000000,?,?,000000FF,00000000), ref: 0035753B
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00357544
WriteFile.KERNEL32(00000000,00343C07,6054B9EC,0042500D,00000000,0044334C,00000001,?,?,000000FF,00000000), ref: 003575C6
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 003575CF
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00357605
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 0035760E
WriteFile.KERNEL32(00000000,?,?,?,00000000,004458A8,00000002,?,?,?,00000000,?,?,000000FF,00000000), ref: 0035766F
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00357678
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 003576A8

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Strings

rw, xrefs: 003576A8
L3D, xrefs: 00357589

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocEnterFindHeapInitializeLeaveResource
String ID: rw$L3D
API String ID: 3436934177-3644781462
Opcode ID: 4c3099b3b58678df480000a03ebb726336ba0e4d3f53d80d7d784f15f36124e8
Instruction ID: e288f2b68b785e106ccea3cef6bb401b8061c148944c289c37eeab561851dedf
Opcode Fuzzy Hash: 4c3099b3b58678df480000a03ebb726336ba0e4d3f53d80d7d784f15f36124e8
Instruction Fuzzy Hash: 84618A70904644AFEB01DFA8DD49FAABBB4FF05315F148169F805A72A1DB319D18CFA4

Function 0027A430 Relevance: 21.2, APIs: 14, Instructions: 243COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 0027A49E
SetWindowLongW.USER32(?,000000F0,00C80000), ref: 0027A4CC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0027A4E1
GetWindowLongW.USER32(?,000000EC), ref: 0027A518
SetWindowLongW.USER32(?,000000EC,00000000), ref: 0027A545
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0027A559
GetWindowLongW.USER32(?,000000F0), ref: 0027A57B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0027A592
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 0027A5A6
GetWindowRect.USER32(?,?), ref: 0027A5F6
GetWindowLongW.USER32(?,000000EC), ref: 0027A61C
GetWindowRect.USER32(?,?), ref: 0027A66A
SetWindowPos.USER32(?,00000000,?,?,?,?,00000604,?,?), ref: 0027A6A0
SetWindowTextW.USER32(?,?), ref: 0027A6E1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$Rect$Text
String ID:
API String ID: 445026432-0
Opcode ID: 46c278c9f80ace7370691e21c021807e864bcb1f1e57cdbfa4aed8a3dc3707ac
Instruction ID: cc2c8fcdef5576a82a8d1e202b5fe232d23ff1927f7a9c597b323c6b1a495758
Opcode Fuzzy Hash: 46c278c9f80ace7370691e21c021807e864bcb1f1e57cdbfa4aed8a3dc3707ac
Instruction Fuzzy Hash: D8916F71A00609AFDB04DFA8DD55FEDBBB5FF88310F204229F426A72A4DB35A910CB54

Function 002859B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 002859F7
GetParent.USER32 ref: 00285A0D
GetWindowRect.USER32(?,?), ref: 00285A18
GetParent.USER32(?), ref: 00285A20
GetWindow.USER32(?,00000004), ref: 00285A52
GetWindowRect.USER32(?,?), ref: 00285A60
GetWindowLongW.USER32(00000000,000000F0), ref: 00285A6D
MonitorFromWindow.USER32(?,00000002), ref: 00285A85
GetMonitorInfoW.USER32(00000000,?), ref: 00285A9F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015,?,00000004), ref: 00285B4D

Strings

$/;, xrefs: 00285A44

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$LongMonitorParentRect$FromInfo
String ID: $/;
API String ID: 1820395375-1662183015
Opcode ID: bb7edfe987488228abde35fb78f334b15ce794aed523a4981ed3c7efceec8f37
Instruction ID: f57ba487e60e5eb2961838c5de0c5515b90c04ec3429eec7acfddd5096394076
Opcode Fuzzy Hash: bb7edfe987488228abde35fb78f334b15ce794aed523a4981ed3c7efceec8f37
Instruction Fuzzy Hash: 0A518D36D10529AFDB14DFA8CD84E9EBBB9FB48310F254229E815E3294DB30AD14CB94

Function 003293B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 003293EF
GetWindowLongW.USER32(?,000000F0), ref: 00329400
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00329412
GetWindowLongW.USER32(?,000000EC), ref: 00329425
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00329434
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 00329448
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00329457
GetWindowRect.USER32(?,?), ref: 00329496
GetDlgItem.USER32(?,?), ref: 003294D2
IsWindow.USER32(00000000), ref: 003294DD
GetWindowRect.USER32(?,?), ref: 003294F8

Strings

$/;, xrefs: 00329509

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$MessageRectSend$Item
String ID: $/;
API String ID: 661679956-1662183015
Opcode ID: ca65779db92926677d0f638a21915151ac7800d5c25d569d969bbb0332072729
Instruction ID: f2a5ca57f51c10bb37ae8ae378131ef8e2867d909c9047fd0b5ecbc919fa3260
Opcode Fuzzy Hash: ca65779db92926677d0f638a21915151ac7800d5c25d569d969bbb0332072729
Instruction Fuzzy Hash: 1F41B1315047019FD761DF69ED80F2BB7E8BF98314F218A2EF59992291DB30E8848B65

Function 00329D00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00322350: LoadLibraryW.KERNEL32(ComCtl32.dll,79276D7D,00000000,?,00000000), ref: 0032238E
Part of subcall function 00322350: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 003223B1
Part of subcall function 00322350: FreeLibrary.KERNEL32(00000000), ref: 0032242F

GetDlgItem.USER32(?,000001F4), ref: 00329D41
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 00329D52
MulDiv.KERNEL32(00000009,00000000), ref: 00329D6A
GetDlgItem.USER32(?,000001F6), ref: 00329DA4
IsWindow.USER32(00000000), ref: 00329DAD
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 00329DC4
GetDlgItem.USER32(?,000001F8), ref: 00329DCE
GetWindowRect.USER32(?,?), ref: 00329DDF
GetWindowRect.USER32(?,?), ref: 00329DF2
GetWindowRect.USER32(00000000,?), ref: 00329E02

Strings

;3;, xrefs: 00329D93
Courier New, xrefs: 00329D70

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$ItemRect$LibraryMessageSend$AddressFreeLoadProc
String ID: ;3;$Courier New
API String ID: 1717253393-460306225
Opcode ID: 57a38d0aa33b77dc1e828b9e8011620669c690f11618bd22a284477c40bc2423
Instruction ID: dedfbb264c6c0b51eac1bb3b8d4228b89210e4f834d88d3c01cb5d6e1000f6ac
Opcode Fuzzy Hash: 57a38d0aa33b77dc1e828b9e8011620669c690f11618bd22a284477c40bc2423
Instruction Fuzzy Hash: AC41D7717C4308BBEB159F21DD53FAE77A8AF88B04F010629FB057E1C1DAB0A8408B58

Function 0034EC20 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 413registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\JavaSoft\Java Development Kit\,00000000,?,?,79276D7D,?,?), ref: 0034EC83
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?), ref: 0034EE19
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?,?,?,?), ref: 0034EE75
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?), ref: 0034EEC5
RegCloseKey.ADVAPI32(?), ref: 0034EF05

Strings

Software\JavaSoft\Java Runtime Environment\, xrefs: 0034EC66
Software\JavaSoft\Java Development Kit\, xrefs: 0034EC75, 0034EC7D
JavaHome, xrefs: 0034EE6F, 0034EEBA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: OpenQueryValue$Close
String ID: JavaHome$Software\JavaSoft\Java Development Kit\$Software\JavaSoft\Java Runtime Environment\
API String ID: 2529929805-1079072530
Opcode ID: b334883d06ffad9b5f8801c17dda70f733feed8e364dbdd6b1c4072a2eea3115
Instruction ID: f5633dbb269f192d77bac12338fd61e64661ec6c871d232e57a41b6852564df8
Opcode Fuzzy Hash: b334883d06ffad9b5f8801c17dda70f733feed8e364dbdd6b1c4072a2eea3115
Instruction Fuzzy Hash: FA027E709012699FDB21DF68CD88B9EB7B4AF44304F1542E9E808AB291DB75AE84CF50

Function 003581B0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,79276D7D,?,?,004C6054), ref: 003581F8
LoadLibraryW.KERNEL32(Shell32.dll,?,004C6054), ref: 00358207
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0035821B
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 0035829A
SHGetMalloc.SHELL32(?), ref: 003582D7
PathFileExistsW.SHLWAPI(?,ADVINST_LOGS,0000000C,?,00000000), ref: 0035832A
CreateDirectoryW.KERNEL32(?,?,Everyone,10000000,00000000,?,00000000), ref: 003583B5

Strings

Everyone, xrefs: 00358371
SHGetSpecialFolderPathW, xrefs: 00358215
Shell32.dll, xrefs: 00358202
ADVINST_LOGS, xrefs: 0035831D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Path$AddressCreateDirectoryExistsFileFolderFromLibraryListLoadLocationMallocProcSpecial
String ID: ADVINST_LOGS$Everyone$SHGetSpecialFolderPathW$Shell32.dll
API String ID: 1254244429-1733115844
Opcode ID: b5e1f0360c2f7e5d4165f7ff9eeec70a10f943d59f9e494c9ebb356187d400ba
Instruction ID: ca4b3703ed4c224d40c8c3f4222a60b73feccb05a294cf3092b66ecc2b768aa2
Opcode Fuzzy Hash: b5e1f0360c2f7e5d4165f7ff9eeec70a10f943d59f9e494c9ebb356187d400ba
Instruction Fuzzy Hash: ABB1BCB0D00609DFDB11DFA9C849BAEFBF4AF44315F258129E815BB2A1EB745A08CB51

Function 0024C7D0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,79276D7D), ref: 0024C85C

Part of subcall function 00230DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00230DE6

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 0024C95F
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 0024C973
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 0024C988
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 0024C99D
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 0024C9B4
GetWindowRect.USER32(?,?), ref: 0024C9E6
SendMessageW.USER32(00000000,00000412,00000000), ref: 0024CA48
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 0024CA58

Strings

,, xrefs: 0024C90E
tooltips_class32, xrefs: 0024C855

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,$tooltips_class32
API String ID: 1954517558-3856767331
Opcode ID: 82012f1729e2e082ba28ddce0d677b65ace897f4893cb4d0c2995d1a6889f005
Instruction ID: fd97ac86b0512a8f3889b6aa572b39ea821bddc6a509827b1ea22fb34a35f82e
Opcode Fuzzy Hash: 82012f1729e2e082ba28ddce0d677b65ace897f4893cb4d0c2995d1a6889f005
Instruction Fuzzy Hash: F6914D71A00208AFEB14CFA5DD95FEEBBF8FB48300F10452AF616EA290D774A914CB54

Function 00329A60 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00329A94
EndDialog.USER32(?,00000000), ref: 00329B52

Part of subcall function 00329550: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00329582
Part of subcall function 00329550: GetWindowLongW.USER32(?,000000F0), ref: 00329588
Part of subcall function 00329550: GetDlgItem.USER32(?,?), ref: 003295FA
Part of subcall function 00329550: GetWindowRect.USER32(00000000,?), ref: 00329612

Strings

L/;, xrefs: 00329B71
U2;, xrefs: 00329AE0

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Long$DialogItemMessageRectSend
String ID: L/;$U2;
API String ID: 188208873-663787360
Opcode ID: 7d427ae206ad6ce85a2a9e0674acefd5b169bf1ae44837285b5cf4b0795d1bcd
Instruction ID: 27b3b71d8a9b6bdda90b25a7dc78bc5c1b21b2734210c78012016a7b532d2958
Opcode Fuzzy Hash: 7d427ae206ad6ce85a2a9e0674acefd5b169bf1ae44837285b5cf4b0795d1bcd
Instruction Fuzzy Hash: 4971A431A002259BDB15CF68ED58BAEBBF8FF49720F11062AE416E7AD0D774D940CB64

Function 00325310 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003254AE
__Init_thread_footer.LIBCMT ref: 00325607
GetStdHandle.KERNEL32(000000F5,?,79276D7D,?,?), ref: 0032568F
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 00325696
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 003256AA
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 003256B1

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,00000000,00000000,004458A8,00000002,?,?), ref: 00325740
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00325747
IsWindow.USER32(00000000), ref: 00325960

Strings

Error, xrefs: 003258FF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalInit_thread_footerSectionText$BufferEnterInfoLeaveScreenWindow
String ID: Error
API String ID: 2811146417-2619118453
Opcode ID: 8167034fa5977afbff6e72f0dd1db25436d73e61040b9a5179c428578556bb55
Instruction ID: e48c73eec226d699116f5ee41fb483ebdbf018134d6fbd6f62123ff4bc6a9f2e
Opcode Fuzzy Hash: 8167034fa5977afbff6e72f0dd1db25436d73e61040b9a5179c428578556bb55
Instruction Fuzzy Hash: 44227BB0D10718DFDB10CFA8D845BDEBBB0BF05314F248299E459AB291DB75AA88CF51

Function 0034F880 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 296libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 002E1FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 002E1FF1
Part of subcall function 002E1FB0: _wcschr.LIBVCRUNTIME ref: 002E20AF

GetLastError.KERNEL32(79276D7D,?,?,?,000000FF,?,00334196,?,?), ref: 0034F8ED
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 0034FA7A
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 0034FADE
FreeLibrary.KERNEL32(00000000,?,?,000000FF,?,00334196,?,?), ref: 0034FBD2

Strings

x86, xrefs: 0034F938
,(E, xrefs: 0034FBC6
Kernel32.dll, xrefs: 0034F8C1
neutral, xrefs: 0034F982
GetPackagePath, xrefs: 0034FA74, 0034FAD8
x64, xrefs: 0034F966

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem_wcschr
String ID: ,(E$GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 3734293021-3595981372
Opcode ID: 60594b00df7c075a9d5d14f8566392eede875d1806a1ba9b21dae0a6d5b158c0
Instruction ID: 8a37376e099bc2617e3fcbeb7a856689b875e40df3110a9cc41844d4936f77ae
Opcode Fuzzy Hash: 60594b00df7c075a9d5d14f8566392eede875d1806a1ba9b21dae0a6d5b158c0
Instruction Fuzzy Hash: 0AC16B70A00205DFDB05DFA8C895BADBBF4EF09314F18826DE815AB391DB74A944CF90

Function 00232500 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004C6250,79276D7D,00000000,004C626C), ref: 00232573
LeaveCriticalSection.KERNEL32(004C6250), ref: 002325D7
LoadCursorW.USER32(00220000,?), ref: 00232630
LeaveCriticalSection.KERNEL32(004C6250), ref: 002326C8

Strings

f.;, xrefs: 00232699
ATL:%p, xrefs: 00232650
lbL, xrefs: 002326AD
rw, xrefs: 002325D7, 002326C8
PbL, xrefs: 0023255C
p.;, xrefs: 002325AA, 002325C1, 00232686

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: rw$ATL:%p$PbL$f.;$lbL$p.;
API String ID: 2080323225-4077051526
Opcode ID: 6e1fdf3e182fafbedc97458e0ad91e8319a7ad64faf0f93232ed8506f6253280
Instruction ID: f0b773734f73d3199a77de17a56ab8db10aea9d7d72fb95d6481049f3a36b323
Opcode Fuzzy Hash: 6e1fdf3e182fafbedc97458e0ad91e8319a7ad64faf0f93232ed8506f6253280
Instruction Fuzzy Hash: 5E51BC70904B45CBD720CF69CA45BAAF7F4FF58710F10861EE896A3690E770B988CB54

Function 00372A80 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 282COMMON

Download Yara Rule

Strings

Progress, xrefs: 00372ABD
Visible, xrefs: 00372B6D
Text, xrefs: 00372AFA
Enabled, xrefs: 00372BE0
TimeRemaining, xrefs: 00372C4F
PropertyValue, xrefs: 00372CC9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Enabled$Progress$PropertyValue$Text$TimeRemaining$Visible
API String ID: 0-2691827946
Opcode ID: ca9d4e217e551cde24f8187886f6e0df848877446a617da5e356da6d24828e36
Instruction ID: df3cf24a12a4e32e8a874378cfeed94054787a3f49644bac90275048b259bf5c
Opcode Fuzzy Hash: ca9d4e217e551cde24f8187886f6e0df848877446a617da5e356da6d24828e36
Instruction Fuzzy Hash: B0B1C1B1A00344DFDB25CF48D944B9EB7B1FB55320F10826EE8299B7C1D7799A00CB95

Function 0034D7C0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 121COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 0034D7F6

Strings

HKCR, xrefs: 0034D87D
HKEY_CLASSES_ROOT, xrefs: 0034D891
HKEY_CURRENT_CONFIG, xrefs: 0034D8B9
HKCC, xrefs: 0034D8A5
HKEY_CURRENT_USER, xrefs: 0034D869
HKLM, xrefs: 0034D825
HKCU, xrefs: 0034D855
HKEY_LOCAL_MACHINE, xrefs: 0034D83D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKLM
API String ID: 2691759472-1956487666
Opcode ID: f026969a32bb65c2f71d33e5f5cd5563ece8c2447d14cf0a1712c950fd46729f
Instruction ID: d0e6319fc78d7717031868ed513ded40cf8b13226b35d67cc57393ca8b981293
Opcode Fuzzy Hash: f026969a32bb65c2f71d33e5f5cd5563ece8c2447d14cf0a1712c950fd46729f
Instruction Fuzzy Hash: 5A41F972E40615ABDF125B54CC02B6AB7E8EB00312F15463EBC14EA6D1EF75BC14CB62

Function 00243190 Relevance: 15.3, APIs: 10, Instructions: 339memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002431EA
VariantClear.OLEAUT32(?), ref: 0024321C
VariantClear.OLEAUT32(?), ref: 00243316
VariantClear.OLEAUT32(?), ref: 00243345
SysFreeString.OLEAUT32(00000000), ref: 0024334C
SysAllocString.OLEAUT32(00000000), ref: 00243393
VariantClear.OLEAUT32(?), ref: 0024341A
VariantClear.OLEAUT32(?), ref: 0024344C
VariantClear.OLEAUT32(?), ref: 00243527
VariantClear.OLEAUT32(?), ref: 00243556

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: b808d433ee4c9ccead1113e629e6c2becb40a008ab910226702e0f31a3259f87
Instruction ID: 0fc874a5e20a1f71d708e3dd2c8d8ac8b60c4f76917a231f04f44a777f28fdbb
Opcode Fuzzy Hash: b808d433ee4c9ccead1113e629e6c2becb40a008ab910226702e0f31a3259f87
Instruction Fuzzy Hash: 6DC17F71910259DFCB14DFA8C844BDEBBB8FF48310F148269E804E7391E778AA55CBA5

Function 00352BC0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

ResetEvent.KERNEL32(?,?,?), ref: 00352C4A
SetEvent.KERNEL32(?,?,?,?,?,00000001,08000000,?,?,?), ref: 00352C83
ResetEvent.KERNEL32(?,?,?,?,?,00000001,08000000,?,?,?), ref: 00352E19
SetEvent.KERNEL32(?,?,?,?,?,?,00000001,08000000,?,?,?), ref: 00352E4B
ResetEvent.KERNEL32(?,?,?,?,?,?,00000001,08000000), ref: 00352F26
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000001,08000000), ref: 00352F43
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000001,08000000), ref: 00352F4A

Strings

FTP Server, xrefs: 00352CF6, 00352D08, 00352D12

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Event$Reset$Init_thread_footerObjectSingleWait$HeapProcess
String ID: FTP Server
API String ID: 3860647947-688436434
Opcode ID: fcef39462e0e733b063482e206e288131bf513c52e0ab8b980412715bde0057f
Instruction ID: 6e09b4db5296f812491170172426042113828fcec05cde58c196be00b008949c
Opcode Fuzzy Hash: fcef39462e0e733b063482e206e288131bf513c52e0ab8b980412715bde0057f
Instruction Fuzzy Hash: 9BD19230A00245DFDB01DF68C988B9EBBB5FF4A315F158269EC15AB3A2D774D948CB90

Function 0024B720 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 218windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000C5,?,00000000), ref: 0024B771
SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 0024B7D5
lstrcpynW.KERNEL32(?,?,00000020), ref: 0024B847
MulDiv.KERNEL32(?,00000048,00000000), ref: 0024B884
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 0024B8B6

Strings

?, xrefs: 0024B88A
U2;, xrefs: 0024B8F2
t, xrefs: 0024B892

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$lstrcpyn
String ID: ?$U2;$t
API String ID: 3928028829-2064999302
Opcode ID: 08c6b7588eb424e8e967f432a93f0b685b45e8f621fad6bfa0b0c20271db6616
Instruction ID: 7b762a1c24261621860c9914761a9d0a180c734a6e186ee2ce1cc95571db1969
Opcode Fuzzy Hash: 08c6b7588eb424e8e967f432a93f0b685b45e8f621fad6bfa0b0c20271db6616
Instruction Fuzzy Hash: 1F918E71614340AFE321DF64CC46F9ABBE8AF88304F004A2AF699D71A1EB74E554CB56

Function 00354900 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,00334998), ref: 003549F3
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 00354A37
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00354A54
CloseHandle.KERNEL32(00000000), ref: 00354A6E
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 00354AAD

Strings

ps1, xrefs: 00354969, 0035497B, 00354985, 00354996
Unable to get temp file , xrefs: 003549D4
Unable to save script file , xrefs: 00354A7D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: 61ca5e343661cff7ab154950c40b9d399eeac682ffe0c54190e18e083b88a43c
Instruction ID: 298e39ff91d5ec3b650102cfb180fa7247bd8e765039635fd395fa0562c2b642
Opcode Fuzzy Hash: 61ca5e343661cff7ab154950c40b9d399eeac682ffe0c54190e18e083b88a43c
Instruction Fuzzy Hash: 3C51D870900245AFDB15CFA8CD49FAEB7B8AF04719F148259F910A72D2D7749E48CBA8

Function 00329550 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00329582
GetWindowLongW.USER32(?,000000F0), ref: 00329588
GetDlgItem.USER32(?,?), ref: 003295FA
GetWindowRect.USER32(00000000,?), ref: 00329612
SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 0032969F
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 003296D3

Strings

$/;, xrefs: 00329623
L/;, xrefs: 00329566

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$MessageSend$ItemLongRect
String ID: $/;$L/;
API String ID: 3432912040-1934778625
Opcode ID: 79a2aff81ef5be1a5ae9297bc27034dd5ecf2debd1a6d59ec7dce3370239022f
Instruction ID: d9f9a40648f4f054ea7a41fe317a0e8ea912884985575c6a04639df5121e3d01
Opcode Fuzzy Hash: 79a2aff81ef5be1a5ae9297bc27034dd5ecf2debd1a6d59ec7dce3370239022f
Instruction Fuzzy Hash: 49517B302043019FD725CF28E985F2ABBE1FF84718F254A2EF5999B2A5D731E844CB59

Function 00343C80 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00343CBE
GetUserDefaultLangID.KERNEL32 ref: 00343CCB
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00343CDD
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00343CF1
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00343D06

Strings

GetUserDefaultUILanguage, xrefs: 00343D00
GetSystemDefaultUILanguage, xrefs: 00343CEB
kernel32.dll, xrefs: 00343CD4

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 54cf5ef665944283862287e4bcad5a423a3f9b9f901be3bcdde2712cfca4ad75
Instruction ID: c2c437b5bb5668457285aa841616ba7642a2eb8e11828447e23cba5813890d0e
Opcode Fuzzy Hash: 54cf5ef665944283862287e4bcad5a423a3f9b9f901be3bcdde2712cfca4ad75
Instruction Fuzzy Hash: 1841B071A083119FC745EF28D8506BAB7E1AFD9355F52192EF885CB280EB34AA44CB52

Function 00236C00 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 148fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00236CEF

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?), ref: 00236D43
CloseHandle.KERNEL32(00000000), ref: 00236D92

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 00236DF6
CloseHandle.KERNEL32(00000000,?), ref: 00236E1C

Strings

|bL, xrefs: 00236DCD
aix, xrefs: 00236D01
html, xrefs: 00236CFC

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html$|bL
API String ID: 2030708724-1889745995
Opcode ID: 8e5d84a7cf109e04c827cd3ad9bf11102eba547474e2c6fb275c84a42f316eb7
Instruction ID: 45c830ce90aad3dfd4212ce0c398b944e9e12ef457426c13371179a79e27ea2a
Opcode Fuzzy Hash: 8e5d84a7cf109e04c827cd3ad9bf11102eba547474e2c6fb275c84a42f316eb7
Instruction Fuzzy Hash: 3451BFB1900248EFDB50DF94DC49B9EBBB4FF04708F1181ADE405AB291D7B96A08CB95

Function 003B9810 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003B9847
___except_validate_context_record.LIBVCRUNTIME ref: 003B984F
_ValidateLocalCookies.LIBCMT ref: 003B98D8
__IsNonwritableInCurrentImage.LIBCMT ref: 003B9903
_ValidateLocalCookies.LIBCMT ref: 003B9958
___vcrt_initialize_locks.LIBVCRUNTIME ref: 003B996E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 003B9983

Strings

csm, xrefs: 003B98ED

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: a10c816bdc3d556e376b0c735efa7adfbe9a5f7a7b662bf5c7d1398477502a15
Instruction ID: fc386b22391985b3ca00af39dbc3f79be551e08286971623476ff9ac7987986c
Opcode Fuzzy Hash: a10c816bdc3d556e376b0c735efa7adfbe9a5f7a7b662bf5c7d1398477502a15
Instruction Fuzzy Hash: B541C434A00608ABCF12DF68C881BDE7BB5EF46318F148096EB159FB52D735D915CBA1

Function 0028C0F0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 87COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5B70,Windows.Foundation.PropertyValue,00000020,79276D7D,?,?), ref: 0028C1C6

Strings

h[L, xrefs: 0028C1A7
}m'y, xrefs: 0028C1CB, 0028C1D6
l[L}m'y, xrefs: 0028C1CE
Windows.Foundation.PropertyValue, xrefs: 0028C11A
}m'y, xrefs: 0028C100
l[L, xrefs: 0028C195
l[L}m'y, xrefs: 0028C10F, 0028C204

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.Foundation.PropertyValue$h[L$l[L$l[L}m'y$l[L}m'y$}m'y$}m'y
API String ID: 4129690577-2663321768
Opcode ID: 2dfeb36242e1b73c76c54ce89e275051bdf24eeefdeae0aadb393c35ee46b836
Instruction ID: 9e4df650bce434e39d3a7dd55c4430345426c653ee349fcbb4fc3d07282f680b
Opcode Fuzzy Hash: 2dfeb36242e1b73c76c54ce89e275051bdf24eeefdeae0aadb393c35ee46b836
Instruction Fuzzy Hash: E5318B75D1121AEBDB04DFA4C945BAEBBB4FB04714F20402AE815772C1DBB46A48CBE5

Function 00350260 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 454synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00352140: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,0035029A,?,79276D7D,?,?,?,000000FF,?), ref: 00352154
Part of subcall function 00352140: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0035029A,?,79276D7D,?,?,?,000000FF,?,0034FC64), ref: 00352171
Part of subcall function 00352140: GetLastError.KERNEL32(?,79276D7D,?,?,?,000000FF,?,0034FC64,?,?,00000000,00000000,79276D7D,?,?), ref: 003521D0

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

ResetEvent.KERNEL32(?,00000000,004238DD), ref: 0035036A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00350389
WaitForSingleObject.KERNEL32(79276D7D,000000FF), ref: 00350390

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

Strings

GET, xrefs: 003502EA
h[D, xrefs: 0035052F
filename, xrefs: 003506E1
attachment, xrefs: 0035059D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Event$CreateInit_thread_footerObjectSingleWait$ErrorFindHeapLastProcessResetResource
String ID: GET$attachment$filename$h[D
API String ID: 818129584-4284821814
Opcode ID: eaa7ca9adeb7082a3facfda5c0d61e6d413aefa5f1c071cd0e90bb43e1db5026
Instruction ID: 95e556583ce6aa59c742844940aa171c34ae05f86ba6a35d2098b45ff744921e
Opcode Fuzzy Hash: eaa7ca9adeb7082a3facfda5c0d61e6d413aefa5f1c071cd0e90bb43e1db5026
Instruction Fuzzy Hash: 3C020E70901249DFDB05DFA8C844BAEBBF4FF15315F148169E815AB3A1EB75AA08CF90

Function 00234E50 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004C6008,79276D7D,?,?,?,?,?,?,?,?,?,?,?,?,00000000,003E04E5), ref: 00234EBA
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,003E04E5), ref: 00234F3A
EnterCriticalSection.KERNEL32(004C6024,?,?,?,?,?,?,?,?,?,?,?,00000000,003E04E5,000000FF), ref: 002350F3
LeaveCriticalSection.KERNEL32(004C6024,?,?,?,?,?,?,?,?,?,?,00000000,003E04E5,000000FF), ref: 00235114

Strings

rw, xrefs: 0023510D
8YL, xrefs: 00234EDC

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: rw$8YL
API String ID: 1807155316-453982213
Opcode ID: 6fd0f64c97af7ce3bbb269714ef7c5dfca0ca4ef583906317f0c5afe44527a35
Instruction ID: 34e451f0eeb24aafc8f539101a09ff88c9d5876b23ad0dbd40fc4151efdec211
Opcode Fuzzy Hash: 6fd0f64c97af7ce3bbb269714ef7c5dfca0ca4ef583906317f0c5afe44527a35
Instruction Fuzzy Hash: 2AB1A2B0A14659DFDB10CFA4C884BAEBBB4FF49314F144598E849EB391C775AE44CB60

Function 00275EF0 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 239COMMON

Download Yara Rule

Strings

}m'y, xrefs: 002760FE, 00276162
}m'y, xrefs: 00275F8F, 002760BC
Windows.UI.Xaml.VisualStateManager, xrefs: 00275F9A
}m'y, xrefs: 00275F80
}m'y, xrefs: 00275F1B, 00275F25
}m'y, xrefs: 00276145

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.VisualStateManager$}m'y$}m'y$}m'y$}m'y$}m'y
API String ID: 0-55632402
Opcode ID: 70650e6746c703dd21b67d05bc37a6afacbed5d6e10a4d8938dc4ea3e8cbd713
Instruction ID: af9422918f8196baa729bc5319bde9cb4795b51fc9200a1f1a804c081bc8e806
Opcode Fuzzy Hash: 70650e6746c703dd21b67d05bc37a6afacbed5d6e10a4d8938dc4ea3e8cbd713
Instruction Fuzzy Hash: CE91BE75900649EFCB01CFA8C844BAEFBB8FF49314F10416AF914A7391D776AA55CBA0

Function 00230E10 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(004437FC,00000000,00000001,00443E84,?), ref: 00230EE0

Strings

>D, xrefs: 00230EFE
{, xrefs: 00230F40
:, xrefs: 00230ECA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateInstance
String ID: :${$>D
API String ID: 542301482-1075776714
Opcode ID: 34abb3fb3b5556e4d33c8e0bd1dfc493f83f2eba345cc8bb581d066f479a0f4a
Instruction ID: 59d19965aba56a3467316fb00cf82e0e919f52fc0ba3bb4b9f77edd311b43195
Opcode Fuzzy Hash: 34abb3fb3b5556e4d33c8e0bd1dfc493f83f2eba345cc8bb581d066f479a0f4a
Instruction Fuzzy Hash: D261B4B4A202569BDF289F94C8A4BBE77F4EB09711F244429F801EB680D775DD90C774

Function 0024DE90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 0024DEF7
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0024DF1F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0024DF37
SendMessageW.USER32(?,0000130A,00000000,?), ref: 0024DF68
GetParent.USER32(?), ref: 0024E044
SendMessageW.USER32(00000000,00000136,?,?), ref: 0024E055

Strings

U2;, xrefs: 0024DFB9, 0024E064

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$Parent
String ID: U2;
API String ID: 1020955656-3377301532
Opcode ID: 43c12bff889cda9c9ec3ada8cd7a2a2844f75244fac70233f9ff9515ee8c212e
Instruction ID: 0f203c559a207b8367b3a4fb549a26d5283cdf7b959a68b5439df8bfba0450fe
Opcode Fuzzy Hash: 43c12bff889cda9c9ec3ada8cd7a2a2844f75244fac70233f9ff9515ee8c212e
Instruction Fuzzy Hash: 5C614A72910218AFDB219FE5DD19FEEBBB9FF88710F110129F619AB2A0C7706950CB54

Function 00357150 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004213BF,000000FF), ref: 003572D3
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004213BF,000000FF), ref: 00357361

Strings

T`L, xrefs: 00357178
<< Advanced Installer (x86) Log >>, xrefs: 0035723F
T`L, xrefs: 00357250
|`L, xrefs: 003571D6
YL, xrefs: 003571FB, 00357217, 00357238

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>$ YL$T`L$T`L$|`L
API String ID: 3699736680-335362602
Opcode ID: 8b01ffab9a2e4e212c151324c21e643f1ee06bd8e881b46ac6ed322a8612bf0e
Instruction ID: c7bf9516b22cfd475fe566a5387508783e6f67a245b7e3d2d8f5fa47751482b2
Opcode Fuzzy Hash: 8b01ffab9a2e4e212c151324c21e643f1ee06bd8e881b46ac6ed322a8612bf0e
Instruction Fuzzy Hash: 3E610170504684DFD701CFA9D948B4AFBF0EF45314F15C2AEE805AB3A1DB759A08CB94

Function 00302240 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 003022AB
GetParent.USER32(00000000), ref: 003022FE
GetWindowRect.USER32(00000000), ref: 00302301
GetParent.USER32(00000000), ref: 00302310

Part of subcall function 002BFCF0: GetWindowRect.USER32(?,?), ref: 002BFD8B
Part of subcall function 002BFCF0: GetWindowRect.USER32(?,?), ref: 002BFDA3

SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00302400
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00302413

Strings

$/;, xrefs: 003023A6

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageRectSendWindow$Parent
String ID: $/;
API String ID: 425339167-1662183015
Opcode ID: ba7c9dc94e5823689dfa2c23158c732e4d6658d178a0b11f05b9a689b7d00e15
Instruction ID: 1beae058d6963875c0c6da6ef71781cbc0a504ac55565fb4039f5696eced016b
Opcode Fuzzy Hash: ba7c9dc94e5823689dfa2c23158c732e4d6658d178a0b11f05b9a689b7d00e15
Instruction Fuzzy Hash: F9514971D00708ABDB11DFA8CE55BDEBBF8EF99710F20436AE815A7291E7706980CB54

Function 00290D60 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 128COMMON

Download Yara Rule

Strings

p\L, xrefs: 00290E97
}m'y, xrefs: 00290E6D
t\L}m'y, xrefs: 00290DFF, 00290EF4
t\L, xrefs: 00290E85
t\L}m'y, xrefs: 00290E73
Windows.UI.Xaml.Controls.ComboBox, xrefs: 00290E0A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ComboBox$p\L$t\L$t\L}m'y$t\L}m'y$}m'y
API String ID: 0-3092671109
Opcode ID: 4c6d41f00d779346d3cd9ab09ecd3235f2329d6158e054353a8cbfbf1e4ff655
Instruction ID: 367d008cc94204e54c56ddd08b67f542944fe710f383fb6e72731a337ea0c887
Opcode Fuzzy Hash: 4c6d41f00d779346d3cd9ab09ecd3235f2329d6158e054353a8cbfbf1e4ff655
Instruction Fuzzy Hash: AF519FB1D10219DFDB00DFA4C981BEFBBB8EB04714F10452AE811A7280DBB96A44CBE5

Function 00302470 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00302500

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

GetProcAddress.KERNEL32(SetWindowTheme), ref: 0030253D
__Init_thread_footer.LIBCMT ref: 00302554
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 0030257F

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

Part of subcall function 002E1FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 002E1FF1
Part of subcall function 002E1FB0: _wcschr.LIBVCRUNTIME ref: 002E20AF

Strings

UxTheme.dll, xrefs: 003024D1
SetWindowTheme, xrefs: 00302532
explorer, xrefs: 00302567

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake_wcschr
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3852524043-3123591815
Opcode ID: 3503ceb834113b6b66c48632681944597c6e181bb24b3fd53c20cff7c6f03aa2
Instruction ID: f23a2aeda34ffc1b28e18422f7715404d09de90b00eaf0ac78084661fca6ae62
Opcode Fuzzy Hash: 3503ceb834113b6b66c48632681944597c6e181bb24b3fd53c20cff7c6f03aa2
Instruction Fuzzy Hash: 3E21A2B1A41304BBC721DF14ED16F89B7A4EB01760F228226F920A73D5D779E901CB5D

Function 002397E0 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0023980A
GetWindow.USER32(?,00000005), ref: 00239817
GetWindow.USER32(00000000,00000002), ref: 00239952

Part of subcall function 00239660: GetWindowRect.USER32(?,?), ref: 0023968C
Part of subcall function 00239660: GetWindowRect.USER32(?,?), ref: 0023969C

GetWindowRect.USER32(?,?), ref: 002398AB
GetWindowRect.USER32(00000000,?), ref: 002398BB
GetWindowRect.USER32(00000000,?), ref: 002398D5

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: b8bdfcfacf7453406c32a6627257f44c3374f5c1036d36e7b0908efc6762ecfa
Instruction ID: 13be823a8d6a3b2299f3988cb499aa45bf596192a7d9665462881235f7af2950
Opcode Fuzzy Hash: b8bdfcfacf7453406c32a6627257f44c3374f5c1036d36e7b0908efc6762ecfa
Instruction Fuzzy Hash: 79419B705187029FC721DF29C980AABF7E9BF97704F504A1DF08597521EBB0E998CB52

Function 003B5BAB Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,003B5D55,00000000,?,?,00230B74,?), ref: 003B5BCF
HeapAlloc.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5BD6

Part of subcall function 003B5CA1: IsProcessorFeaturePresent.KERNEL32(0000000C,003B5BBD,00000000,?,003B5D55,00000000,?,?,00230B74,?), ref: 003B5CA3

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,003B5D55,00000000,?,?,00230B74,?), ref: 003B5BE6
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,00230B74,?), ref: 003B5C0D
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,00230B74,?), ref: 003B5C21
InterlockedPopEntrySList.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5C34
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00230B74,?), ref: 003B5C47

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: b9240840da4e08b3c5b15373e5e907f0d0251e19e221bc43b253227490f92978
Instruction ID: 3240f03941aa158dd1d8ab87dbd9a9579a497baeabbfa7c263dbaae6d60829a2
Opcode Fuzzy Hash: b9240840da4e08b3c5b15373e5e907f0d0251e19e221bc43b253227490f92978
Instruction Fuzzy Hash: 8911B671602F11ABE7221764AD58FABAA6EEB48799F170435FB01D7550DF61CC008668

Function 0028E970 Relevance: 10.9, APIs: 4, Strings: 3, Instructions: 419memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 0028EB86
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 0028EB8C

Part of subcall function 00290530: GetProcessHeap.KERNEL32(?,?,79276D7D,00000000,?,00000000), ref: 002905EA
Part of subcall function 00290530: HeapFree.KERNEL32(00000000,?,?,79276D7D,00000000,?,00000000), ref: 002905F0

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0028ED97
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0028ED9D

Strings

|3D, xrefs: 0028ECEC
}m'y, xrefs: 0028E9AD
|3D, xrefs: 0028EAE1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3D$|3D$}m'y
API String ID: 3859560861-1273754131
Opcode ID: 61597cf026963bdc85258e604853fa2f8abc4dbdf0b4b8ab8ebbbb0538d428dc
Instruction ID: e895dd36051b0d8aa66ab45a0ead20f169bdea52c3a3439c679ce0b02d65fbdf
Opcode Fuzzy Hash: 61597cf026963bdc85258e604853fa2f8abc4dbdf0b4b8ab8ebbbb0538d428dc
Instruction Fuzzy Hash: A6F17B74901249DFDF14EFA8C945BEEBBB4FF05314F204299E811AB2D1DB74AA18CB91

Function 00366EA0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 371COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

_wcschr.LIBVCRUNTIME ref: 00366F6B
_wcschr.LIBVCRUNTIME ref: 0036701D
_wcschr.LIBVCRUNTIME ref: 0036703C

Part of subcall function 00229390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002369F0,-00000010,?,0023AA9D,*.*), ref: 002293B7

_wcschr.LIBVCRUNTIME ref: 003670E2
GetTickCount.KERNEL32 ref: 0036728A

Strings

0123456789AaBbCcDdEeFf, xrefs: 00366F01, 00366F13, 00366F1D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$CountFindHeapProcessResourceTick
String ID: 0123456789AaBbCcDdEeFf
API String ID: 2181188311-3822820098
Opcode ID: 586e5c4a50091935e918abe6aac383a81e305c1ddd910873a3883c533a79c8ce
Instruction ID: 2ad652c5294389bc5cc738f429f76bfbd282a337fb5f16df73905f3526465a18
Opcode Fuzzy Hash: 586e5c4a50091935e918abe6aac383a81e305c1ddd910873a3883c533a79c8ce
Instruction Fuzzy Hash: 38D12070A046058FDB22CF68C848BAEB7F5EF45328F14C65DE4559B295DB34E845CBA0

Function 0024F780 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 369windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0024F7CD

Strings

AiTabPage, xrefs: 0024F9E3, 0024FAEA
,nD, xrefs: 0024FA85
' AND `Control_`=', xrefs: 0024F947
ControlEvent, xrefs: 0024FA59
`Dialog_`=', xrefs: 0024F900

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend
String ID: ' AND `Control_`='$,nD$AiTabPage$ControlEvent$`Dialog_`='
API String ID: 3850602802-2534852014
Opcode ID: 533c728be4d2741302180af1190073268e8009467a0cbb67654e621d474b7cb0
Instruction ID: 6e4098805a05e6cad891f8989ebb9f35ff9f18fe92dc3f2f47b0412e4d935665
Opcode Fuzzy Hash: 533c728be4d2741302180af1190073268e8009467a0cbb67654e621d474b7cb0
Instruction Fuzzy Hash: C5F17871910258DFDF04DF68C999BEEBBB1FF48304F150169ED149B292DB74AA18CB90

Function 003209E0 Relevance: 10.8, APIs: 7, Instructions: 300fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,79276D7D,?,00000000), ref: 00320A69
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000), ref: 00320AEC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00320B39
GetFileSize.KERNEL32(00000000,00000000), ref: 00320B42
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00320BA5
CloseHandle.KERNEL32(00000000), ref: 00320CF7
ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00320D7F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointerSize
String ID:
API String ID: 4181610692-0
Opcode ID: dfcac6a0748cee809285c72007308c4bd409b8c94e9657520f2582b7dc12c7fe
Instruction ID: d6f6fc89adf86bd6ffcfb267e62813ad0d13c5fac839fceb5e6cbb31356aa0a8
Opcode Fuzzy Hash: dfcac6a0748cee809285c72007308c4bd409b8c94e9657520f2582b7dc12c7fe
Instruction Fuzzy Hash: 3BC18E70D01318DFDB29CFA4D845BEEBBB5BF44704F21825DE415AB282DB70AA49CB94

Function 00254CC3 Relevance: 10.7, APIs: 7, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00254D55
SysFreeString.OLEAUT32(00000000), ref: 00254DCA
GetProcessHeap.KERNEL32(?,?), ref: 00254E30
HeapFree.KERNEL32(00000000,?,?), ref: 00254E36
GetProcessHeap.KERNEL32(?,00000000,?,00000000), ref: 00254E66
HeapFree.KERNEL32(00000000,?,00000000,?,00000000), ref: 00254E6C
SysFreeString.OLEAUT32(00000000), ref: 00254E84

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: c14391def34d30c0b168fa8ca342d20c76c682d681f1f84f8917b2a93bac1295
Instruction ID: f12afcefacd95c4bcd7db63aee8541b4fb752dad3bf4266cd02a7223a7d2a1b6
Opcode Fuzzy Hash: c14391def34d30c0b168fa8ca342d20c76c682d681f1f84f8917b2a93bac1295
Instruction Fuzzy Hash: AB61D070D1025A8FDF11EFA8C845BEFFBB4BF01309F140158E811AB282C7789A59CBA5

Function 0022B550 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0022B5D2

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

__Init_thread_footer.LIBCMT ref: 0022B658
CreateDirectoryW.KERNEL32(004C61F4,00000000,?,00000000,79276D7D,?,00000000), ref: 0022B695

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

Strings

,bL, xrefs: 0022B664
,bL, xrefs: 0022B5AE
,bL, xrefs: 0022B6E9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionCreateDirectoryVariableWake
String ID: ,bL$,bL$,bL
API String ID: 2312781895-2433560460
Opcode ID: 71489c59958253e83c2ae1de85aecf9c2fbba3cf6c0d91c8d8c6882fa0a2ca14
Instruction ID: 73fbafa7771679adcb4acf528721240d7b86eac49f29a88f6a83646ffc9310e1
Opcode Fuzzy Hash: 71489c59958253e83c2ae1de85aecf9c2fbba3cf6c0d91c8d8c6882fa0a2ca14
Instruction Fuzzy Hash: 4251C671900219EBCB11EFE4E845F9EBBB4EF04314F11866EE411AB2D1DB78AA18CF55

Function 002BFCF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002BFD8B
GetWindowRect.USER32(?,?), ref: 002BFDA3
GetWindowRect.USER32(?,?), ref: 002BFE10
GetWindowLongW.USER32(?,000000EC), ref: 002BFE34

Strings

$/;, xrefs: 002BFE25
L/;, xrefs: 002BFD73

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Rect$Long
String ID: $/;$L/;
API String ID: 3486571012-1934778625
Opcode ID: ae15f5c1b3071947dfe2572156e2b5eb1eb4ee0507d74e5635e02a8f9680bdde
Instruction ID: 72f2a1d3de86e0dcd8af3295112446a4fc53d5035d829ee8ed0c5e32bfb02389
Opcode Fuzzy Hash: ae15f5c1b3071947dfe2572156e2b5eb1eb4ee0507d74e5635e02a8f9680bdde
Instruction Fuzzy Hash: C54189326083069FC744CF25CA80EABB7E8FF99744F158A2EF94597211EB30E9548B56

Function 0034E2C0 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,79276D7D,?,?), ref: 0034E307
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,79276D7D,0042344D), ref: 0034E37F
GetLastError.KERNEL32 ref: 0034E390
WaitForSingleObject.KERNEL32(0042344D,000000FF), ref: 0034E3AC
GetExitCodeProcess.KERNEL32(0042344D,00000000), ref: 0034E3BD
CloseHandle.KERNEL32(0042344D), ref: 0034E3C7
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 0034E3E2

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: eb20cfbcfe612684200ba8118b1cd0d6a03b2a057f2dccb6c803e51424c4334c
Instruction ID: 5f76a8ea6a44a70efb5fd4da2affee972c6b570e0bc7dca0ae757b3d1289d28a
Opcode Fuzzy Hash: eb20cfbcfe612684200ba8118b1cd0d6a03b2a057f2dccb6c803e51424c4334c
Instruction Fuzzy Hash: B0417B31E04389ABDB12CFA5CD047AEBBF8BF49314F145669F825A7190DB749A40CF60

Function 00360E90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000010,?,00000000,00346881,00000000,79276D7D,?,00000010,00000000), ref: 00360EAB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00360EC1
FreeLibrary.KERNEL32(00000000), ref: 00360EFA
FreeLibrary.KERNEL32(00000000,?,00000010,?,00000000,00346881,00000000,79276D7D,?,00000010,00000000), ref: 00360F16

Strings

Shlwapi.dll, xrefs: 00360EAA
DllGetVersion, xrefs: 00360EBB

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: d50c4a7b699e726dba728fbf0901ec9c5c9dc89a98bf6e7d9523c52c21b67875
Instruction ID: f583c835b679bf75b2396de2d5d663ee3cd0a3cb8721bcaeb220437606bff201
Opcode Fuzzy Hash: d50c4a7b699e726dba728fbf0901ec9c5c9dc89a98bf6e7d9523c52c21b67875
Instruction Fuzzy Hash: 1821A7726043018BC315AF29EC4266BF7E4BFD9715F81056EF949D7302EB35D80987A2

Function 003CFDD2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,003CFEDF,003CD0E1,0000000C,?,00000000,00000000,?,003D0109,00000021,FlsSetValue,0043CF80,0043CF88,?), ref: 003CFE93

Strings

api-ms-, xrefs: 003CFE29
ext-ms-, xrefs: 003CFE3D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 4a2892933ce337061f7c33d2724a2dff1c9f7e024acb9b39402324159063a091
Instruction ID: 0e43c0d12272ca6849ec6e4964fb09f72897d65a9e173ddb9b630b885bd808a9
Opcode Fuzzy Hash: 4a2892933ce337061f7c33d2724a2dff1c9f7e024acb9b39402324159063a091
Instruction Fuzzy Hash: A7219372A02214AFC723AB749C45F5A776A9B45770F261138E916E72A1DB30ED00C7D4

Function 00286CB0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00286ED0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00286ED6
GetProcessHeap.KERNEL32(-000000FF,00000000), ref: 00286F01
HeapFree.KERNEL32(00000000,-000000FF,00000000), ref: 00286F07

Strings

_TEMP, xrefs: 00286DF7, 00286E2A
|3D, xrefs: 00286E2B

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: _TEMP$|3D
API String ID: 3859560861-4027163254
Opcode ID: f971f2ea2ef75ee2f492df42fcadb05acb1a9a29adb010ecfc15622986475fdc
Instruction ID: 83a92a9d0545844f707fd3707360d8e1e67de28d6f7e9d745727c1e5c683e24c
Opcode Fuzzy Hash: f971f2ea2ef75ee2f492df42fcadb05acb1a9a29adb010ecfc15622986475fdc
Instruction Fuzzy Hash: 4891B075E12249DFDB00DF98C988BEEFBB4EF44314F2442A9E505A72D1CB749A04CBA1

Function 00316080 Relevance: 9.1, APIs: 6, Instructions: 149COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003160CA
std::_Lockit::_Lockit.LIBCPMT ref: 003160EC
std::_Lockit::~_Lockit.LIBCPMT ref: 00316114
__Getctype.LIBCPMT ref: 003161E5
std::_Facet_Register.LIBCPMT ref: 00316247
std::_Lockit::~_Lockit.LIBCPMT ref: 00316271

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 0b7ece2807b42add0db7869b723f9f9f6b30ae8aff78a5f81bb5127a85e2fda8
Instruction ID: afcbc59ab3fbc3002d0d2dfb4d31294553fcd6bd77818f7b33d9823cdc8a1166
Opcode Fuzzy Hash: 0b7ece2807b42add0db7869b723f9f9f6b30ae8aff78a5f81bb5127a85e2fda8
Instruction Fuzzy Hash: B351D2B1D00214DFDB12CFA8C941BAEB7F0EF18314F15816DE8456B392E775AA85CB91

Function 00239980 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 330COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002399D7
GetWindowRect.USER32(?,?), ref: 00239AB3

Strings

$/;, xrefs: 00239B83
PVD, xrefs: 00239D39
U2;, xrefs: 00239C6D, 00239DB8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: RectWindow
String ID: $/;$PVD$U2;
API String ID: 861336768-2145497844
Opcode ID: 2da1d0f69b3c979b1ac153eb58c76c9b3837e0ed6ef0d7216189f43c80864bf3
Instruction ID: 3c00ce804d4f09ba1820fdb973285b508ae775f5f80a766b17fb4d57b5fcc9f1
Opcode Fuzzy Hash: 2da1d0f69b3c979b1ac153eb58c76c9b3837e0ed6ef0d7216189f43c80864bf3
Instruction Fuzzy Hash: 1CE138B1D04618EFEB61CFA4D944B9EBBF8EF59700F1082A9E809A7251D7706A80CF50

Function 003B7D52 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,003B7D49,003B7D15,?,?,002521FD,00320140,?,00000008), ref: 003B7D60
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003B7D6E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003B7D87
SetLastError.KERNEL32(00000000,003B7D49,003B7D15,?,?,002521FD,00320140,?,00000008), ref: 003B7DD9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: db1aaac028f9963ede7396b17456c6c488365194bb944cbf69da629ee01a6c49
Instruction ID: ccf44c5ad0f1dc80f7badb378f488e006208b0da31a72edeb6ad1672a71c5cf7
Opcode Fuzzy Hash: db1aaac028f9963ede7396b17456c6c488365194bb944cbf69da629ee01a6c49
Instruction Fuzzy Hash: B701B53220CB216EA7272A796C856F62664EF913B9725033DF711599E2EF514C005249

Function 00333CC0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(79276D7D,00000000,00000000), ref: 00333D1F
GetShortPathNameW.KERNEL32(?,?,?), ref: 00333D8D

Strings

x86, xrefs: 00333F4A
neutral, xrefs: 00333EE6
x64, xrefs: 00333FAA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: NamePathShort
String ID: neutral$x64$x86
API String ID: 1295925010-1541741584
Opcode ID: 8825a9e26a1a004101f668322a1303f2eef5bb9a0e6e28ead187af0bb13b75af
Instruction ID: df633d116bb7646d559690ed22c3c78c802c206461eecd62ebce1613b3f3e4e9
Opcode Fuzzy Hash: 8825a9e26a1a004101f668322a1303f2eef5bb9a0e6e28ead187af0bb13b75af
Instruction Fuzzy Hash: 6AB1B171A04208EFDB01DFA8D899BDEFFB4EF04324F108159E415AB291DB75AA44CFA4

Function 00248180 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 266windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 00248258
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00248287
SendMessageW.USER32(00000000,0000110A,00000004,0A74C085), ref: 00248443
SendMessageW.USER32(0000110A,0000110A,00000001,00000000), ref: 00248466

Strings

_L, xrefs: 00248325

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend
String ID: _L
API String ID: 3850602802-2792937660
Opcode ID: b189d609b0cab103e32f2347cf9ac7623900128752c03abfa793eaad9cb8b24f
Instruction ID: 58d49cbabe0703c634cb759fedb8bfdd70eaeda2f7641a428a446721f6f65a88
Opcode Fuzzy Hash: b189d609b0cab103e32f2347cf9ac7623900128752c03abfa793eaad9cb8b24f
Instruction Fuzzy Hash: 1EA17072920215DFCF19DFA4D880AEEBBF5BF08710F1545A9E901AB291DB70EC51CB60

Function 00329710 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 003299E8

Strings

Send Error Report, xrefs: 0032994A
Details >>, xrefs: 0032996E
Close, xrefs: 00329904
Copy, xrefs: 003299CF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: 692d696392b20479b3ac47e367fb9d09ebc80db62be4eeeb1971ed3805f7be85
Instruction ID: 2a35ae872e492277e957875769ea9bdc8e45011d36cd8c4d06e4a4f233a7a0c9
Opcode Fuzzy Hash: 692d696392b20479b3ac47e367fb9d09ebc80db62be4eeeb1971ed3805f7be85
Instruction Fuzzy Hash: E091E270A40715ABEB19DF60EC56FAAB775FF44704F104229F612BB2D0EBB0A904CB55

Function 00228890 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00228975
__Init_thread_footer.LIBCMT ref: 002289EF

Strings

<a>, xrefs: 00228BA1
<a href=", xrefs: 00228937
</a>, xrefs: 00228AF9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 00982f5af39e933cce71842c83006ff9d939f95874c81b14a3a5d64d81693d55
Instruction ID: ce09bc104ca8a1b8dcd8a11a4d0d7d4b540286c86c04c91ac5893d00cddb597a
Opcode Fuzzy Hash: 00982f5af39e933cce71842c83006ff9d939f95874c81b14a3a5d64d81693d55
Instruction Fuzzy Hash: A9A1BDB0A11214EFCB04DFA8E859FADB7B5FF44314F148229E411AB2D2EF34A954CB54

Function 00245E20 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 220windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Part of subcall function 00302040: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00240168,00000000,80004005), ref: 003020AB
Part of subcall function 00302040: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003020DB

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00245FDC
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00245FF3
SendMessageW.USER32(?,00001061,00000000,?), ref: 0024604F

Strings

QuickSelectionList, xrefs: 00245F15, 00245F27, 00245F31
|3D, xrefs: 00246012

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$AllocHeapWindow
String ID: QuickSelectionList$|3D
API String ID: 2851540245-875564710
Opcode ID: 03bfe415714a2cd11f2f010a8984a0aa6a27657fc892d3b849a917672637ae13
Instruction ID: b89d6d756db36a7c18ac5a23e74f95ec14bba203c793b87a75c5546079787a99
Opcode Fuzzy Hash: 03bfe415714a2cd11f2f010a8984a0aa6a27657fc892d3b849a917672637ae13
Instruction Fuzzy Hash: 0281CB71A106099FCB18DF68C894BAEF7F4FF88324F10422DE955A7291CB71A904CF90

Function 002799D0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 207threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00320F40: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00320F84
Part of subcall function 00320F40: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00320F8F

GetCurrentThreadId.KERNEL32 ref: 00279B3C
SendMessageW.USER32(?,00000127,00030003,00000000), ref: 00279BC5

Strings

AI_HIDE_CAPTION_ICON_AND_TEXT, xrefs: 00279AE0
AI_HIDE_CAPTION_ICON_AND_TEXT_ALL, xrefs: 00279A69
0^L, xrefs: 00279A33

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$CurrentThread
String ID: 0^L$AI_HIDE_CAPTION_ICON_AND_TEXT$AI_HIDE_CAPTION_ICON_AND_TEXT_ALL
API String ID: 2377075789-62552522
Opcode ID: 7933ef75ffa6f535b4cedb8c2d3fe9316fc55f5d30e586d28af11a2537289e01
Instruction ID: 1377c2fbc4e19710220b3e986d6bf5c8aa4193cd18a1e2372411bd467e10397e
Opcode Fuzzy Hash: 7933ef75ffa6f535b4cedb8c2d3fe9316fc55f5d30e586d28af11a2537289e01
Instruction Fuzzy Hash: FA81B130A15208DFDF05EF64C995B9DBBB5EF48304F1481A9E809AB292DB74AE04CF91

Function 00322450 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

SHGetSpecialFolderLocation.SHELL32(00000000,00000011,?,?,79276D7D,00000000,?), ref: 0032266C
SHGetMalloc.SHELL32(?), ref: 00322695

Strings

C:\FAKE_DIR\, xrefs: 0032263A, 00322657
C:\, xrefs: 00322621
%s, %.2u %s %.4u %.2u:%.2u:%.2u GMT, xrefs: 00322566

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$FolderHeapLocationMallocProcessSpecial
String ID: %s, %.2u %s %.4u %.2u:%.2u:%.2u GMT$C:\$C:\FAKE_DIR\
API String ID: 3216538967-785558474
Opcode ID: 511d9c8c14c400c25fab18def0e40b106678696decbbedc8f14665267b22653b
Instruction ID: 9f593862ae1853f33660816445b4f589d2d75bd27b76e7d3282ecaca47a4ce59
Opcode Fuzzy Hash: 511d9c8c14c400c25fab18def0e40b106678696decbbedc8f14665267b22653b
Instruction Fuzzy Hash: EF718FB1900258EBDB10DF95DC45BEEBBF8FB48705F10851AF914AB282D7B89908CF58

Function 0024DC60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 0024DD5D
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 0024DD72
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 0024DD7A

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Part of subcall function 0024F780: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 0024F7CD

Strings

TabHost, xrefs: 0024DCE9, 0024DCFB, 0024DD05
SysTabControl32, xrefs: 0024DD55

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$AllocCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 4294867080-2872506973
Opcode ID: cbee6b9b9aa4295d718f430e1d99dac4cfacd71e3860b802ad5c4ae8c9fb272a
Instruction ID: 4487b3c80a6e2865387994963eee68584adab9800cc7513662377450dbf3f2b0
Opcode Fuzzy Hash: cbee6b9b9aa4295d718f430e1d99dac4cfacd71e3860b802ad5c4ae8c9fb272a
Instruction Fuzzy Hash: A1519D31A00605AFDB04DF69C884BAABBB4FF89710F104269E915A7391DB75AC00CFA4

Function 00236E60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 159registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,79276D7D), ref: 00236EF3
GetLastError.KERNEL32 ref: 00236F1C
RegCloseKey.ADVAPI32(?,00000000,00000000,?,0044337C,00000000,00000000,80000001,00000000,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 00237065

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00236EE8
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00236F5C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CloseCreateErrorEventLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1713683948-2079760225
Opcode ID: c5c10d1e427caa8b6076764b40426dcd36f8fd32a0b68ae4d96518066ade8568
Instruction ID: 06082ce9d78b801a5910ff54e306b524a3d303126053daa270591ea636bdc49d
Opcode Fuzzy Hash: c5c10d1e427caa8b6076764b40426dcd36f8fd32a0b68ae4d96518066ade8568
Instruction Fuzzy Hash: 5A618FB0D14349EEDB10CFA8C945BDEFBF4BF14304F108259E459A7281DBB46A58CB91

Function 00275BA0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 128COMMON

Download Yara Rule

Strings

}m'y, xrefs: 00275BCB, 00275BD5
}m'y, xrefs: 00275CAD
}m'y, xrefs: 00275C30
Windows.UI.Xaml.DispatcherTimer, xrefs: 00275C4A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.DispatcherTimer$}m'y$}m'y$}m'y
API String ID: 0-548761736
Opcode ID: f34f458cfe2c932575236283d4fedfe2205adaef0b379662780d06dcc4204a4b
Instruction ID: 1d8eb78c37591d39a9f1dc7adc1056522169e0bec945c088585b580de7625a8e
Opcode Fuzzy Hash: f34f458cfe2c932575236283d4fedfe2205adaef0b379662780d06dcc4204a4b
Instruction Fuzzy Hash: 8F51BEB1D1061ADBDB01DF98C841BEEFBB8FB04714F20456AE815A7280DBB56A48CBD5

Function 00285E00 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(010D9CE0,79276D7D,010D9CE0), ref: 00285E41
GetCurrentThreadId.KERNEL32 ref: 00285E51
LeaveCriticalSection.KERNEL32(?), ref: 00285E77

Strings

}m'y, xrefs: 00285E00
rw, xrefs: 00285E77

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: rw$}m'y
API String ID: 2351996187-2181794445
Opcode ID: 8fffd4004e6da890bc5bb89edb3b9928421797ef010f6968c39f068d37b39220
Instruction ID: d926b08eaa3a4b3dd02b5874bc02bd616dafc47f9d0293dc0ec42e0016ed53d6
Opcode Fuzzy Hash: 8fffd4004e6da890bc5bb89edb3b9928421797ef010f6968c39f068d37b39220
Instruction Fuzzy Hash: AA41CF75911926AFDB20DF58CC80BAAF7A8FB45314F108729E925D7680D731EE64CBD0

Function 0025D090 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C59E8,Windows.UI.Xaml.Controls.TextBlock,00000022,79276D7D,00000001,00000000,?,YL,003E6017,000000FF), ref: 0025D168

Strings

Windows.UI.Xaml.Controls.TextBlock, xrefs: 0025D0BA
YL, xrefs: 0025D137
YL, xrefs: 0025D149
YL, xrefs: 0025D0A0

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Controls.TextBlock$YL$YL$YL
API String ID: 4129690577-108268177
Opcode ID: 5981e620507ab9f5e41880a1ebf9bf3957d32a8e279afbadc4726bd70819a75f
Instruction ID: 8d378092f2df6d26cee8ad77ee634ecae9640ed87165c8faead1840b3c6e238e
Opcode Fuzzy Hash: 5981e620507ab9f5e41880a1ebf9bf3957d32a8e279afbadc4726bd70819a75f
Instruction Fuzzy Hash: 28319CB191161AEBDB00DF94CC46BEFBBB4FB04315F10416AE814AB280DBB46B48CBD5

Function 00232990 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002329C6
EnterCriticalSection.KERNEL32(004C6250), ref: 002329E6
LeaveCriticalSection.KERNEL32(004C6250), ref: 00232A0A

Strings

PbL, xrefs: 002329CF
rw, xrefs: 00232A0A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: rw$PbL
API String ID: 2351996187-1635339685
Opcode ID: aba4285a7f70d91c73585193b18fc9e9a4ad106661613a9a8be42329fb235442
Instruction ID: f3a511b322f67dc2acb4be336004977258e1d716e1e300d05e1b73bc87a033c0
Opcode Fuzzy Hash: aba4285a7f70d91c73585193b18fc9e9a4ad106661613a9a8be42329fb235442
Instruction Fuzzy Hash: EA21BFB1904744EFDB21DF58DC40B8ABBF8FB05B10F10866EE82597780D7B9A508CB94

Function 00346820 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

APPDATA, xrefs: 00346A57, 00346A5F
PROGRAMFILES, xrefs: 00346A3D
ProgramFilesFolder, xrefs: 003468E7
AppDataFolder, xrefs: 003469C8, 00346A05

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFilesFolder
API String ID: 0-3551742416
Opcode ID: f607005096f92f2a3703d4cd027f620dccb887949f7e0e32d342d5b74cbf2d43
Instruction ID: 05ba13902eec01b846f6e403b21c2e7cb55717f2a2254bed474367a2aac05281
Opcode Fuzzy Hash: f607005096f92f2a3703d4cd027f620dccb887949f7e0e32d342d5b74cbf2d43
Instruction Fuzzy Hash: E4212032A006059BCB25DF28C841BBAF3E4FF46720F5046AAE911DB391EB35ED44C784

Function 00286040 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 81threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(}m'y,79276D7D), ref: 00286080
GetCurrentThreadId.KERNEL32 ref: 00286093
LeaveCriticalSection.KERNEL32(?), ref: 00286111

Strings

}m'y, xrefs: 0028607D
rw, xrefs: 00286111

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: rw$}m'y
API String ID: 2351996187-2181794445
Opcode ID: 1fdbe6c771ea76f2e949fe58319e58dd1c7f0ef368cb794fbdec69b077d97689
Instruction ID: 658b469910367730703c8a11ba63ae5947536710869c3792c303f945793f9eb4
Opcode Fuzzy Hash: 1fdbe6c771ea76f2e949fe58319e58dd1c7f0ef368cb794fbdec69b077d97689
Instruction Fuzzy Hash: 7C31C975900245DFDB21CF69C849BAEBBF0EF08314F148169E895A33A1E775AA04CB90

Function 00254B50 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00254B92
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00254B98

Strings

}m'y, xrefs: 00254BB1
combase.dll, xrefs: 00254B8D
RoOriginateLanguageException, xrefs: 00254B88

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll$}m'y
API String ID: 2574300362-426541238
Opcode ID: 61a6b08c263e110bb65d987a8a88d8584f095409f097bea68a6249893d774e0c
Instruction ID: 6f920370fde8fb203a023dab2f78bc0b5d76c2b03d917e4347685fd4f256fbea
Opcode Fuzzy Hash: 61a6b08c263e110bb65d987a8a88d8584f095409f097bea68a6249893d774e0c
Instruction Fuzzy Hash: C131D470910209EFDB14EFA8C801BEEB7F4EB04315F10466AEC25A72C0D7789B58CB94

Function 003BA78C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,003BA84D,?,?,00000000,?,?,003BA8FF,00000002,FlsGetValue,0043A0D0,0043A0D8), ref: 003BA81C

Strings

api-ms-, xrefs: 003BA7DC

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 43e420ca650189dd60b618187728866e0c6f61dfb9092fd27f411c9f6e92b5fe
Instruction ID: 11c280029ea48d2cd202103a1817b1577eec83e610c082348847807a02237a5d
Opcode Fuzzy Hash: 43e420ca650189dd60b618187728866e0c6f61dfb9092fd27f411c9f6e92b5fe
Instruction Fuzzy Hash: 2A11A731A45F21ABDB334BA89C45B9D77B49F01774F260120FA11EB980DB70ED0586D6

Function 00232700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004C6250), ref: 0023273C
GetCurrentThreadId.KERNEL32 ref: 00232750
LeaveCriticalSection.KERNEL32(004C6250), ref: 0023278E

Strings

rw, xrefs: 0023278E
PbL, xrefs: 00232729

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: rw$PbL
API String ID: 2351996187-1635339685
Opcode ID: 539aa316126658adc7db84f60e135f0de7213182734b44a15c7007d50e2ac98e
Instruction ID: e3a8ec4b6e3df6f232b4b540cd4de63758aa5ad364c039cfb6acdc3cf9f50940
Opcode Fuzzy Hash: 539aa316126658adc7db84f60e135f0de7213182734b44a15c7007d50e2ac98e
Instruction Fuzzy Hash: 13112775904345DBCB20CF59CD04B6AFBF4FB55720F11866EE81293390D7749908CB90

Function 003CC68F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,79276D7D,?,?,00000000,00436426,000000FF,?,003CC662,?,?,003CC636,?), ref: 003CC6C4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 003CC6D6
FreeLibrary.KERNEL32(00000000,?,00000000,00436426,000000FF,?,003CC662,?,?,003CC636,?), ref: 003CC6F8

Strings

CorExitProcess, xrefs: 003CC6CE
mscoree.dll, xrefs: 003CC6BD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: be19b5da3e750479c1ad05f1d2344ced8eb54ac792ae051883ee775edcc9c518
Instruction ID: d999a5edd86c8c8ed74a4a0d5ae7d142165838beef005dc64f2bc924541cac2f
Opcode Fuzzy Hash: be19b5da3e750479c1ad05f1d2344ced8eb54ac792ae051883ee775edcc9c518
Instruction Fuzzy Hash: B601A231914619EFDB129F54DC05FAEBBB8FB04B11F15612EF811E2290DBB89800CB98

Function 003279C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00327A1E
GetProcAddress.KERNEL32(00000000), ref: 00327A25
__Init_thread_footer.LIBCMT ref: 00327A3C

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

Strings

Dbghelp.dll, xrefs: 00327A19
SymFromAddr, xrefs: 00327A14

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: 8eb9e5b84eb4824fd84439d9542ab09a4795f6f6521de6a64328998a9bcd3d50
Instruction ID: d6a8ce46a3456269535ca66e9c38ef25a0ba5954add3dc8d52448b1fef3f736d
Opcode Fuzzy Hash: 8eb9e5b84eb4824fd84439d9542ab09a4795f6f6521de6a64328998a9bcd3d50
Instruction Fuzzy Hash: 1801BCB1A40700EFC710CF58ED46F68B7A4EB08B30F21827AFC15837D0C739A9008A19

Function 003B66EA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,003B6687,00000064), ref: 003B670D
LeaveCriticalSection.KERNEL32(004C4CD8,?,?,003B6687,00000064,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B6717
WaitForSingleObjectEx.KERNEL32(?,00000000,?,003B6687,00000064,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B6728
EnterCriticalSection.KERNEL32(004C4CD8,?,003B6687,00000064,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B672F

Strings

rw, xrefs: 003B6717

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: rw
API String ID: 3269011525-1192573183
Opcode ID: 5e88e0753de79828c876cb70cd8a15a766cb5854d33c523a5bc306625542eae9
Instruction ID: 65fd9a182123001fe5a5c4ae6bc1080cfe04c11e32445461632e36543c7b509b
Opcode Fuzzy Hash: 5e88e0753de79828c876cb70cd8a15a766cb5854d33c523a5bc306625542eae9
Instruction Fuzzy Hash: AFE09235542624A7CB421B91EE1AFDE7F38EB45B15B130039FA0566530CF6809109BEC

Function 0028DE10 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 316memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 0028E08B
HeapFree.KERNEL32(00000000,?,?), ref: 0028E091
GetProcessHeap.KERNEL32(?,?), ref: 0028E160
HeapFree.KERNEL32(00000000,?,?), ref: 0028E166

Strings

|3D, xrefs: 0028DFBF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3D
API String ID: 3859560861-661694623
Opcode ID: 5ac864c58040ecab1c2ffcb08ad5e966cfbb055ad162d917fc60074f2274fc74
Instruction ID: 4754dddedcac3e903a74165ffaf5934dd58c92b7e20484acea59081b13b9e162
Opcode Fuzzy Hash: 5ac864c58040ecab1c2ffcb08ad5e966cfbb055ad162d917fc60074f2274fc74
Instruction Fuzzy Hash: 11D18D34911208DFDF14EFA8C858BEEBBB5BF14304F1441A9D405AB292DB74AE19CF91

Function 00261B70 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 268memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?), ref: 00261E5F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00261E65
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?), ref: 00261F0F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00261F15

Strings

|3D, xrefs: 00261DF1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3D
API String ID: 3859560861-661694623
Opcode ID: d4afe0ba95bae516debae98b15c0298de76a93d65610c12ec4d1a1fce9f753a6
Instruction ID: 9106b9ae9ebe57f95b52ab4eda2615a9e3a5058b493dd094a50dead60d2274a8
Opcode Fuzzy Hash: d4afe0ba95bae516debae98b15c0298de76a93d65610c12ec4d1a1fce9f753a6
Instruction Fuzzy Hash: 54B17C70D10268DEEB20DF28CC45BDEB7B5AF01314F1442D9D919A7282DB74AA98CF91

Function 002403C0 Relevance: 7.7, APIs: 5, Instructions: 234windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002425D0: __Init_thread_footer.LIBCMT ref: 0024263F

SendMessageW.USER32(?,0000104D,00000000,00000000), ref: 00240502
SendMessageW.USER32(?,0000104D,00000000,?), ref: 002405B7
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00240656
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00240701

Part of subcall function 00232970: RaiseException.KERNEL32(?,?,00000000,00000000,003B5A3C,C000008C,00000001,?,003B5A6D,00000000,?,002291C7,00000000,79276D7D,00000001,?), ref: 0023297C

SendMessageW.USER32(?,0000104C,00000000,?), ref: 00240787

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$ExceptionInit_thread_footerRaise
String ID:
API String ID: 3442259968-0
Opcode ID: 1c25d6c96d33f3b5f26ed72906aab4163313c4ca94bed83890c471f7fe860622
Instruction ID: f8883ee024f9cc69d8035970982020db12440c57b8de2eb3542c822038fd155c
Opcode Fuzzy Hash: 1c25d6c96d33f3b5f26ed72906aab4163313c4ca94bed83890c471f7fe860622
Instruction Fuzzy Hash: 3DB11BB1D11359DBEB24DF54CD94BDABBB1FF48304F108299EA186B280D7B56A84CF90

Function 002607E0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?), ref: 00260A0F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 00260A15
GetProcessHeap.KERNEL32(?,?,?,?,?,?), ref: 00260ABF
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 00260AC5

Strings

|3D, xrefs: 002609A1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3D
API String ID: 3859560861-661694623
Opcode ID: 07181cc87cd9f94efc566a968ef9f1c18310e95f3c3e29db95cd85eb0b0ca1db
Instruction ID: aa1e1c9e33984f4f7d2544517a26956036ffdbf453b7f025f29d8441450886f4
Opcode Fuzzy Hash: 07181cc87cd9f94efc566a968ef9f1c18310e95f3c3e29db95cd85eb0b0ca1db
Instruction Fuzzy Hash: FD916970A11368DEEB21DF64CC85BDABBB5AF01304F1442D9D509A7282DB745F98CF92

Function 0022FCE0 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0022FD30
GetDlgItem.USER32(?,?), ref: 0022FD55
SendMessageW.USER32(?,?,?,?), ref: 0022FE1F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: 13d69baab3f557a8bdcff46f7ed830c64ff5c61f7b0f4f03414b26ae257ff149
Instruction ID: efb0f8192619e1e6e06c7ea1d620f0284d5a3d820d2773886b8d26ca4dd08985
Opcode Fuzzy Hash: 13d69baab3f557a8bdcff46f7ed830c64ff5c61f7b0f4f03414b26ae257ff149
Instruction Fuzzy Hash: 3141D636210122BFC795CF98FA98E76B7B9FB45311F04443AE549C6562D732EC20DB20

Function 0031BCD0 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0031BD04
std::_Lockit::_Lockit.LIBCPMT ref: 0031BD24
std::_Lockit::~_Lockit.LIBCPMT ref: 0031BD4C
std::_Facet_Register.LIBCPMT ref: 0031BE2B
std::_Lockit::~_Lockit.LIBCPMT ref: 0031BE55

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 326ba731969bca9570754bd9329079ffda2972e0721fdceca96528ecf7cbc1e9
Instruction ID: 627f87d7d2093b4763a3061991670bda96267f57483df9846832f2912a729a10
Opcode Fuzzy Hash: 326ba731969bca9570754bd9329079ffda2972e0721fdceca96528ecf7cbc1e9
Instruction Fuzzy Hash: 3F51AF70900218DFDB1ACF58D840BEEFBB4EF08314F25816DE845AB292DB75AE45CB91

Function 00277A70 Relevance: 7.6, APIs: 5, Instructions: 100threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00277A99
CoInitializeEx.COMBASE(00000000,00000002), ref: 00277AA9
SendMessageW.USER32(?,000005FA,?,00000000), ref: 00277BC1

Part of subcall function 00286040: EnterCriticalSection.KERNEL32(}m'y,79276D7D), ref: 00286080
Part of subcall function 00286040: GetCurrentThreadId.KERNEL32 ref: 00286093
Part of subcall function 00286040: LeaveCriticalSection.KERNEL32(?), ref: 00286111

Part of subcall function 00280100: SetLastError.KERNEL32(0000000E,?,0027880B,?,?,?,?), ref: 00280118

GetLastError.KERNEL32(?,?,0044C530,00000000), ref: 00277B33
ShowWindow.USER32(?,0000000A,?,?,0044C530,00000000), ref: 00277B45

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalCurrentErrorLastSectionThread$EnterInitializeLeaveMessageSendShowWindow
String ID:
API String ID: 2782539745-0
Opcode ID: dfb1f299dd3242f721a821d6c9479de452466886ff9a7568428d70fbc560cf4b
Instruction ID: d4b3f4838f861f3758b17c49ea3ee66d4b5683173cc54e0279e0d811b4a66e61
Opcode Fuzzy Hash: dfb1f299dd3242f721a821d6c9479de452466886ff9a7568428d70fbc560cf4b
Instruction Fuzzy Hash: 3931CD70D10248EBDB14EFA4C84ABDEBBB4EF50308F108269E5156B2D1DBB95A19CF91

Function 0022DB60 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0022DBC2
VariantClear.OLEAUT32(?), ref: 0022DC1B
VariantClear.OLEAUT32(?), ref: 0022DC25
VariantClear.OLEAUT32(?), ref: 0022DC2F
VariantClear.OLEAUT32(?), ref: 0022DC3C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: 29fe07a5b5b4e1d3f4d6f0e3aadc23c8b77f364ea7cc7f0f15ac1c3c7ae3fe4f
Instruction ID: d098a39b21577e757dfe95cc1496b9456b298343b1763b67d452b4553076218e
Opcode Fuzzy Hash: 29fe07a5b5b4e1d3f4d6f0e3aadc23c8b77f364ea7cc7f0f15ac1c3c7ae3fe4f
Instruction Fuzzy Hash: 32311871D15248EFDB05CFA8D944BDEBBF8EF49304F10C69AE410A7290D7B5AA04CBA1

Function 002546E0 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 0025472A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00254730
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00254753
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,003E6756,000000FF), ref: 0025477B
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,003E6756,000000FF), ref: 00254781

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 84f9a11f0e8e9fd116d2bb64f6abc0672a532e3ac0447b3c0e214812ffe8145f
Instruction ID: 7a230223c515c63486c9de102c74b50f63d8eae155e19f675bcfb3eaa734dce3
Opcode Fuzzy Hash: 84f9a11f0e8e9fd116d2bb64f6abc0672a532e3ac0447b3c0e214812ffe8145f
Instruction Fuzzy Hash: EC1186B1A54219ABEB11EF94CC06BEFB7BCEB04708F100619F910AB6C1D7B599048795

Function 00240DC0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00240DCB
SendMessageW.USER32(?,?,?,0000102B), ref: 00240E28
SendMessageW.USER32(?,?,?,0000102B), ref: 00240E77
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00240E88
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00240E95

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 6c3a8ac6b5757afc4c99579a02e64ff183979f1c35b0e4f737641b4a62953ce0
Instruction ID: d39132a89b3a6a191fcd8618a3b636acafc7b562e1364d675690c8a385742d34
Opcode Fuzzy Hash: 6c3a8ac6b5757afc4c99579a02e64ff183979f1c35b0e4f737641b4a62953ce0
Instruction Fuzzy Hash: 84215E31918346ABE220DF11CD44B1ABBF1BFEE758F202B1EF1D4211A4E7F191848E86

Function 0033A780 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 0033A570: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000010), ref: 0033A59D

_wcschr.LIBVCRUNTIME ref: 0033AAE2
_wcschr.LIBVCRUNTIME ref: 0033AB6F

Strings

lE, xrefs: 0033ABEE
hE, xrefs: 0033ABF5

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer_wcschr$FileHeapModuleNameProcess
String ID: hE$lE
API String ID: 973101865-1549293132
Opcode ID: b121d129d713679239f4924b6f2eb901cc08db5c9b85cf34245050701cbc7355
Instruction ID: 915842fe26afa5c6344f082efe3549383f4ed49429da4fc7fdaff0b28a3526a6
Opcode Fuzzy Hash: b121d129d713679239f4924b6f2eb901cc08db5c9b85cf34245050701cbc7355
Instruction Fuzzy Hash: A7F1E271A00609DFDB05DFA8C889B9EFBF8FF44314F158269E815AB291EB749904CF91

Function 00353F70 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 417COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00353FC9
_wcschr.LIBVCRUNTIME ref: 003540A9

Strings

realm, xrefs: 0035438D, 0035439F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: _wcschr
String ID: realm
API String ID: 2691759472-4204190682
Opcode ID: 37a456135dc76efd2deace49ad588807e48067874540ad324b7923f6de4d62de
Instruction ID: 5e5aae5b42da30fd71bd47dcd3bb21f52e62630e67ba431bf608f1b89810987d
Opcode Fuzzy Hash: 37a456135dc76efd2deace49ad588807e48067874540ad324b7923f6de4d62de
Instruction Fuzzy Hash: 8BF1B331A00619DFDB05DFA8C848F9EBBB9EF55325F158259F8149B2A1D730DD84CB90

Function 0022D8D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 0022D946
SendMessageW.USER32(?,00000000,00000000), ref: 0022DA42

Part of subcall function 0022F190: SysFreeString.OLEAUT32(00000000), ref: 0022F233

Strings

>D, xrefs: 0022D971
AtlAxWin140, xrefs: 0022D93E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140$>D
API String ID: 4045344427-2440186897
Opcode ID: d1b17f0c79798d09a962ee19fdbc8265e556c23ba5cf1cc60679fb88476715b1
Instruction ID: c97acd651946136afc3b8560ed0e7d2e0474236ed038c8d432c16fe6afe335b7
Opcode Fuzzy Hash: d1b17f0c79798d09a962ee19fdbc8265e556c23ba5cf1cc60679fb88476715b1
Instruction Fuzzy Hash: EC910374600205EFDB14CF64C888F5ABBB9FF48724F2085A9F8199B291CB75EA11CB90

Function 002807C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000004,?), ref: 0028083C
MonitorFromWindow.USER32(?,00000002), ref: 00280860
GetMonitorInfoW.USER32(00000000,?), ref: 00280882

Strings

U2;, xrefs: 00280998, 002809A8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MonitorWindow$FromInfoRect
String ID: U2;
API String ID: 1973172141-3377301532
Opcode ID: 3c9aaccba383d8403d7a1de7a54544b05b551db4feee985680fd03628f5a4cde
Instruction ID: f7e57e108b5a0214e605d7319c1c9d81409d20fe7e45180faa9d855a110e0c44
Opcode Fuzzy Hash: 3c9aaccba383d8403d7a1de7a54544b05b551db4feee985680fd03628f5a4cde
Instruction Fuzzy Hash: 1E717975D10208AFDB54DFA4DD59FAEBBF9EF88700F204229F805A7290DB70A914CB64

Function 0027C4B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0027C4EE
SetWindowPos.USER32(?,00000000,?,?,?,00000008,00000604), ref: 0027C6C1

Strings

AiDlgWeight, xrefs: 0027C50C
AiDlgHeight, xrefs: 0027C5E1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Rect
String ID: AiDlgHeight$AiDlgWeight
API String ID: 3200805268-871102398
Opcode ID: 0860d1c6938c8d5e4911bf2e785e79fb11638bb48110c194f9b140ae9735d899
Instruction ID: 7f6d933b238d0c8a3a1d82f96a54de78be21a5d3bc9d21e41b59c2d0f5d43d72
Opcode Fuzzy Hash: 0860d1c6938c8d5e4911bf2e785e79fb11638bb48110c194f9b140ae9735d899
Instruction Fuzzy Hash: AA618071D00249EFCB04DFA8D985BDEBBB9EF48314F248169E815AB291D774AA14CF90

Function 0035F940 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,79276D7D,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 0035F974

Part of subcall function 00325170: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,80004005,80004005,?,?,?,00000000,0041A8AD,000000FF), ref: 00325188
Part of subcall function 00325170: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,80004005,80004005,?,?,?,00000000,0041A8AD,000000FF), ref: 003251BB

Part of subcall function 00232970: RaiseException.KERNEL32(?,?,00000000,00000000,003B5A3C,C000008C,00000001,?,003B5A6D,00000000,?,002291C7,00000000,79276D7D,00000001,?), ref: 0023297C

Part of subcall function 00229B10: HeapAlloc.KERNEL32(?,00000000,?,79276D7D,00000000,003DD840,000000FF,?,?,004B9A1C,?,0035BB18,80004005,79276D7D), ref: 00229B5A

Strings

*.*, xrefs: 0035F9EA, 0035F9FC, 0035FA04
.pack, xrefs: 0035FCB1
.jar, xrefs: 0035FDFC

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ByteCharMultiWide$AllocExceptionHeapObjectRaiseSingleWait
String ID: *.*$.jar$.pack
API String ID: 1065105516-3892993289
Opcode ID: 64cbdc36e23b327b60b5542e97e9a3a1e35af8e88f50969e2f538465f2afe1a2
Instruction ID: b64199fcd0d068e4577d51e923f567b3f0b52e5974d7362b6ba38d76559f1415
Opcode Fuzzy Hash: 64cbdc36e23b327b60b5542e97e9a3a1e35af8e88f50969e2f538465f2afe1a2
Instruction Fuzzy Hash: 91516F70A006169FDB11DFA9C844FAEB7B4FF44315F158269E825EB2A1DB34D908CF91

Function 0028C2E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.CheckBox, xrefs: 0028C38A
P\L, xrefs: 0028C417
T\L, xrefs: 0028C405

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: P\L$T\L$Windows.UI.Xaml.Controls.CheckBox
API String ID: 0-2012647524
Opcode ID: c8b8e01a83c75e1f3401d7a0578e287660aec05271a251ed9fa74de484dc7883
Instruction ID: 19649c6deafd7a8a4a82392e39e91e60c8688c723234eddba942d3b0f35b18d6
Opcode Fuzzy Hash: c8b8e01a83c75e1f3401d7a0578e287660aec05271a251ed9fa74de484dc7883
Instruction Fuzzy Hash: E5519FB5D11219DBDB00DF94C981BEEBBB8FB04714F20412AE815A73C0D7B96A48CBE5

Function 00274340 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.ListBoxItem, xrefs: 002743EA
,[L, xrefs: 00274465
([L, xrefs: 00274477

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: ([L$,[L$Windows.UI.Xaml.Controls.ListBoxItem
API String ID: 0-753802402
Opcode ID: 7994f4a4007b35f069e50a0f08d7d919d6e6cab1a6961856695a72b8a0a00b4c
Instruction ID: 7d8f0ffb55e45cd25f6824d056a0beb55f7c38db2933c69553a1c67ef6e88913
Opcode Fuzzy Hash: 7994f4a4007b35f069e50a0f08d7d919d6e6cab1a6961856695a72b8a0a00b4c
Instruction Fuzzy Hash: F45190B1D10219EBDB00DFA4DC41BEEBBB8FB04714F10456AE915A7380DB756A44CBE5

Function 00288830 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.Foundation.Uri, xrefs: 002888DA
$\L, xrefs: 00288955
\L, xrefs: 00288967

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: \L$$\L$Windows.Foundation.Uri
API String ID: 0-2804300113
Opcode ID: 277272e6a58951d529b9ebffa90661f4af3fd9438f11253c602bacbf6f62208b
Instruction ID: 6f52d58436d9bd0a1c79e7dfa3b26e4bd6dc83b631b8287eeba2c1a4264779b8
Opcode Fuzzy Hash: 277272e6a58951d529b9ebffa90661f4af3fd9438f11253c602bacbf6f62208b
Instruction Fuzzy Hash: 32519FB5D1121ADBDB00EF94DD41BEEBBB8EB04714F10452AE815A73C0DBB56A44CBD1

Function 00275470 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

x[L, xrefs: 002755A7
|[L, xrefs: 00275595
Windows.UI.Xaml.Controls.ListViewItem, xrefs: 0027551A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ListViewItem$x[L$|[L
API String ID: 0-1949322299
Opcode ID: 3e1c04872cb6dde51f4065070ce78d08c77c771a8c8d7f6e472adf3420f561ae
Instruction ID: a9d7811c677995398db57ccc85a8b0b3607f92b4cca4f254360dd2a2303c8d74
Opcode Fuzzy Hash: 3e1c04872cb6dde51f4065070ce78d08c77c771a8c8d7f6e472adf3420f561ae
Instruction Fuzzy Hash: 33519EB1D1061AEBDB00DF98C841BEEFBB8FB04715F10452AE815A7380D7B56A48CBE5

Function 00273620 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

ZL, xrefs: 00273757
Windows.UI.Xaml.Controls.Grid, xrefs: 002736CA
ZL, xrefs: 00273745

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.Grid$ZL$ZL
API String ID: 0-2539264344
Opcode ID: 3893a579364ad43971017272a0fe7faed808a9f842820b680380f985e1f76000
Instruction ID: b0b7ff8778a0824a084ae21ab0425afdf587f5169a30315e728cb791b8ccf3c5
Opcode Fuzzy Hash: 3893a579364ad43971017272a0fe7faed808a9f842820b680380f985e1f76000
Instruction Fuzzy Hash: 5651BEB1D1021AEBCB00DF94C881BEFFBB8FB04714F10412AE805A7280D7B56A58CBD5

Function 00271D30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.TreeView, xrefs: 00271DDA
XZL, xrefs: 00271E67
\ZL, xrefs: 00271E55

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.TreeView$XZL$\ZL
API String ID: 0-1940702151
Opcode ID: 8ddc3cae733cdde9d78ad466242413027ec1c2d623c06d6d00ba37df91ed16ea
Instruction ID: 34ce15c697370dedb9b66d9ec6a2478a265406f400017c49b4278eb03a779209
Opcode Fuzzy Hash: 8ddc3cae733cdde9d78ad466242413027ec1c2d623c06d6d00ba37df91ed16ea
Instruction Fuzzy Hash: BD51BFB1D1061AEBDB00DF98C841BEFBBB8FF04714F20452AE815A7280D7B56A58CBD5

Function 002748C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

Windows.UI.Text.FontWeights, xrefs: 00274969
L[L, xrefs: 002749E2
H[L, xrefs: 002749F4

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: H[L$L[L$Windows.UI.Text.FontWeights
API String ID: 0-3732253990
Opcode ID: 66505ef3383ca401ae9a205e59ce33fe83dda3d6b9b896d6a48200ec5d50e2ce
Instruction ID: c07467abac6bbc93b9318f3b111ce6c79c32a380f405e038435377bc0acd8868
Opcode Fuzzy Hash: 66505ef3383ca401ae9a205e59ce33fe83dda3d6b9b896d6a48200ec5d50e2ce
Instruction Fuzzy Hash: D4518DB191025ADFDB10DFA8D841BAEBBB4FF04314F10466AE914A7380EB746A48CB95

Function 002786F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000005,?,?,?), ref: 0027881F

Strings

|f', xrefs: 00278726
|f', xrefs: 00278715, 0027882E
(0;, xrefs: 00278816

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ShowWindow
String ID: (0;$|f'$|f'
API String ID: 1268545403-2363562750
Opcode ID: 15d24894e415dadd8afd558ccf740981ac481af71133c7aa4d704a02b81ac545
Instruction ID: 0131b82048aa845d00fb88657e07880594a6a611d3e14e0d67860e87ee847e68
Opcode Fuzzy Hash: 15d24894e415dadd8afd558ccf740981ac481af71133c7aa4d704a02b81ac545
Instruction Fuzzy Hash: 2F41A130901209EFDB15DFA4C859BDEBBB4FF08314F24416DE819AB282DB75AA04CF51

Function 00252730 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5958,Windows.Management.Deployment.PackageManager,0000002C,79276D7D,?,?,?,004C5954,003E6017,000000FF), ref: 00252808

Strings

TYL, xrefs: 002527D7
Windows.Management.Deployment.PackageManager, xrefs: 0025275A
PYL, xrefs: 002527E9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: PYL$TYL$Windows.Management.Deployment.PackageManager
API String ID: 4129690577-2446590760
Opcode ID: 7668009fbe83fe502414f452ddf45207f65adf9179048812adf4b8e7c3d617cc
Instruction ID: 33c4824059d83734f66aa43ad38a27b524e996440cd238c606c2a3a821086794
Opcode Fuzzy Hash: 7668009fbe83fe502414f452ddf45207f65adf9179048812adf4b8e7c3d617cc
Instruction Fuzzy Hash: D9319CB191021AEBDB00DF94C845BEEFBB4FB05715F50416AE814AB2C0DBB46B58CBD5

Function 00272211 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5A80,Windows.UI.Xaml.Controls.Image,0000001E,79276D7D), ref: 002722E8

Strings

Windows.UI.Xaml.Controls.Image, xrefs: 0027223A
|ZL, xrefs: 002722B7
xZL, xrefs: 002722C9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Controls.Image$xZL$|ZL
API String ID: 4129690577-4143579661
Opcode ID: af3816bb80e25002865aa92ae9af444bc3b0beebde0429adb7199a6ea9bd9793
Instruction ID: 111879aebcd5c30d0afee310dabf4bdb11890c5a47a6e2ee7bfe90beb8ed3a32
Opcode Fuzzy Hash: af3816bb80e25002865aa92ae9af444bc3b0beebde0429adb7199a6ea9bd9793
Instruction Fuzzy Hash: FE318B7191021AEBDB00DFA9C845BEEBBB4FB14314F10426AE81467280DBB56A48CBD1

Function 00284A00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5B70,Windows.Foundation.PropertyValue,00000020,79276D7D,00000000,00000000), ref: 00284AD6

Strings

h[L, xrefs: 00284AB7
Windows.Foundation.PropertyValue, xrefs: 00284A2A
l[L, xrefs: 00284AA5

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.Foundation.PropertyValue$h[L$l[L
API String ID: 4129690577-2382600991
Opcode ID: 2dfeb36242e1b73c76c54ce89e275051bdf24eeefdeae0aadb393c35ee46b836
Instruction ID: b219a2f73119a87b89bc413afc9af893fb805e5bf504a766c37b9795536103c1
Opcode Fuzzy Hash: 2dfeb36242e1b73c76c54ce89e275051bdf24eeefdeae0aadb393c35ee46b836
Instruction Fuzzy Hash: 29318B75D1121AEBDB05EFA4C855BAEFBB4FB04714F20406AE8116B2C0DBB46A48CBD5

Function 00299A20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5B70,Windows.Foundation.PropertyValue,00000020,79276D7D,?,?), ref: 00299AF6

Strings

Windows.Foundation.PropertyValue, xrefs: 00299A4A
l[L, xrefs: 00299AC5
h[L, xrefs: 00299AD7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.Foundation.PropertyValue$h[L$l[L
API String ID: 4129690577-2382600991
Opcode ID: 967463709c53cf394d9081c45802c9e3bf5561adfd349add2a876ac06f4ef3a4
Instruction ID: 0cfc2b097a3d6e48012b5435b9f4548c7fe706792ea82da66cc5e54745539ef5
Opcode Fuzzy Hash: 967463709c53cf394d9081c45802c9e3bf5561adfd349add2a876ac06f4ef3a4
Instruction Fuzzy Hash: 7A319C71D1121AEBDB04DFA8C845BEEFBB4FB44714F14402EE81167280DBB46A88CBD5

Function 00236560 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

VariantClear.OLEAUT32 ref: 00236603

Strings

}m'y, xrefs: 002365A7
}m'y, xrefs: 0023657B, 002365F9, 00236609
}m'y, xrefs: 00236570

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$ClearHeapProcessVariant
String ID: }m'y$}m'y$}m'y
API String ID: 1301896575-414442922
Opcode ID: 38800c5dedea4cab9f42085c9f074eebabd75e54d04ca81cae77642d73c5dd26
Instruction ID: 09e5f88336773bd0799e1d90fb586deb86110b808c5efab4407e377ea5aa5135
Opcode Fuzzy Hash: 38800c5dedea4cab9f42085c9f074eebabd75e54d04ca81cae77642d73c5dd26
Instruction Fuzzy Hash: AC119471A04658FFC715DF58DC01BAAB7A8EB04720F00476EFC25D7790DB7599108B94

Function 00352140 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,0035029A,?,79276D7D,?,?,?,000000FF,?), ref: 00352154
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0035029A,?,79276D7D,?,?,?,000000FF,?,0034FC64), ref: 00352171
GetLastError.KERNEL32(?,79276D7D,?,?,?,000000FF,?,0034FC64,?,?,00000000,00000000,79276D7D,?,?), ref: 003521D0

Strings

AdvancedInstaller, xrefs: 003521B7

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: d5ebf7bbeaa9e3fd1633569db45d45ca5743368c0c65e107a741172e669dbeba
Instruction ID: 04470ae13a89c04133e3efccc4ddd18655464c04f3e1a04caa003941fd6a6b34
Opcode Fuzzy Hash: d5ebf7bbeaa9e3fd1633569db45d45ca5743368c0c65e107a741172e669dbeba
Instruction Fuzzy Hash: FF11B131340602BBD715CB21DD89F17F7A4BB45701F124428FA019B690CB70F955CBA4

Function 00229E50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00229EA5
__Init_thread_footer.LIBCMT ref: 00229ED7

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

__Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

Strings

}m'y, xrefs: 00229E6A, 00229F6F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionHeapProcessVariableWake
String ID: }m'y
API String ID: 3269001908-184714451
Opcode ID: c9d23a6836e3176d58f2008c3a5ae40b54989d7148e0255359fb449cd1c3fa36
Instruction ID: c96d0f3ccd598fe1fa8c7f47811dd8fd8b4e24757379e5aad4de4f31dde1c3ae
Opcode Fuzzy Hash: c9d23a6836e3176d58f2008c3a5ae40b54989d7148e0255359fb449cd1c3fa36
Instruction Fuzzy Hash: 5221DEF0901B09EBC390DF58ED06F9D77A4E749734F508AAAE4248B6D0C7787A808B59

Function 002795E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 0027962E
DestroyWindow.USER32(?), ref: 0027966A

Strings

Eg', xrefs: 00279602, 00279682
Eg', xrefs: 00279670

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Destroy
String ID: Eg'$Eg'
API String ID: 3707531092-1006138911
Opcode ID: 551cff7db94402bd3a6bb7c16229d465cf5300b16463ef03791646ead1ad1c34
Instruction ID: 4905bcd5cabccd4190459f4098b2283374492f96345ef875c70b5cee607d0d59
Opcode Fuzzy Hash: 551cff7db94402bd3a6bb7c16229d465cf5300b16463ef03791646ead1ad1c34
Instruction Fuzzy Hash: 1021DE30904389EFCB11CF68C904B9DFBF8EB44710F10826AE42997291CBB5AA54CB94

Function 003029C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(46030080,RichEdit20W,?,00000000,46030080,80000000,00000000,00000000,00000000,00000000,00000000), ref: 00302A0B
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00302A23
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00302A2B

Part of subcall function 00230DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00230DE6

Strings

RichEdit20W, xrefs: 00302A02

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSendWindow$CreateLong
String ID: RichEdit20W
API String ID: 4015368215-4173859555
Opcode ID: 77de2f817ac164037ca7decb877e8b625a52d350bde79daef7151e7069ddd98c
Instruction ID: 35ab9febd87c65979b3964ab6d703d705c0a56c97dc7758d62f757fb46932aad
Opcode Fuzzy Hash: 77de2f817ac164037ca7decb877e8b625a52d350bde79daef7151e7069ddd98c
Instruction Fuzzy Hash: 10015735305210BFD6149B15DD04F6BFBE9FBC9760F15821AFA08A72A0C6B1AC00CAA5

Function 00284830 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00284881
GetParent.USER32(?), ref: 0028488A
SendMessageW.USER32(?,00000411,00000000,?), ref: 0028489F

Strings

,, xrefs: 00284879

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Parent$MessageSend
String ID: ,
API String ID: 2251359880-3772416878
Opcode ID: e2e144afde4bcac23311ea09c9261c0092f15b3d8fbf3807ab74db91bcdc97f1
Instruction ID: 138303fba914710aa28f5cfeeee6d35bb7c371211448d24a877090101c54d940
Opcode Fuzzy Hash: e2e144afde4bcac23311ea09c9261c0092f15b3d8fbf3807ab74db91bcdc97f1
Instruction Fuzzy Hash: C011C071525302AFD710EF18DC44B1AFBF4FB89300F00492AF61482690D7B1E824CF96

Function 0022EFA0 Relevance: 6.3, APIs: 4, Instructions: 271memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 0022F06A
SysFreeString.OLEAUT32(00000000), ref: 0022F0B6
SysFreeString.OLEAUT32(00000000), ref: 0022F0D8
SysFreeString.OLEAUT32(00000000), ref: 0022F233

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: a6bf831678164a14db2777f144a7a8b98e757ccdcc738e004acc316b54037dd0
Instruction ID: de4c92dab2ce697619307b099f4942bda60ff0a4925de4c0431db1e8c63b1c1f
Opcode Fuzzy Hash: a6bf831678164a14db2777f144a7a8b98e757ccdcc738e004acc316b54037dd0
Instruction Fuzzy Hash: 18A19F71A1021AEFDB54CFA8DD44BAEB7B8EF44714F104239E919E7380DB74AA11CB61

Function 00243E70 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00243ECD
VariantClear.OLEAUT32(?), ref: 00243EFF
VariantClear.OLEAUT32(?), ref: 00244117
VariantClear.OLEAUT32(?), ref: 00244146

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4c4580775849e79c435f553613ff1c9bf173082fff6c68fcc51d73616312cacc
Instruction ID: 9d52c6738fdb1063e48297c774b3cf8124a05c347050c6047f1db0a4b377d38d
Opcode Fuzzy Hash: 4c4580775849e79c435f553613ff1c9bf173082fff6c68fcc51d73616312cacc
Instruction Fuzzy Hash: C0A18974910219DFCB14DFA8C884B9EBBB4FF48300F258269E408E7391E7749A55CB91

Function 00242F00 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00242F5A
VariantClear.OLEAUT32(?), ref: 00242F8C
VariantClear.OLEAUT32(?), ref: 002430F5
VariantClear.OLEAUT32(?), ref: 00243124

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 3d90ca7fda713637dc76565a8a60b9980c8cd7df76b341ab09b75344f221e95b
Instruction ID: e800d035a0d1ab73b9352c5ddd080e0ad25f88cb798839e22e5b137935856a85
Opcode Fuzzy Hash: 3d90ca7fda713637dc76565a8a60b9980c8cd7df76b341ab09b75344f221e95b
Instruction Fuzzy Hash: A581C130A10348DFDB14DFA8C944B9EFBB4EF44700F148269E818AB391E774AE49CB91

Function 00234650 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 002346F0
SysFreeString.OLEAUT32(00000000), ref: 00234731

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 7100c687682af77e892601ddf170c1299b86d34367cb962540a24ae9b3e3638d
Instruction ID: 77525a9909331e1013a9f081668e989a2bc37af238aa105ea18fa70b5b228309
Opcode Fuzzy Hash: 7100c687682af77e892601ddf170c1299b86d34367cb962540a24ae9b3e3638d
Instruction Fuzzy Hash: 8A61A372A04259EFDB10DF54D944B9ABBB8FB85720F1042AAFC1597390D776ED20CBA0

Function 00254140 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,79276D7D), ref: 00254209
HeapFree.KERNEL32(00000000,?,?,79276D7D), ref: 0025420F

Strings

tYL, xrefs: 00254165
tYL, xrefs: 00254221

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: tYL$tYL
API String ID: 3859560861-1534252146
Opcode ID: 11aeec09f9676ddcdd9ecc5ccee6ec296e1f7fefc58644acfc59532fa8159a91
Instruction ID: 78d3510e74d372019d854c40deb385d9f7504317c6daf2310558e7ee4a3e062a
Opcode Fuzzy Hash: 11aeec09f9676ddcdd9ecc5ccee6ec296e1f7fefc58644acfc59532fa8159a91
Instruction Fuzzy Hash: 1F313731A14614DBCB12EF69DC00BEAF7A8EB41739F10432AFD25CB6C0D739995486A4

Function 0023CCF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(79276D7D,79276D7D,?), ref: 0023CD2F
EnterCriticalSection.KERNEL32(?,79276D7D,?), ref: 0023CD3C
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 0023CE13

Strings

rw, xrefs: 0023CE13

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: rw
API String ID: 3991485460-1192573183
Opcode ID: 359cf1cb0fbccacee3a6301e5816dac231d151a6cae6842f6a16f633b095fe5e
Instruction ID: 7702a842d5527694c4ba01817f9af7156ff9b0ba5cd676060b34130bdfa578b5
Opcode Fuzzy Hash: 359cf1cb0fbccacee3a6301e5816dac231d151a6cae6842f6a16f633b095fe5e
Instruction Fuzzy Hash: 8041D6B52147468FCB26DF38C840BAABBB5EF45310F204579F996E7391CB31A925CB90

Function 0033C6B0 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,?,00000000,00000000), ref: 0033C70F
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 0033C71C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 0033C739
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0033C75B

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 470a920d5d25b1cba88960c5bf1bc39fae1f61f3d22f8b5e275411b16d28218c
Instruction ID: 565736790137e786173b4363e1d7dd8df98656126bf261dd849156b9122cd40e
Opcode Fuzzy Hash: 470a920d5d25b1cba88960c5bf1bc39fae1f61f3d22f8b5e275411b16d28218c
Instruction Fuzzy Hash: 022122B67803067BE7215F54ECD2F6AB75DEB90B04F250129FA01AB1C0EBA17D158BA4

Function 0027642D Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000010,?,00000060), ref: 00276467
GetWindowRect.USER32(?,?), ref: 002764B6
GetWindowLongW.USER32(?,000000EC), ref: 002764DF
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,?,00000060), ref: 00276571

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$LongRect
String ID:
API String ID: 463821813-0
Opcode ID: 5ebeabeb83306730ded0b5af3a4f839ceacda58499d007ff45896fc3873664bc
Instruction ID: 86155174c2147630698a322e3544c9c93506e2748ee6d015058d12fcd2801f92
Opcode Fuzzy Hash: 5ebeabeb83306730ded0b5af3a4f839ceacda58499d007ff45896fc3873664bc
Instruction Fuzzy Hash: A4415E71108745AFC305CF69DD55E6AFBB4FF89300F148A2AF98593260D771A894CF85

Function 00325170 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,80004005,80004005,?,?,?,00000000,0041A8AD,000000FF), ref: 00325188
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,80004005,80004005,?,?,?,00000000,0041A8AD,000000FF), ref: 003251BB
GetStdHandle.KERNEL32(000000F5,?,79276D7D,00000000,003DD840,000000FF,?,80070057,?,-00000001,?,?,80004005,80004005,?,?), ref: 00325226
SetConsoleTextAttribute.KERNEL32(00000000,?,79276D7D,00000000,003DD840,000000FF,?,80070057,?,-00000001,?,?,80004005,80004005,?,?), ref: 0032522D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ByteCharMultiWide$AttributeConsoleHandleText
String ID:
API String ID: 3849414675-0
Opcode ID: 21f2969ca1fbe9f3c6f6f8453ddce5b368f1c7f2a1f27a88bf6b90ffad9176d1
Instruction ID: 1612e1e8c50ca7aa9b0e080fcf5c1e2edef42a739e805ad75b6b8e289b1ac9a1
Opcode Fuzzy Hash: 21f2969ca1fbe9f3c6f6f8453ddce5b368f1c7f2a1f27a88bf6b90ffad9176d1
Instruction Fuzzy Hash: AC21F632304611AFDA10DF98EC89F5AF769EB85720F20432EF625DB3D0CB3169118BA4

Function 002798E0 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 0027996F
GetParent.USER32(00000000), ref: 00279977
GetParent.USER32(00000000), ref: 0027997C
SendMessageW.USER32(00000000,0000037F,00000000,?), ref: 0027998D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: 6ee25229495da29a68b815525221698402272dda23528da8f49fc14e47f71521
Instruction ID: b556a042f45f8fb1f0c10adfa573196c2d052d381406217c359dc11cf86d7df5
Opcode Fuzzy Hash: 6ee25229495da29a68b815525221698402272dda23528da8f49fc14e47f71521
Instruction Fuzzy Hash: 6E21D732210216AFE7159B28EC84FAEF7ACEF91754F148539F609C2150EB31DDA1CA69

Function 002389D0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000FC,00000000), ref: 00238A19
GetParent.USER32(?), ref: 00238A4D

Part of subcall function 003B5D0D: GetProcessHeap.KERNEL32(00000008,00000008,?,00230DC7,?,?,00230B74,?), ref: 003B5D12
Part of subcall function 003B5D0D: HeapAlloc.KERNEL32(00000000,?,?,00230B74,?), ref: 003B5D19

SetWindowLongW.USER32(?,000000EB), ref: 00238A80
ShowWindow.USER32(?,00000000), ref: 00238A96

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$HeapLong$AllocParentProcessShow
String ID:
API String ID: 78937335-0
Opcode ID: 0765b1c791680a416a3769137c3b8c838bf670c1ae346e91f9254b53b0b57b74
Instruction ID: cc640b7999b302c0588a0cddf50b55549e43359d0413fc8b453066ea1910cff8
Opcode Fuzzy Hash: 0765b1c791680a416a3769137c3b8c838bf670c1ae346e91f9254b53b0b57b74
Instruction Fuzzy Hash: 8121BF70604B019FC724EF29D944E6BBBE8FF89714B004A2EF496C6661DB30E804CB61

Function 0023CB20 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,79276D7D), ref: 0023CB8A
EnterCriticalSection.KERNEL32(?,79276D7D), ref: 0023CB97
LeaveCriticalSection.KERNEL32(?), ref: 0023CBE8

Strings

rw, xrefs: 0023CBE8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: rw
API String ID: 3991485460-1192573183
Opcode ID: 401b38079ca21856d0e160739a6cb016bde821fba31a9d011849ac5a22fbbfd8
Instruction ID: 4ee2c808cc3c0b1db742296f8e3266c529355e9989a13ffa36d8c40c2a79983f
Opcode Fuzzy Hash: 401b38079ca21856d0e160739a6cb016bde821fba31a9d011849ac5a22fbbfd8
Instruction Fuzzy Hash: 9121D1729003459FDF11DF24D845BEABBB4EB16328F2005B9EC59AB382D7325909CB60

Function 0023CC10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,79276D7D), ref: 0023CC7A
EnterCriticalSection.KERNEL32(?,79276D7D), ref: 0023CC87
LeaveCriticalSection.KERNEL32(?), ref: 0023CCCE

Strings

rw, xrefs: 0023CCCE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: rw
API String ID: 3991485460-1192573183
Opcode ID: 939cef17cab645e225bf7353ae8c0a1ec41e47eb02162a37f2728249b6727f33
Instruction ID: d90eaaf1d0263080935d744b2ad1051572a8532b98e3cf7e85b1ca75ee42b7d0
Opcode Fuzzy Hash: 939cef17cab645e225bf7353ae8c0a1ec41e47eb02162a37f2728249b6727f33
Instruction Fuzzy Hash: 6D21B2719002459FDB11CF24D844BE9BBB4FF15324F2006BAEC59AB292D7319909CBA0

Function 00285D40 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(}m'y,79276D7D), ref: 00285D80
LeaveCriticalSection.KERNEL32(?), ref: 00285DB1

Strings

}m'y, xrefs: 00285D7D
rw, xrefs: 00285DB1

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: rw$}m'y
API String ID: 3168844106-2181794445
Opcode ID: c833a687ab3db55ced60246e3373132543df5216dfbeccca42668ed02d7254e4
Instruction ID: beef0cab9fa14229fefefed2524130d45680c3cce4e29b4177dfa30ef958e74f
Opcode Fuzzy Hash: c833a687ab3db55ced60246e3373132543df5216dfbeccca42668ed02d7254e4
Instruction Fuzzy Hash: F5212135A15625DFDB15DF18C948BAEBBB4FB05324F204269F821A72D0C371AD248BA0

Function 0023CA60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,79276D7D,?), ref: 0023CABD
EnterCriticalSection.KERNEL32(?,79276D7D,?), ref: 0023CACA
LeaveCriticalSection.KERNEL32(?), ref: 0023CAF2

Strings

rw, xrefs: 0023CAF2

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: rw
API String ID: 3991485460-1192573183
Opcode ID: e2ae9eb8a276e7207d92b464a18c64afb2b03803d82f4ccb852e4cbca78722e0
Instruction ID: 41a4c6097f0392fb397c2dd6e18f27081674eadf55c5512bf12882b893822cd9
Opcode Fuzzy Hash: e2ae9eb8a276e7207d92b464a18c64afb2b03803d82f4ccb852e4cbca78722e0
Instruction Fuzzy Hash: 1621D3769043499FCF05CF64CC40BEABB74EB56324F2046ADE855A7392DB325A09CBA0

Function 003612C0 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,?,79276D7D,?,?,00000000,003DD670,000000FF,?,003612A8,00000000,80004005,?,004C4C50,?,?), ref: 003612F7
GetExitCodeThread.KERNEL32(00000001,80004005,?,?,00000000,003DD670,000000FF,?,003612A8,00000000), ref: 00361311
TerminateThread.KERNEL32(00000001,00000000,?,?,00000000,003DD670,000000FF,?,003612A8,00000000), ref: 00361329
CloseHandle.KERNEL32(00000001,?,?,00000000,003DD670,000000FF,?,003612A8,00000000,80004005,?,004C4C50,?,?,00343989), ref: 00361332

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: d71a9385dbd4627e6e277954a200844d13cb0e59b6f0320672b46979fe62a6c3
Instruction ID: 72bd1f27c8614b461ec058ce153df8306c2e3e321e79d919457e8d498673c8ee
Opcode Fuzzy Hash: d71a9385dbd4627e6e277954a200844d13cb0e59b6f0320672b46979fe62a6c3
Instruction Fuzzy Hash: 17019E75500705EFCB218F54DD04BA6F7FCFB04720F14862EF82692AA0DB75A804CA58

Function 002BF9D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 255windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 002BFAD1
SendMessageW.USER32(00000000,00000317,?,00000014), ref: 002BFB65

Strings

U2;, xrefs: 002BFC62, 002BFC7F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageRectSendWindow
String ID: U2;
API String ID: 2814762282-3377301532
Opcode ID: 68140c11de25c3fba9adb5fc687e88c36b96880ce0ea23b6804fb0c3bac2db58
Instruction ID: 116bc07cd36b9ff26efc949e1d34101f095500c6df7d3452bf34b940d3f2c69c
Opcode Fuzzy Hash: 68140c11de25c3fba9adb5fc687e88c36b96880ce0ea23b6804fb0c3bac2db58
Instruction Fuzzy Hash: 39B18974A10609DFDB14CFA8CA54B9DFBB4FF48304F18826AE815AB391D770A991CB90

Function 00360320 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

DeleteFileW.KERNEL32(?), ref: 003603FA
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 0036052F

Part of subcall function 0034F280: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,79276D7D,00000001,7686EB20,00000000), ref: 0034F2CF
Part of subcall function 0034F280: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,79276D7D,00000001,7686EB20,00000000), ref: 0034F305

Part of subcall function 0034C7E0: LoadStringW.USER32(000000A1,?,00000514,79276D7D), ref: 0034C836

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 003603AE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: File$DeleteInit_thread_footer$CreateHeapLoadProcessReadString
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 3544038457-3685554107
Opcode ID: 9654b671643dbaa262e6b84d8e48a6c2efbcb7ff1f299e5b235112d0706e0b8e
Instruction ID: 572807d99d2ba39988f22fcc28339ca34d2a02163ac6431a9053041e946adc87
Opcode Fuzzy Hash: 9654b671643dbaa262e6b84d8e48a6c2efbcb7ff1f299e5b235112d0706e0b8e
Instruction Fuzzy Hash: D691D131A006059FDB05DFA8C845B9EBBB5FF45324F1982A9E915DB2A2DB30DD04CF90

Function 00344C40 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32(79276D7D,-00000044,?,-00000048,00000000), ref: 00344C76

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 00344050: GetLocaleInfoW.KERNEL32(?,00000002,0044337C,00000000), ref: 003440C1
Part of subcall function 00344050: GetLocaleInfoW.KERNEL32(?,00000002,00343B85,-00000001,00000078,-00000001), ref: 003440FD

Strings

T`L, xrefs: 00344CFC
SystemDefault LangID=, xrefs: 00344CB8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: InfoInit_thread_footerLocale$DefaultHeapLangProcessSystem
String ID: SystemDefault LangID=$T`L
API String ID: 185108660-2155230632
Opcode ID: 36b501b219b3973b4ef68242681dc05509d62e658b07f86148f3ab6258e223c1
Instruction ID: baa8bfde4a86314b4029ec5916c329c965785f01a99dfd7663bf0dc748e8b8c7
Opcode Fuzzy Hash: 36b501b219b3973b4ef68242681dc05509d62e658b07f86148f3ab6258e223c1
Instruction Fuzzy Hash: EA51BE31A00A159BDB11DF68C845BAAF7F5FF81321F1583A9E8259B2D6DB34AD00CB90

Function 00292AC0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.Grid, xrefs: 00292B69
}m'y, xrefs: 00292ADD, 00292B29

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.Grid$}m'y
API String ID: 0-1336049469
Opcode ID: f217e118cadcefe29e4bbcb62f4c31cc4f77e62e4b63b1305edc3bb33037b7a9
Instruction ID: 57b2f69192694fc95ddd3f74d41335254090b0174cf2c3fd68e1377acb28fd5a
Opcode Fuzzy Hash: f217e118cadcefe29e4bbcb62f4c31cc4f77e62e4b63b1305edc3bb33037b7a9
Instruction Fuzzy Hash: CB61A6B0900609EFDB11DFA4C945BAFBBB8FF08714F10466AE810A7391DB75AA05CF94

Function 0026D130 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 003B6662: EnterCriticalSection.KERNEL32(004C4CD8,?,?,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B666D
Part of subcall function 003B6662: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229EF6,004C5904,79276D7D,?,?,003DDE0D,000000FF,?,0035BABC,79276D7D), ref: 003B66AA

__Init_thread_footer.LIBCMT ref: 0026D28D

Part of subcall function 003B6618: EnterCriticalSection.KERNEL32(004C4CD8,?,?,00229F67,004C5904,00436640), ref: 003B6622
Part of subcall function 003B6618: LeaveCriticalSection.KERNEL32(004C4CD8,?,00229F67,004C5904,00436640), ref: 003B6655
Part of subcall function 003B6618: RtlWakeAllConditionVariable.NTDLL ref: 003B66CC

Strings

Windows.UI.Xaml.Controls.ListViewItem, xrefs: 0026D256
ItemData, xrefs: 0026D2F2

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: ItemData$Windows.UI.Xaml.Controls.ListViewItem
API String ID: 2296764815-2445763458
Opcode ID: 70ba758029971c5bb89b984284560f8bfa6c8fef7e1edfd41bb811e1283a06b5
Instruction ID: 902cc3a6bb5fbbaad762a358b0276622eeb9912da120470e96bacaeaeb588a9e
Opcode Fuzzy Hash: 70ba758029971c5bb89b984284560f8bfa6c8fef7e1edfd41bb811e1283a06b5
Instruction Fuzzy Hash: ED71B570900289EFDB05CF68C915BDEBBB0BF14304F148259E815673D1DBB95A58CFA2

Function 00313C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,79276D7D,00000000,00000000), ref: 00313D11

Strings

\\?\UNC\, xrefs: 00313D3C, 00313D9E
\\?\, xrefs: 00313E0B, 00313E37

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: e457d38334d7f8421301595f31b58c8da52608018f6793662ab521956dd360cd
Instruction ID: da140901bf9890722872ddbf086f93619ab1e3662e9e75aaef90d8ed72e82495
Opcode Fuzzy Hash: e457d38334d7f8421301595f31b58c8da52608018f6793662ab521956dd360cd
Instruction Fuzzy Hash: C751C371E10604DBDB19DF58D885BEEF7B5FF48704F20811DE8016B281DB75AA58CBA1

Function 00358550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,79276D7D,?,?,004C6054), ref: 0035858F
CreateDirectoryW.KERNEL32(?,00000000,?,004C6054), ref: 003585F0

Strings

ADVINST_LOGS, xrefs: 003585C8

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: 1a7556f3f65239f1a9eacec909a575f059ca49fadcc9e5e150eead22e0c9e94e
Instruction ID: 5dbfe3f2538c5c148a9dc401f3b00153a178b8491dfaaf6c8b0718e45aa32f08
Opcode Fuzzy Hash: 1a7556f3f65239f1a9eacec909a575f059ca49fadcc9e5e150eead22e0c9e94e
Instruction Fuzzy Hash: B351D375940219CBCB319F28C844BB6B3B4FF14315F2546AEED49A72A1EF748D89CB90

Function 0035C3A0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,79276D7D,?,00000010,?,?,003DF36E,000000FF), ref: 0035C428

Part of subcall function 00229E50: GetProcessHeap.KERNEL32 ref: 00229EA5
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229ED7
Part of subcall function 00229E50: __Init_thread_footer.LIBCMT ref: 00229F62

Part of subcall function 0035C240: ConnectNamedPipe.KERNEL32(?,00000000,79276D7D,?,000000FF,?,00000000,004262A6,000000FF,?,0035C45A,000000FF,?,00000001), ref: 0035C27A
Part of subcall function 0035C240: GetLastError.KERNEL32(?,0035C45A,000000FF,?,00000001), ref: 0035C284

Strings

}m'y, xrefs: 0035C490
\\.\pipe\ToServer, xrefs: 0035C4E4, 0035C4F5, 0035C4FF

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessWrite
String ID: \\.\pipe\ToServer$}m'y
API String ID: 3549655173-328139405
Opcode ID: f163b118c779f600b6cdc379c204a94b4617091fc833d119cf907119da87196f
Instruction ID: ee28f5e779b3de300e0d2b3fe4a0c77210a1e150e60b648d480775c887cec979
Opcode Fuzzy Hash: f163b118c779f600b6cdc379c204a94b4617091fc833d119cf907119da87196f
Instruction Fuzzy Hash: EC41CD71610214AFDB05CF59D805FAEB7A8EB44728F00826EFC15DB390DBB5A904CB94

Function 002862E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 132COMMON

Download Yara Rule

Strings

}m'y, xrefs: 0028630B, 00286315
Windows.UI.Xaml.Hosting.WindowsXamlManager, xrefs: 0028638A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Hosting.WindowsXamlManager$}m'y
API String ID: 0-4239443272
Opcode ID: 7693f3b8eb9b6d7aeafd59b46d2f1868f741d6899411e9e6984101ad05bfb446
Instruction ID: 2a130ff2cfedc2b05205c4e6cc8e8569ec1240ce4c0ba6917fd80c03d0454f64
Opcode Fuzzy Hash: 7693f3b8eb9b6d7aeafd59b46d2f1868f741d6899411e9e6984101ad05bfb446
Instruction Fuzzy Hash: 795190B5D1121ADBDB00DF98C845BEEFBB4FB04714F10416AE815A7380DBB5AA48CBD5

Function 002729D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

}m'y, xrefs: 00272ADD
Windows.UI.Xaml.Controls.Pivot, xrefs: 00272A7A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.Pivot$}m'y
API String ID: 0-3743839013
Opcode ID: 115a34185b725024b0a89ee6957d0589f02f58c7b9a0fc83ce398fe7321abffe
Instruction ID: 42396115a41b873d1e33b431bafa238cbd4ed8ecb56c9c9f6fc1750c3e8ce4ed
Opcode Fuzzy Hash: 115a34185b725024b0a89ee6957d0589f02f58c7b9a0fc83ce398fe7321abffe
Instruction Fuzzy Hash: 7D519FB1D1061AEBDB00DF99C881BEFBBB4FB04714F20452AE815A7280D7B56A48CBD5

Function 00272C40 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.ListBox, xrefs: 00272CEA
}m'y, xrefs: 00272D4D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ListBox$}m'y
API String ID: 0-3985360200
Opcode ID: 0769e5076cbdc361199698286da546cfbffb9933d716350b7363a3fd20df5d29
Instruction ID: 84af2b1a43e272455c98cfed73ff76d5d65ec7efc89e743b16f3b54c1003ccea
Opcode Fuzzy Hash: 0769e5076cbdc361199698286da546cfbffb9933d716350b7363a3fd20df5d29
Instruction Fuzzy Hash: 97519DB1D1021AEFDB11DF99C841BEEBBB8FB04714F10452AE815A7380D7B56A48CBD5

Function 0025D470 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.ToolTip, xrefs: 0025D51A
}m'y, xrefs: 0025D57D

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ToolTip$}m'y
API String ID: 0-284662525
Opcode ID: f5fed02049416cf5ac8d8088999953a90c2f7a88ed4f531573e76f36883f9cbc
Instruction ID: e50c587df26defe1911a6b849a3e6dcbd1366946df40b844e6e43920cdf9023f
Opcode Fuzzy Hash: f5fed02049416cf5ac8d8088999953a90c2f7a88ed4f531573e76f36883f9cbc
Instruction Fuzzy Hash: EA51B0B1D1021ADBDB10DF98C941BEFBBB8FB04715F10466AE815A7380DB746A48CBD5

Function 002B7480 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

}m'y, xrefs: 002B758D
Windows.UI.Xaml.Controls.RichEditBox, xrefs: 002B752A

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.RichEditBox$}m'y
API String ID: 0-1359917148
Opcode ID: b3b3979a259daa66f2f2f3dc5f568722c0db2d1799b5915651175c910e8206de
Instruction ID: 2863a547784154cc3a03447f199b1a7dc2ca4f6f20dba9ad9127bc2b24964a1e
Opcode Fuzzy Hash: b3b3979a259daa66f2f2f3dc5f568722c0db2d1799b5915651175c910e8206de
Instruction Fuzzy Hash: F751BEB1D1425AEFDB00DF98C945BEEBBB8FB04715F10452AE811A7280D7B46A48CBD5

Function 0025D9F0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.ScalarTransition, xrefs: 0025DA9A
}m'y, xrefs: 0025DAFD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.ScalarTransition$}m'y
API String ID: 0-1493348250
Opcode ID: fedf2196d34f6dc50e1f7d29d6c569c0cb2af5860a99183ff6fab898e96a96e4
Instruction ID: 365ee76cf2c3f6d6cfcc8a0a0e435ed4531cffeebaf95d8e72f92f0ac0a61e7a
Opcode Fuzzy Hash: fedf2196d34f6dc50e1f7d29d6c569c0cb2af5860a99183ff6fab898e96a96e4
Instruction Fuzzy Hash: F251AFB1D1025ADFDB10DF94C841BAEBBB8FB04715F10416AE811A7280D7B56A48CBD5

Function 00237110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,?,00000002,0044337C,00000000,00000000,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033,79276D7D), ref: 00237280

Part of subcall function 0030DDA0: GetModuleHandleW.KERNEL32(Advapi32.dll,79276D7D,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 0030DDE3

CloseHandle.KERNEL32(?,79276D7D), ref: 002372B9

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00237178

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CloseHandle$Module
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current
API String ID: 1412095732-2431777889
Opcode ID: 7336e97a586d687a97163fc6ad5572479f3b95fcd69fcf0e2001fb0128478b16
Instruction ID: cf571694d0a9fd16892dcf9da73c44fca62bd812e1dc4b4d7cee9ead70005abb
Opcode Fuzzy Hash: 7336e97a586d687a97163fc6ad5572479f3b95fcd69fcf0e2001fb0128478b16
Instruction Fuzzy Hash: E4515AB0D14258EAEF20DFA8C859BDEFBB4BF14704F108159E445B7281DBB46A48CFA5

Function 003D2981 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003CDBDD: RtlFreeHeap.NTDLL(00000000,00000000,?,003D221D,?,00000000,?,?,003D24BE,?,00000007,?,?,003D2B18,?,?), ref: 003CDBF3
Part of subcall function 003CDBDD: GetLastError.KERNEL32(?,?,003D221D,?,00000000,?,?,003D24BE,?,00000007,?,?,003D2B18,?,?), ref: 003CDBFE

___free_lconv_mon.LIBCMT ref: 003D29C5

Strings

XK, xrefs: 003D2A6D
pK, xrefs: 003D2997

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: XK$pK
API String ID: 4068849827-1722102153
Opcode ID: 4393700833a176f597537467c0f922dad59ab6a72547fbab1ad680c2f42c71ea
Instruction ID: fcd1aed0022ac9b39051635745a03776dde31851a4fed2f8a2f9862db58808b8
Opcode Fuzzy Hash: 4393700833a176f597537467c0f922dad59ab6a72547fbab1ad680c2f42c71ea
Instruction Fuzzy Hash: 4B3139326007059FEB32AA39E845F5B77E9EF50350F12482AF499DB255DF75EC908B20

Function 00278A90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 00278B02
DestroyWindow.USER32(?), ref: 00278B17

Strings

(0;, xrefs: 00278B0E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DestroySleepWindow
String ID: (0;
API String ID: 3305115879-2807173533
Opcode ID: 5ac1e45aef1b3b527463cce4947be13ffa8d30756e733870dbcb99f509d5d5d9
Instruction ID: 27fcc3eef1a01bae82128ed28e5b14fe5c6ae72d6b58a15fe07d4b250d685ede
Opcode Fuzzy Hash: 5ac1e45aef1b3b527463cce4947be13ffa8d30756e733870dbcb99f509d5d5d9
Instruction Fuzzy Hash: 3E418231A50348EFCB11DF68DC49BDDBBB5BF09700F1441A9E909AB292CB745E04CBA6

Function 003D277F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 003D284F
__freea.LIBCMT ref: 003D285E

Part of subcall function 003CDC17: RtlAllocateHeap.NTDLL(00000000,00000000,003CD0E1,?,003CEE85,?,00000000,?,003BF625,00000000,003CD0E1,?,?,?,?,003CCEDB), ref: 003CDC49

Strings

`&#, xrefs: 003D2781

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AllocateHeapStringType__freea
String ID: `&#
API String ID: 4073780324-3593461860
Opcode ID: 0b4b52f7658b0a5dc8534e963de4939ac9bf8bb39a7a4eb81e88141adfc9982c
Instruction ID: c140448a30adf88a2f3d084d9ab6d8b8e39b6300b882d8315a5e1ef0eafba5ba
Opcode Fuzzy Hash: 0b4b52f7658b0a5dc8534e963de4939ac9bf8bb39a7a4eb81e88141adfc9982c
Instruction Fuzzy Hash: 6E31ED72A0021AABCF229F65EC41EEFBBA8EF54710F05412AF904AB251E635CC51D7A0

Function 003273D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,79276D7D,00459754), ref: 00327428
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00327524

Part of subcall function 00319AC0: std::locale::_Init.LIBCPMT ref: 00319B9D

Part of subcall function 003172B0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00317385

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 00327446

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-3373098694
Opcode ID: a0ded40433861bc1ec7bf4c2c71fa61df8365cbef2d73beda91fc45e8848804d
Instruction ID: d1319d37387ff47f324678463593b331d08b4f47e67e58fdf7127f811f4a7e3a
Opcode Fuzzy Hash: a0ded40433861bc1ec7bf4c2c71fa61df8365cbef2d73beda91fc45e8848804d
Instruction Fuzzy Hash: 9C419070A043199BDB11DF68D909BAFBBF8FF44704F108659E455EB290D7B89A08CB91

Function 00295190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5CC8,Windows.UI.Xaml.Documents.Hyperlink,00000023,79276D7D,00000004,000000FF,?,004C5CC4,003E6017,000000FF), ref: 00295268

Strings

Windows.UI.Xaml.Documents.Hyperlink, xrefs: 002951BA
PT), xrefs: 00295270, 00295278

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: PT)$Windows.UI.Xaml.Documents.Hyperlink
API String ID: 4129690577-2743552777
Opcode ID: 149e7be85c17d4a4eec6adadbc293b19ac68f47b2ee1fadcb0022f2ea572079d
Instruction ID: a71b8e37f78628e0992c0c0a480cf78a81d819474a9c8079f018e96df309fe65
Opcode Fuzzy Hash: 149e7be85c17d4a4eec6adadbc293b19ac68f47b2ee1fadcb0022f2ea572079d
Instruction Fuzzy Hash: 4C316B71E1061AEBDB01DF94C945BAEBBB4FB14715F10416AE8106B3C0DBB96B48CBD1

Function 00372050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000001,_pbl_evt,00000008,?,?,0045A350,00000001,79276D7D,00000000), ref: 003720FE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 0037211B

Strings

_pbl_evt, xrefs: 003720D2

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 9af23868a9d523a3dbe1aa7f6213827150653f3f1027c475cba248f45679db69
Instruction ID: f2070550c4f98cc50ac9de5619625d938ab5771a4ca34e9f7ee845e46b2b3bc9
Opcode Fuzzy Hash: 9af23868a9d523a3dbe1aa7f6213827150653f3f1027c475cba248f45679db69
Instruction Fuzzy Hash: 18318B31D10218EFDB10DFA8D846BDEB7B4EF04714F608229E811B7280DB746A09CFA5

Function 0022E110 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00313430: GetModuleFileNameW.KERNEL32(00000000,?,00000400,79276D7D), ref: 00313479

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,00000000,004BF0E0,80000001,00000001,00000000,?,79276D7D), ref: 0022E1A2
RegCloseKey.ADVAPI32(?,?,00002AF8,004BF0E0,80000001,00000001,00000000,?,79276D7D), ref: 0022E1EA

Strings

}m'y, xrefs: 0022E13B, 0022E15C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CloseFileModuleNameQueryValue
String ID: }m'y
API String ID: 1288538307-184714451
Opcode ID: c817896011b39e9e9870062799218d159a0d317aeea11cbac1550133016ac0f0
Instruction ID: 899aceab924d0a0fc4d1e3af5f3b0bf782b8fef2a38eb14d3614f66531369ba8
Opcode Fuzzy Hash: c817896011b39e9e9870062799218d159a0d317aeea11cbac1550133016ac0f0
Instruction Fuzzy Hash: B6318D30914208EBDF15DFA4DC55BEEB7B8AF14700F108169E419AB2C1DFB46A48CB91

Function 00239710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0023973C
SetWindowPos.USER32(?,00000000,00000000,}m'y,00000000,00000000,00000015,?,?,00000000,?,?,?,?,79276D7D,00000000), ref: 002397BE

Strings

}m'y, xrefs: 0023978C, 00239771, 00239780, 002397AC, 002397B6

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Rect
String ID: }m'y
API String ID: 3200805268-184714451
Opcode ID: be64964e86c05d2cf4b1eea0eb9d0148e0ce8d430897a0be30df0f848cf6d404
Instruction ID: 653bae5aa1c9907129d8eaa3312202b271fd389861e2130fe1ff3cb95306da5d
Opcode Fuzzy Hash: be64964e86c05d2cf4b1eea0eb9d0148e0ce8d430897a0be30df0f848cf6d404
Instruction Fuzzy Hash: AA21ACB1618206AFD714CF28CD85E7BB7EDEBC9710F108529F95487281D770E8148BAA

Function 0022D640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000002), ref: 0022D6CB
IsWindow.USER32(00000002), ref: 0022D6E2

Strings

H?D, xrefs: 0022D681

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window
String ID: H?D
API String ID: 2353593579-2829560543
Opcode ID: b87c0d044d1e8172d3c38e6c1473b8f02b89692c3d80440dbc27de0bd10966c0
Instruction ID: d1c5f7c48952eeea2534b59a63c45c80dadb9e2885ca8313a3921d08140cf662
Opcode Fuzzy Hash: b87c0d044d1e8172d3c38e6c1473b8f02b89692c3d80440dbc27de0bd10966c0
Instruction Fuzzy Hash: FC217C30610701AFCB24DFA5E955F6BB7B9EF44B10F048A2DE42A87AA0CB35E814CB50

Function 00316870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0031689B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003168FE

Strings

bad locale name, xrefs: 00316921

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: ec176131485312f17158d43d36cdefe22d80264d5dd8beb36b63474b70ee144f
Instruction ID: 093c8d6dc871a2e2dc425043c441639d539ad0e6cad23984c471536aeeed2771
Opcode Fuzzy Hash: ec176131485312f17158d43d36cdefe22d80264d5dd8beb36b63474b70ee144f
Instruction Fuzzy Hash: 1D210270504784DFD721CF69C80079ABFF4AF15704F14869EE4858BB81D7B6DA04C791

Function 002C80F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 002C813A
DestroyWindow.USER32(00000000,?,?,?), ref: 002C8147

Strings

{D, xrefs: 002C81BB

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Destroy
String ID: {D
API String ID: 3707531092-1498132776
Opcode ID: 90a496fe722cc34cacb2f153f90c01c2fad5708aa249eb1e24dae6fa941f133f
Instruction ID: 876d8f917aa9353a8d1b215db33572952e45d21bb97b31052d0fde074a66018a
Opcode Fuzzy Hash: 90a496fe722cc34cacb2f153f90c01c2fad5708aa249eb1e24dae6fa941f133f
Instruction Fuzzy Hash: 5A31BC70809689EFCB00DFA5C904B8EFBF4BF10314F1082A9E45497AD1CBB4AA18CB95

Function 00229190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 003B5A3D: EnterCriticalSection.KERNEL32(004C4C5C,00000001,?,?,002291C7,00000000,79276D7D,00000001,?,?,?,-00000010,003DDD00,000000FF,?,002293A0), ref: 003B5A48
Part of subcall function 003B5A3D: LeaveCriticalSection.KERNEL32(004C4C5C,?,002291C7,00000000,79276D7D,00000001,?,?,?,-00000010,003DDD00,000000FF,?,002293A0,?,00000001), ref: 003B5A74

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,79276D7D,00000001,?,?,?,-00000010,003DDD00,000000FF,?,002293A0,?), ref: 002291E6

Part of subcall function 00229250: LoadResource.KERNEL32(00000000,00000000,79276D7D,00000001,00000000,?,00000000,003DD610,000000FF,?,002291FC,?,?,?,-00000010,003DDD00), ref: 0022927B
Part of subcall function 00229250: LockResource.KERNEL32(00000000,?,002291FC,?,?,?,-00000010,003DDD00,000000FF,?,002293A0,?,00000001,?,002369F0,-00000010), ref: 00229286
Part of subcall function 00229250: SizeofResource.KERNEL32(00000000,00000000,?,002291FC,?,?,?,-00000010,003DDD00,000000FF,?,002293A0,?,00000001,?,002369F0), ref: 00229294

Strings

HLL, xrefs: 002291BD
HLL, xrefs: 00229204

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID: HLL$HLL
API String ID: 529824247-2104390300
Opcode ID: 557001dd7f2f805e10224da571a7a8d148bb389c774aee3c3fcabca6484f7cfb
Instruction ID: 87e56e87dbdf2796286f0cbe90ecd6523bb3c065b7eff7d4605da70e48091a56
Opcode Fuzzy Hash: 557001dd7f2f805e10224da571a7a8d148bb389c774aee3c3fcabca6484f7cfb
Instruction Fuzzy Hash: 72110836B04624ABD7254F59AC81B7AB3D8E784764F00027EED09D7380EB759C104690

Function 004366F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,79276D7D,?,?,?,?,?,003DE74D,000000FF), ref: 0043673C

Strings

,bL, xrefs: 0043674B
8bL, xrefs: 00436759

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: DirectoryRemove
String ID: ,bL$8bL
API String ID: 597925465-1623662416
Opcode ID: f70fa359359dbd83c2bbbd5fb3fae2cafb927139c455d49eaf9584a627ecc5c4
Instruction ID: 4300864b8b106c05ef9aef6d4c0a0ebfd69aa59ddc390646d24cb73d1635f47d
Opcode Fuzzy Hash: f70fa359359dbd83c2bbbd5fb3fae2cafb927139c455d49eaf9584a627ecc5c4
Instruction Fuzzy Hash: 9011A071900604EBC711EF48DC41B5AF7B8FB49720F61877AE464A7290D7756D008BA4

Function 00241200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetParent.USER32(00000005), ref: 00241274

Strings

C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00241249
d, xrefs: 00241240

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3357045315
Opcode ID: 2c99552884055c628e4163b7031e82bec71bbe77137ae93e184427951e0e52e8
Instruction ID: 57594c8354e3f4a8d03a0b13a58a6c03bf0b83ca8f7eb2b70811ce06c3d34953
Opcode Fuzzy Hash: 2c99552884055c628e4163b7031e82bec71bbe77137ae93e184427951e0e52e8
Instruction Fuzzy Hash: 03213874D15298EFDF04CFE4D958BCDBBB1BF18308F248098E401AB295D7B95A08CB91

Function 0022D329 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0022D39A

Strings

d, xrefs: 0022D369
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 0022D375

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: a37144e6cd046763ab35164a692ca380fc7502a59336e76b77bb2721a434c8e3
Instruction ID: 7d5dacfd689792f982ae9de2a366467fb6639d5c5a905274fd21dae3975a8c54
Opcode Fuzzy Hash: a37144e6cd046763ab35164a692ca380fc7502a59336e76b77bb2721a434c8e3
Instruction Fuzzy Hash: 0A213674D15298EFDB05DFE4D898BCDBBB1BF18304F248099E401AB295DBB95A08CF81

Function 0022CF5D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0022CFCB

Strings

d, xrefs: 0022CF9D
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 0022CFA6

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: e3389407cdc278ba45cbf3c953b32422de4aacf2afac430a7ae5df1b20000c53
Instruction ID: 5daad7bc212b6c1d5f9e8df446a181040f6b78c350660cb52e0361542e0f56f3
Opcode Fuzzy Hash: e3389407cdc278ba45cbf3c953b32422de4aacf2afac430a7ae5df1b20000c53
Instruction Fuzzy Hash: DC214774D15298EFDB05CFE0D8587CDBBB1BF18308F148099E401AB291DBB95A08CB91

Function 002412CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000D), ref: 0024133B

Strings

C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 0024130E
d, xrefs: 00241305

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3357045315
Opcode ID: 484b43182bb1a478d42839178179eee52213c8a984b402808c623ca3e025b260
Instruction ID: 05e4ca5021ddee312ad8f02392a9eb378050344a9e9ae7eb0db7bd2bb234a403
Opcode Fuzzy Hash: 484b43182bb1a478d42839178179eee52213c8a984b402808c623ca3e025b260
Instruction Fuzzy Hash: 31211374D15298EFDB04CFE0D958BCDBFB1BF18308F248099E401AB292D7B95A08CB51

Function 0022D3F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0022D460

Strings

d, xrefs: 0022D42D
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 0022D439

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 82bfa770c119477f49137c0875293be1bea71dee9c18dbe28d90c5d21ab148ed
Instruction ID: 90c695f32bb926ab5a886ef4c6d666382c9592f2705f21d59188055d4acb7f0b
Opcode Fuzzy Hash: 82bfa770c119477f49137c0875293be1bea71dee9c18dbe28d90c5d21ab148ed
Instruction Fuzzy Hash: D7214434D15298EEDB05DFE0D9987CDBBB1BF18308F208059E401AB286DBB95A08CF41

Function 0022D021 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0022D08C

Strings

d, xrefs: 0022D05C
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 0022D065

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 2957f3d1068a11be0e2b97ac8cd88f908e61be496f671b5699d46c041de6d8e2
Instruction ID: 886885604deb83ff5823c81609352371c7732354e969c7b245bafab7a4a65ff5
Opcode Fuzzy Hash: 2957f3d1068a11be0e2b97ac8cd88f908e61be496f671b5699d46c041de6d8e2
Instruction Fuzzy Hash: 1A211274D15298EEDB05CFE0D9987CDBBB1BF18308F248099E401AB296DBB95A08CB55

Function 002812B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0028130F
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,0027FDEC,00000000,79276D7D,?,?), ref: 00281328

Strings

tooltips_class32, xrefs: 00281306

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Window$Create
String ID: tooltips_class32
API String ID: 870168347-1918224756
Opcode ID: 5cba48e81555b759539cf7b147c85ce6a4bc717041bc0d71f3743c88ecbeb1cd
Instruction ID: d1d25121e303ce6fa18514999810c0c9cef520df23386d13a875ed3f64330ddb
Opcode Fuzzy Hash: 5cba48e81555b759539cf7b147c85ce6a4bc717041bc0d71f3743c88ecbeb1cd
Instruction Fuzzy Hash: 27012B313D12127EF7644664DD1AFE13298D780B41F348339BB40FD0D0D6A6E921C60C

Function 00282130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000411,00000000,0000002C), ref: 00282192

Strings

,, xrefs: 00282162
}m'y, xrefs: 0028213E

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: MessageSend
String ID: ,$}m'y
API String ID: 3850602802-3752572645
Opcode ID: 279f74f12c28fda69e6245b0f87178524e6c9e0ed15cb8fc3c3a8aabcd7ef5cb
Instruction ID: 4e1acd0fe77eaa1a82fe090bb80196b37a016e1df052e7d3ff4ae4b773b06c85
Opcode Fuzzy Hash: 279f74f12c28fda69e6245b0f87178524e6c9e0ed15cb8fc3c3a8aabcd7ef5cb
Instruction Fuzzy Hash: E2017C74615341DFE318DF29C855B9AB7E0AB88300F448A2EA989C7291DBB4E808CB81

Function 00241391 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000013), ref: 002413C4

Strings

C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 002413A9
Unknown exception, xrefs: 00241399

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-2259502730
Opcode ID: 39fbec301e8ae75793f31d6de19e5deaad62fdf108d56a44077aa0e37ea19597
Instruction ID: 46c586b15bac04b1509c00adf819397f13652b972c02d650fac6b435e64a1600
Opcode Fuzzy Hash: 39fbec301e8ae75793f31d6de19e5deaad62fdf108d56a44077aa0e37ea19597
Instruction Fuzzy Hash: 4D01C034D05288EFDF04DBE4C914ACDBFB0AF19300F648098E0016B392CBB55E08DB91

Function 0022D4B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0022D4E8

Strings

Unknown exception, xrefs: 0022D4C0
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 0022D4D3

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-452454139
Opcode ID: 45e43d279514a60c66cfab6802ae62bbb0c71d2df672fde6be1c718f19a5a101
Instruction ID: b1b6385b426d51b72dfbb5bd67ea921278174112ab0a09643d1842218ba5d14e
Opcode Fuzzy Hash: 45e43d279514a60c66cfab6802ae62bbb0c71d2df672fde6be1c718f19a5a101
Instruction Fuzzy Hash: 24019234D0529CEBDF05EBE4D9156CDBBB16F59300F248198D4016B386DBB45B08DB92

Function 0022D0E2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0022D10F

Strings

Unknown exception, xrefs: 0022D0EA
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 0022D0FA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-452454139
Opcode ID: 7d24f2158d52b671d74647b945c41fcfffa6e634115036af641b2c4d97bc435c
Instruction ID: b8bdbfd952692974b902e604f7e73e9c140c8f2912a8a4132f9908bfc520f8d1
Opcode Fuzzy Hash: 7d24f2158d52b671d74647b945c41fcfffa6e634115036af641b2c4d97bc435c
Instruction Fuzzy Hash: B601F134D0529CEBDF01DBE4D9186CDBFB1AF59300F208098E0016B382DBB44B08DB92

Function 0028BE85 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(004C5968,004C5C48), ref: 0028BEB6

Strings

@\L, xrefs: 0028BE97
D\L, xrefs: 0028BE85

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: @\L$D\L
API String ID: 4129690577-244307285
Opcode ID: 15ee2aa6fff45343d7911e4c8b5e176d0bdf6e6dae8df858d942436b2c033e1b
Instruction ID: 6423a4df20fc6e71e31eda7e0bf37db3d410f48b9de3a7f00583364f4a95f6eb
Opcode Fuzzy Hash: 15ee2aa6fff45343d7911e4c8b5e176d0bdf6e6dae8df858d942436b2c033e1b
Instruction Fuzzy Hash: 3401DF39A01709DACB06DFA4D841FBEB7B0EB44311F20446FD8006B380CB782A41CB84

Function 00236620 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00236629
SysAllocString.OLEAUT32(}m'y), ref: 0023663F

Strings

}m'y, xrefs: 00236633

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AllocClearStringVariant
String ID: }m'y
API String ID: 1959693985-184714451
Opcode ID: 512e4bc91e1236484d427e353757f8e02402b17be83b7cad62b0bdf3f5eb02f2
Instruction ID: ee188f7145b0f2b5ca25726f04a4a6af804a13760bef2513d98d8a3843cce53a
Opcode Fuzzy Hash: 512e4bc91e1236484d427e353757f8e02402b17be83b7cad62b0bdf3f5eb02f2
Instruction Fuzzy Hash: 76F0C074720357A7DB205F74D81964AB6DCEF50395F10C82FEA85E7220E675C4908B9D

Function 003D2DAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,?,?,?,00000104), ref: 003D2DD7
GetACP.KERNEL32(00000000,?,?,?,00000104), ref: 003D2DEE

Strings

`&#, xrefs: 003D2DAE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID:
String ID: `&#
API String ID: 0-3593461860
Opcode ID: f510d634c80a6b5ac4bd9196d6841ac790787e194b2f452ba55cb5e7869de996
Instruction ID: 5b5cd1023a4c2a79d1b18d19cf406034f73ab75035fceba96922bfb3c80d8040
Opcode Fuzzy Hash: f510d634c80a6b5ac4bd9196d6841ac790787e194b2f452ba55cb5e7869de996
Instruction Fuzzy Hash: 00F06231400A04CFD711EB68E848B6E77B4BB10339F940369E535CA6E1D7715DA5CB94

Function 003B598C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00233650: InitializeCriticalSectionAndSpinCount.KERNEL32(004C4C5C,00000000,79276D7D,00220000,Function_001BD840,000000FF,?,003B59BB,?,?,?,00226438), ref: 00233675
Part of subcall function 00233650: GetLastError.KERNEL32(?,003B59BB,?,?,?,00226438), ref: 0023367F

IsDebuggerPresent.KERNEL32(?,?,?,00226438), ref: 003B59BF
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00226438), ref: 003B59CE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 003B59C9

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: b07da1e6a4a8de8dc5cac3d9d36092f3e7ba23b67cbfc49a0f97680c4522fb5c
Instruction ID: 7a8a51f44fdad77a08c573e2b7069dcb4ade5e474fd8f9320016a845d375a697
Opcode Fuzzy Hash: b07da1e6a4a8de8dc5cac3d9d36092f3e7ba23b67cbfc49a0f97680c4522fb5c
Instruction Fuzzy Hash: ACE09270200B10CFD3A1AF34E405782BAE4AF08318F11886EE586C6A80DBF4E944CF95

Function 003B33FD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B33E0

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

3;, xrefs: 003B33DA
XCL, xrefs: 003B33FD

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: XCL$3;
API String ID: 1269201914-4034168182
Opcode ID: 70972c4ff468167647b8e0b853aac2cb102d7c5ee168ff6fe9b7ce1e275e7468
Instruction ID: 3ee7615cfd6c1de3bb04529c394504b61d21577b6524c5e1b6cda079aecd5266
Opcode Fuzzy Hash: 70972c4ff468167647b8e0b853aac2cb102d7c5ee168ff6fe9b7ce1e275e7468
Instruction Fuzzy Hash: E0B0128D39C3507C3149610C1D02EB7015CC0C4F18734C12FF908CA840E8886D5C0037

Function 003B344C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B341F

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

~4;, xrefs: 003B3419
L4;, xrefs: 003B344C

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: L4;$~4;
API String ID: 1269201914-751004607
Opcode ID: e2a6b1df0289815d8088cad54f403b8781c6240fc1cb661171e4cb54d1efe62f
Instruction ID: 747bb3a6eb4c032e85784d125027ec85672d6fb3a1ab013f6089196d56d04693
Opcode Fuzzy Hash: e2a6b1df0289815d8088cad54f403b8781c6240fc1cb661171e4cb54d1efe62f
Instruction Fuzzy Hash: 05B0128D3ACD116C3146718E1D03EF6092CC0C4F14730C53FF204C6841E9480D4C0037

Function 003B74BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B748D

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

{t;, xrefs: 003B7487
XFL, xrefs: 003B74BE

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: XFL${t;
API String ID: 1269201914-1157156505
Opcode ID: 1aa1ca2bb46e4a4c5ef2d54e04c1b6118855598a539fa9084631c0b3a8618951
Instruction ID: 6943077c346aec49fcdd54fdd7c75c7e286609f73f6c5e9c3ce431fb861ad0b2
Opcode Fuzzy Hash: 1aa1ca2bb46e4a4c5ef2d54e04c1b6118855598a539fa9084631c0b3a8618951
Instruction Fuzzy Hash: 7EB0128539D1106C3285512D1D02EB6511CC1D4F15330C12FF104C6D40F4480C580037

Function 003B74B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B748D

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

{t;, xrefs: 003B7487
\FL, xrefs: 003B74B4

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: \FL${t;
API String ID: 1269201914-2964843146
Opcode ID: 9c8e7bcc9233c5333a04b4949055f4824c290b9a2d346465eefb5711d8db07a2
Instruction ID: f26b1e949c6f41779eae23ed2b61ef89d3e3ed68a866b275eb4c063a9c827708
Opcode Fuzzy Hash: 9c8e7bcc9233c5333a04b4949055f4824c290b9a2d346465eefb5711d8db07a2
Instruction Fuzzy Hash: E8B012C539C0106C3285516D1D02EB6511CC1D4F19730C02FF504C6840F4480C080037

Function 003B74AA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B748D

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

{t;, xrefs: 003B7487
`FL, xrefs: 003B74AA

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: `FL${t;
API String ID: 1269201914-3748930988
Opcode ID: b1d7c432f74ffa6a906ef6910b4101b6970186e67adde4b876475d78d42a5d53
Instruction ID: 0e927b5d27f0382f25ee16e2a91a2db7da2a47541332f5a8b59d0244b53ebe75
Opcode Fuzzy Hash: b1d7c432f74ffa6a906ef6910b4101b6970186e67adde4b876475d78d42a5d53
Instruction Fuzzy Hash: 66B012C539C1146C32C5952D2D02EF6512CC1C4F15330C03FF104C6840F4480C040137

Function 003B74A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B748D

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

{t;, xrefs: 003B7487
dFL, xrefs: 003B74A0

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: dFL${t;
API String ID: 1269201914-725287359
Opcode ID: 095cbb3aad6d5149184918b3335d021deaa1337a9fc402b6eb23d8bad0453fcb
Instruction ID: 2f8f2ece48b71b0d72d8b74a97b09bd3b088097f69b5e693aa679af6221af094
Opcode Fuzzy Hash: 095cbb3aad6d5149184918b3335d021deaa1337a9fc402b6eb23d8bad0453fcb
Instruction Fuzzy Hash: 90B0128539C2106C32C5512D2E02EF6511CC1C4F15330C02FF104C6840F4490C05003B

Function 003B7496 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B748D

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

{t;, xrefs: 003B7487
hFL, xrefs: 003B7496

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: hFL${t;
API String ID: 1269201914-3969608651
Opcode ID: c77a9b12fc2d80e1f5e1f46f448d3bc8e7d4d2261d78a9f30e276cb2d4cee56f
Instruction ID: 5cef96a3cff306e5195bb744c06c6accdb829664df0c2fd71649295c2e15af31
Opcode Fuzzy Hash: c77a9b12fc2d80e1f5e1f46f448d3bc8e7d4d2261d78a9f30e276cb2d4cee56f
Instruction Fuzzy Hash: 96B0128539E2106C32C5513D1D02EF6512CC1C4F15330C12FF104C6940F4480C444037

Function 003B351F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 003B34D8

Part of subcall function 003B3814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 003B3887
Part of subcall function 003B3814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 003B3898

Strings

a5;, xrefs: 003B34D2
@CL, xrefs: 003B351F

Memory Dump Source

Source File: 00000000.00000002.1370260126.0000000000221000.00000020.00000001.01000000.00000003.sdmp, Offset: 00220000, based on PE: true

Associated: 00000000.00000002.1370231688.0000000000220000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370430980.0000000000438000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370550573.00000000004BE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370567124.00000000004C3000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370585637.00000000004C4000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004C7000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370609821.00000000004E6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_220000_RIv8fq9APB.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: @CL$a5;
API String ID: 1269201914-3101152609
Opcode ID: eeeff223486a944e64fb83168ba4c4351c0a78274fb7a37c6d0b8cf065a33c10
Instruction ID: 06e38ebd67f11b89a5b6a249e55d10d316603549d6a92598dcca947bbc65ac58
Opcode Fuzzy Hash: eeeff223486a944e64fb83168ba4c4351c0a78274fb7a37c6d0b8cf065a33c10
Instruction Fuzzy Hash: 28B0129539C0106C3146614D2D02EF6013CC1C4F1CB34C02FF504C7840E4480E0C4037

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RIv8fq9APB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSI4545.tmp

C:\Users\user\AppData\Local\Temp\MSI45D2.tmp

C:\Users\user\AppData\Local\Temp\MSI648fd.LOG

C:\Users\user\AppData\Local\Temp\shi44B7.tmp

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\0BEAF65\Installer.msi

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\decoder.dll

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ Utils 1.14.1\install\holder0.aiph

C:\Windows\Installer\5646f9.msi

C:\Windows\Installer\MSI4812.tmp

C:\Windows\Installer\MSI4871.tmp

C:\Windows\Installer\MSI48A1.tmp

C:\Windows\Installer\MSI48C1.tmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
RIv8fq9APB.exe

Function 0035B350 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 551
COMMON

Function 0034EAB0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Function 00344050 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Function 00322350 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 85
libraryloaderCOMMON

Function 0035A240 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
COMMON

Function 00322BA0 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Function 00344960 Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 220
COMMON

Function 00322F80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Function 003364D0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 495
COMMON

Function 0035F7B0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Function 0030DDA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96
registrylibraryloaderCOMMON

Function 003B5A9F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Function 00342810 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 224
fileCOMMON

Function 00360BE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Function 0035F2F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON