Edit tour

Windows Analysis Report
pYcFueZgOd.exe

Overview

General Information

Sample name:	pYcFueZgOd.exe renamed because original name is a hash value
Original sample name:	5c66f9bca9f767940d4cb22b59f77a5459c8625bdcc4824fbe42af548e5e5d83.exe
Analysis ID:	1554999
MD5:	196bba4588947b52ece8dc38cd566b24
SHA1:	cb31b0ce35428b4d8ad22a52547c04a517d89e68
SHA256:	5c66f9bca9f767940d4cb22b59f77a5459c8625bdcc4824fbe42af548e5e5d83
Tags:	ConsolHQLTDexeuser-JAMESWT_MHT
Infos:

Detection

Score:	32
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Query firmware table information (likely to detect VMs)

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

pYcFueZgOd.exe (PID: 6108 cmdline: "C:\Users\user\Desktop\pYcFueZgOd.exe" MD5: 196BBA4588947B52ECE8DC38CD566B24)

msiexec.exe (PID: 5156 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\pYcFueZgOd.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488858 " AI_EUIMSI="" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 3776 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 3784 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 161E3B14046EDAE7687DCE0A2DE92319 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 2084 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 086D93F0B7AD81A713F30BD085B16B8B MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:11:29.301001+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49748	TCP
2024-11-13T10:12:06.808572+0100	2022930	1	A Network Trojan was detected	20.109.210.53	443	192.168.2.6	49964	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: pYcFueZgOd.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: pYcFueZgOd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: pYcFueZgOd.exe, 00000000.00000003.2217124522.0000000005BA6000.00000004.00000020.00020000.00000000.sdmp, shi7EE7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: pYcFueZgOd.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI814A.tmp.0.dr, MSI8811.tmp.2.dr, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI814A.tmp.0.dr, MSI8811.tmp.2.dr, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: wininet.pdbUGP source: pYcFueZgOd.exe, 00000000.00000003.2217124522.0000000005BA6000.00000004.00000020.00020000.00000000.sdmp, shi7EE7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: pYcFueZgOd.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: pYcFueZgOd.exe

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DC2380 FindFirstFileW,FindClose,	0_2_00DC2380
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DA43B0 FindFirstFileW,GetLastError,FindClose,	0_2_00DA43B0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CBA950 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,	0_2_00CBA950
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DC14D0 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_00DC14D0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DA3DE0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00DA3DE0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DAC0B0 FindFirstFileW,FindClose,FindClose,	0_2_00DAC0B0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DBE3A0 FindFirstFileW,FindClose,	0_2_00DBE3A0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DCE610 FindFirstFileW,FindClose,	0_2_00DCE610
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DCB3D0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00DCB3D0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DCB7D0 FindFirstFileW,FindClose,	0_2_00DCB7D0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DA3A50 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00DA3A50
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DDFB20 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00DDFB20

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DCA620 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_00DCA620

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49748
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.6:49964

Source: pYcFueZgOd.exe	String found in binary or memory: RShlwapi.dllShell32.dllmsiexec.exebinJavaHomeSoftware\JavaSoft\Java Development Kit\Software\JavaSoft\Java Runtime Environment\FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: pYcFueZgOd.exe, 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmp, pYcFueZgOd.exe, 00000000.00000000.2159340655.0000000000EB8000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: Shlwapi.dllShell32.dllmsiexec.exebinJavaHomeSoftware\JavaSoft\Java Development Kit\Software\JavaSoft\Java Runtime Environment\FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: shi7EE7.tmp.0.dr	String found in binary or memory: http://.css
Source: shi7EE7.tmp.0.dr	String found in binary or memory: http://.jpg
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shi7EE7.tmp.0.dr	String found in binary or memory: http://html4/loose.dtd
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://t2.symcb.com0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://tl.symcd.com0&
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DE15E0 NtdllDefWindowProc_W,	0_2_00DE15E0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D61FB0 GetSystemDirectoryW,_wcschr,LoadLibraryExW,NtdllDefWindowProc_W,	0_2_00D61FB0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D00010 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00D00010
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB2250 NtdllDefWindowProc_W,	0_2_00CB2250
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CBC4F0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	0_2_00CBC4F0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB8720 NtdllDefWindowProc_W,	0_2_00CB8720
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB8890 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00CB8890
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CAEBE0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	0_2_00CAEBE0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D00BAA ShowWindow,ShowWindow,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00D00BAA
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D00CE3 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00D00CE3
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D00C22 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	0_2_00D00C22
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CF6EE0 NtdllDefWindowProc_W,	0_2_00CF6EE0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CAF190 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	0_2_00CAF190
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CCD320 NtdllDefWindowProc_W,	0_2_00CCD320
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CC15F0 NtdllDefWindowProc_W,	0_2_00CC15F0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB1670 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	0_2_00CB1670
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CAF7C0 NtdllDefWindowProc_W,	0_2_00CAF7C0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB1C90 NtdllDefWindowProc_W,	0_2_00CB1C90
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D47F20 NtdllDefWindowProc_W,	0_2_00D47F20

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6c83b9.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8743.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87A2.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87F1.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8811.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI8743.tmp

Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01502CB4	0_3_01502CB4
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01502CB4	0_3_01502CB4
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_014DF770	0_3_014DF770
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01502CB4	0_3_01502CB4
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01502CB4	0_3_01502CB4
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CBA950	0_2_00CBA950
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DDB350	0_2_00DDB350
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DB7D70	0_2_00DB7D70
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CC6070	0_2_00CC6070
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CC41B0	0_2_00CC41B0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CBE290	0_2_00CBE290
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E3E2BE	0_2_00E3E2BE
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E3E64C	0_2_00E3E64C
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D82A50	0_2_00D82A50
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E58B95	0_2_00E58B95
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB8CD0	0_2_00CB8CD0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CA2F40	0_2_00CA2F40
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CD52F0	0_2_00CD52F0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CC35A0	0_2_00CC35A0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E1D550	0_2_00E1D550
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E53631	0_2_00E53631
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CC7630	0_2_00CC7630
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D7B7A0	0_2_00D7B7A0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CFFA40	0_2_00CFFA40
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E4DD6A	0_2_00E4DD6A
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D13FC0	0_2_00D13FC0

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00D9E6D0 appears 59 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00CA8800 appears 223 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00D9E770 appears 31 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00CA9390 appears 41 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00CD3810 appears 90 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00CA99C0 appears 69 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00CA7070 appears 53 times
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: String function: 00CA6FF0 appears 46 times

Source: pYcFueZgOd.exe, 00000000.00000003.2162923408.000000000151C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDecoder.dllF vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe, 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileNameInstaller.exe8 vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe, 00000000.00000003.2217124522.0000000005BA6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe	Binary or memory string: OriginalFileNameInstaller.exe8 vs pYcFueZgOd.exe
Source: pYcFueZgOd.exe	Binary or memory string: OriginalFilenameDecoder.dllF vs pYcFueZgOd.exe

Source: pYcFueZgOd.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: shi7EE7.tmp.0.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: sus32.evad.winEXE@8/13@0/0

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DA2230 FormatMessageW,GetLastError,

0_2_00DA2230

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DCC990 GetDiskFreeSpaceExW,

0_2_00DCC990

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DE6D50 CoCreateInstance,

0_2_00DE6D50

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00D3AB40 FindResourceW,LoadResource,LockResource,SizeofResource,

0_2_00D3AB40

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

File created: C:\Users\user\AppData\Roaming\ConsolHQ LTD

Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

File created: C:\Users\user\AppData\Local\Temp\shi7EE7.tmp

Jump to behavior

Source: pYcFueZgOd.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

File read: C:\Users\user\Desktop\pYcFueZgOd.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\pYcFueZgOd.exe "C:\Users\user\Desktop\pYcFueZgOd.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 161E3B14046EDAE7687DCE0A2DE92319 C
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\pYcFueZgOd.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488858 " AI_EUIMSI=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 086D93F0B7AD81A713F30BD085B16B8B
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\pYcFueZgOd.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488858 " AI_EUIMSI=""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 161E3B14046EDAE7687DCE0A2DE92319 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 086D93F0B7AD81A713F30BD085B16B8B	Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: pYcFueZgOd.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: pYcFueZgOd.exe

Static file information: File size 49199285 > 1048576

Source: pYcFueZgOd.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x216e00

Source: pYcFueZgOd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pYcFueZgOd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pYcFueZgOd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pYcFueZgOd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pYcFueZgOd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pYcFueZgOd.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pYcFueZgOd.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: pYcFueZgOd.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wininet.pdb source: pYcFueZgOd.exe, 00000000.00000003.2217124522.0000000005BA6000.00000004.00000020.00020000.00000000.sdmp, shi7EE7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: pYcFueZgOd.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI814A.tmp.0.dr, MSI8811.tmp.2.dr, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI814A.tmp.0.dr, MSI8811.tmp.2.dr, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: wininet.pdbUGP source: pYcFueZgOd.exe, 00000000.00000003.2217124522.0000000005BA6000.00000004.00000020.00020000.00000000.sdmp, shi7EE7.tmp.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: pYcFueZgOd.exe, decoder.dll.0.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: pYcFueZgOd.exe

Source: pYcFueZgOd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pYcFueZgOd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pYcFueZgOd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pYcFueZgOd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pYcFueZgOd.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: shi7EE7.tmp.0.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DA2350 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00DA2350

Source: shi7EE7.tmp.0.dr	Static PE information: section name: .wpp_sf
Source: shi7EE7.tmp.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01509841 pushfd ; retf	0_3_01509842
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01509841 pushfd ; retf	0_3_01509842
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504D7B push edi; ret	0_3_01504E19
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504D7B push edi; ret	0_3_01504E19
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504080 push eax; ret	0_3_01504081
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504080 push eax; ret	0_3_01504081
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504B21 push ebx; ret	0_3_01504B49
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504B21 push ebx; ret	0_3_01504B49
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_014ED4FD push 5563014Eh; iretd	0_3_014ED502
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01509841 pushfd ; retf	0_3_01509842
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01509841 pushfd ; retf	0_3_01509842
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504D7B push edi; ret	0_3_01504E19
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504D7B push edi; ret	0_3_01504E19
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504080 push eax; ret	0_3_01504081
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504080 push eax; ret	0_3_01504081
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504B21 push ebx; ret	0_3_01504B49
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_3_01504B21 push ebx; ret	0_3_01504B49
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D0A486 push esi; ret	0_2_00D0A488
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E36C6E push ecx; ret	0_2_00E36C81
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00D83330 push ecx; mov dword ptr [esp], 3F800000h	0_2_00D83478
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CB5BE0 push ecx; mov dword ptr [esp], ecx	0_2_00CB5BE1

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File created: C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File created: C:\Users\user\AppData\Local\Temp\MSI7F84.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File created: C:\Users\user\AppData\Local\Temp\MSI814A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8743.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87F1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File created: C:\Users\user\AppData\Local\Temp\shi7EE7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8811.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87A2.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8743.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87F1.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI8811.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI87A2.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	System information queried: FirmwareTableInformation			Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI7F84.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI814A.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8743.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI87F1.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shi7EE7.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI8811.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSI87A2.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Evaded block: after key decision

graph_0-67816

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-69876

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File Volume queried: C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File Volume queried: C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DC2380 FindFirstFileW,FindClose,	0_2_00DC2380
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DA43B0 FindFirstFileW,GetLastError,FindClose,	0_2_00DA43B0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CBA950 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,	0_2_00CBA950
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DC14D0 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	0_2_00DC14D0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DA3DE0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	0_2_00DA3DE0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DAC0B0 FindFirstFileW,FindClose,FindClose,	0_2_00DAC0B0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DBE3A0 FindFirstFileW,FindClose,	0_2_00DBE3A0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DCE610 FindFirstFileW,FindClose,	0_2_00DCE610
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DCB3D0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00DCB3D0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DCB7D0 FindFirstFileW,FindClose,	0_2_00DCB7D0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DA3A50 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	0_2_00DA3A50
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00DDFB20 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	0_2_00DDFB20

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DCA620 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

0_2_00DCA620

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00E3365A VirtualQuery,GetSystemInfo,

0_2_00E3365A

Source: pYcFueZgOd.exe	Binary or memory string: &VmCi
Source: Installer.msi.0.dr	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00E3AD13 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E3AD13

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DD77C0 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

0_2_00DD77C0

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DA2350 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_00DA2350

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E4C66D mov ecx, dword ptr fs:[00000030h]	0_2_00E4C66D
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E5783E mov eax, dword ptr fs:[00000030h]	0_2_00E5783E
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E35CA1 mov esi, dword ptr fs:[00000030h]	0_2_00E35CA1

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00E35D0D GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

0_2_00E35D0D

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00CD21E0 __set_se_translator,SetUnhandledExceptionFilter,	0_2_00CD21E0
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E36738 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E36738
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: 0_2_00E3AD13 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E3AD13

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\consolhq ltd\skimarutils 1.12.3\install\52455d3\installer.msi" ai_setupexepath=c:\users\user\desktop\pycfuezgod.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488858 " ai_euimsi=""
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\consolhq ltd\skimarutils 1.12.3\install\52455d3\installer.msi" ai_setupexepath=c:\users\user\desktop\pycfuezgod.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488858 " ai_euimsi=""			Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DCEAB0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

0_2_00DCEAB0

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,MsgWaitForMultipleObjectsEx,MsgWaitForMultipleObjectsEx,PeekMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,TranslateMessage,DispatchMessageW,MsgWaitForMultipleObjectsEx,	0_2_00DC4050
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,	0_2_00E541E6
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,	0_2_00E50186
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E5430F
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E544E4
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,	0_2_00E54415
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00E53B80
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: EnumSystemLocalesW,	0_2_00E4FC09
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,	0_2_00E53D7B
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: EnumSystemLocalesW,	0_2_00E53E6D
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: EnumSystemLocalesW,	0_2_00E53E22
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E53F93
Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Code function: EnumSystemLocalesW,	0_2_00E53F08

Source: C:\Users\user\Desktop\pYcFueZgOd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DDBB20 CreateNamedPipeW,CreateFileW,

0_2_00DDBB20

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00E372F4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00E372F4

Source: C:\Users\user\Desktop\pYcFueZgOd.exe

Code function: 0_2_00DDA240 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,

0_2_00DDA240

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	25 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pYcFueZgOd.exe	1%	Virustotal		Browse
pYcFueZgOd.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\MSI7F84.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI7F84.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSI814A.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSI814A.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\shi7EE7.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\decoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSI8743.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI87A2.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI87F1.tmp	0%	ReversingLabs
C:\Windows\Installer\MSI8811.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, 6c83b9.msi.2.dr, Installer.msi.0.dr	false	high
http://html4/loose.dtd	shi7EE7.tmp.0.dr	false	high
https://www.advancedinstaller.com	pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	false	high
https://www.thawte.com/cps0/	pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	false	high
http://.css	shi7EE7.tmp.0.dr	false	high
http://.jpg	shi7EE7.tmp.0.dr	false	high
https://www.thawte.com/repository0W	pYcFueZgOd.exe, 00000000.00000002.2284677443.0000000004606000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.00000000046C0000.00000004.00001000.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2279677005.00000000045FA000.00000004.00000020.00020000.00000000.sdmp, pYcFueZgOd.exe, 00000000.00000003.2203217484.0000000004816000.00000004.00001000.00020000.00000000.sdmp, MSI7F84.tmp.0.dr, MSI814A.tmp.0.dr, MSI87F1.tmp.2.dr, MSI8811.tmp.2.dr, MSI8743.tmp.2.dr, 6c83b9.msi.2.dr, MSI87A2.tmp.2.dr, Installer.msi.0.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1554999
Start date and time:	2024-11-13 10:10:18 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pYcFueZgOd.exe renamed because original name is a hash value
Original Sample Name:	5c66f9bca9f767940d4cb22b59f77a5459c8625bdcc4824fbe42af548e5e5d83.exe
Detection:	SUS
Classification:	sus32.evad.winEXE@8/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 57% Number of executed functions: 66 Number of non-executed functions: 198
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\shi7EE7.tmp	setup.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	http://downloads.ciscocems.com/downloads/CeDAR/Setup_Cedar%208.05.08.zip	Get hash	malicious	Unknown	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	teracopy.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\MSI7F84.tmp	IM-vL5WWvBl.msi	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSI7F84.tmp

Download File

Process:	C:\Users\user\Desktop\pYcFueZgOd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:	6144:PBtBN+l8CKvSHJSTHLntEToqi/9rpiAO+7lMhZeBajAt7fgcY:PB/0l1K7HLnt5DgMlgZ7AtDgcY
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: IM-vL5WWvBl.msi, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSI814A.tmp

Download File

Process:	C:\Users\user\Desktop\pYcFueZgOd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919520
Entropy (8bit):	6.451407326378623
Encrypted:	false
SSDEEP:	24576:1x90VXSK4fSa6HXr1iWn8Zlb2h4ntHurpllQ6a:Pq4Fb6HXr1iWnU84ntHurpllQ6a
MD5:	064278F42704CDCE52C8C527CF9AFBC7
SHA1:	007C2A1C946EB62886AC26ADFC7C6B41EECD4D41
SHA-256:	070155314AE1035E0A74729231EA97053744EC3B0D5E8D8AF0D000448924D5A9
SHA-512:	9D7AE27229317F07CFD051AB8A7E4E7AC4071593FB0329BFF21CFB812086CA00CFFEBBC950A4849C233D8B2EE3D306E9A3338415DEB48CEE09C5B94704A01A70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#S..#S..#S]. R..#S].&R;.#S.'R..#S. R..#S.&R..#S].'R..#S]."R..#S.."S..#S2.*R..#S2.#R..#S2..S..#S..S..#S2.!R..#SRich..#S........PE..L...P..b.........."!.....X...................p...............................@......{9....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIc886c.LOG

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	280
Entropy (8bit):	3.4347808834234357
Encrypted:	false
SSDEEP:	6:Q2nIeAMOYrsfc/okjxaaOEqQbr62avKpnKBlv2K84UlUlosle:Q2nOGsc/7aFEVbr62aInKT8xh
MD5:	5E175FD9C0308725E145CD356447422E
SHA1:	494DC977CAFA07CFD8453D1AB319BC7077973D87
SHA-256:	4041C5845747A90763D1AF39BE0020A24506A29FA21B6B062974DCB4C29BC00D
SHA-512:	3E8E56CEAF2545CB8423449588AFDCAC3C492E05E0304227E3761E70878B4D94FD4F8A7A60AF462B4B6CBADAA5DD9BA40222A0CE207CC1E210A529A5A6B6ACFC
Malicious:	false
Reputation:	low
Preview:	..S.k.i.m.a.r.U.t.i.l.s. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .s.y.s.t.e.m.s. .w.i.t.h. .s.c.r.e.e.n. .r.e.s.o.l.u.t.i.o.n. .s.m.a.l.l.e.r. .t.h.a.n. .1.3.6.0. .x. .7.6.8.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.1.1./.2.0.2.4. . .0.4.:.1.1.:.2.6. .=.=.=.....

C:\Users\user\AppData\Local\Temp\shi7EE7.tmp

Download File

Process:	C:\Users\user\Desktop\pYcFueZgOd.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: VirtualDesktop.Streamer.Setup.exe, Detection: malicious, Browse Filename: VirtualDesktop.Streamer.Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: teracopy.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3\Installer.msi

Download File

Process:	C:\Users\user\Desktop\pYcFueZgOd.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C80C8DC4-7882-4425-A62B-5CA32EF1048D}, Number of Words: 0, Subject: SkimarUtils, Author: ConsolHQ LTD, Name of Creating Application: SkimarUtils, Template: ;1033, Comments: This installer database contains the logic and data required to install SkimarUtils., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2202112
Entropy (8bit):	6.505978865753567
Encrypted:	false
SSDEEP:	49152:V2VYVKjlgZcDgcYtAvq4Fb6HXr1iWnU84ntHurpllQ6asHCP1N0ZqgJtHhxl:YY4jlYAjFnWns1
MD5:	EC03685D7F65603C98E75EF2F755BDFC
SHA1:	942ED2C2F75155992CC355C028DEB548FCAF93E6
SHA-256:	4BB6045F752606CA4C7381358CB3BEC67D0B4E362A22ED5FACD187BDE6AF5C46
SHA-512:	B172A0E5C5C5B802F455CBF4D445C9B78024E07C6DA194543356D376ECDAE93BB323FDBEA61BA80AE0F14EB26766AE86339126E09B37EB5D1F9BFD3C7B4E632A
Malicious:	false
Preview:	......................>..................."...................................f...............................1...2...3...4...5...6...7...8...9...:...;...<...=...>...C...D...E...F...G...H...I...J...K...................................................................................................................................................................................................................................................................................................................................N...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C.......E...K...G...H...I...J.......L...M...O..._...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^...`......a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\decoder.dll

Download File

Process:	C:\Users\user\Desktop\pYcFueZgOd.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209920
Entropy (8bit):	6.447659228395253
Encrypted:	false
SSDEEP:	3072:tScXkSa4E7uzTK+NbkuO2DcUC1myXxskH9Xq4fa2KbDI0lSmb9D:Q7sO+EZ9LH2j7Mmb9
MD5:	A5FFDCF45D3D123139C49017B22F444E
SHA1:	7B3D3D293F9A34570FC91500A6580496147C7658
SHA-256:	8F49245444B02BF0E103C5A5850A0B2FB1F2880C917261D146E3B8BC3C166E40
SHA-512:	5FF195A70825EFCED761ACEEEC5A6F0D0E18C1A4074482F584EFABEF7166C957C728D71D6185E3487A1405C608D820EFA4E07C584D60A8D51625E5D8A9A89397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..a..2..2..2..3 ..2..3...2x.3...2x.3:..2x.3?..2..3?..2..3-..2..2...2..3v..2..3+..2..^2+..2.62+..2..3+..2Rich..2................PE..L...?..b.........."!.....`...................p............................................@......................... ...........<....p.. .......................0 ......p...........................`...@............p..t............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...dV..........................@....rsrc... ....p......................@..@.reloc..0 ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\pYcFueZgOd.exe
File Type:	data
Category:	dropped
Size (bytes):	162168468
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2DBC0818CDB52345791955E058A40132
SHA1:	3CEC7455FB8C8F57FABA2B065BA7BEEBCECBA565
SHA-256:	896FBF58598F1376DC47013E0CCDF5422A54C28460F858ABD25B871DC02D5509
SHA-512:	8173DAE9455BD4D200E0C5D3A25014AA879FF3FC9A9001C02F91BB0F1EA10D226BFFD6C8E19BA2F7A37A646749E82C5A70CF62A7C461660A188343C8A19E77CB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\6c83b9.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {C80C8DC4-7882-4425-A62B-5CA32EF1048D}, Number of Words: 0, Subject: SkimarUtils, Author: ConsolHQ LTD, Name of Creating Application: SkimarUtils, Template: ;1033, Comments: This installer database contains the logic and data required to install SkimarUtils., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2202112
Entropy (8bit):	6.505978865753567
Encrypted:	false
SSDEEP:
MD5:	EC03685D7F65603C98E75EF2F755BDFC
SHA1:	942ED2C2F75155992CC355C028DEB548FCAF93E6
SHA-256:	4BB6045F752606CA4C7381358CB3BEC67D0B4E362A22ED5FACD187BDE6AF5C46
SHA-512:	B172A0E5C5C5B802F455CBF4D445C9B78024E07C6DA194543356D376ECDAE93BB323FDBEA61BA80AE0F14EB26766AE86339126E09B37EB5D1F9BFD3C7B4E632A
Malicious:	false
Preview:	......................>..................."...................................f...............................1...2...3...4...5...6...7...8...9...:...;...<...=...>...C...D...E...F...G...H...I...J...K...................................................................................................................................................................................................................................................................................................................................N...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C.......E...K...G...H...I...J.......L...M...O..._...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^...`......a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSI8743.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI87A2.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI87F1.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI8811.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	919520
Entropy (8bit):	6.451407326378623
Encrypted:	false
SSDEEP:
MD5:	064278F42704CDCE52C8C527CF9AFBC7
SHA1:	007C2A1C946EB62886AC26ADFC7C6B41EECD4D41
SHA-256:	070155314AE1035E0A74729231EA97053744EC3B0D5E8D8AF0D000448924D5A9
SHA-512:	9D7AE27229317F07CFD051AB8A7E4E7AC4071593FB0329BFF21CFB812086CA00CFFEBBC950A4849C233D8B2EE3D306E9A3338415DEB48CEE09C5B94704A01A70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#S..#S..#S]. R..#S].&R;.#S.'R..#S. R..#S.&R..#S].'R..#S]."R..#S.."S..#S2.*R..#S2.#R..#S2..S..#S..S..#S2.!R..#SRich..#S........PE..L...P..b.........."!.....X...................p...............................@......{9....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362990898893127
Encrypted:	false
SSDEEP:
MD5:	54AF47CDC74B83878F50F08804FC9322
SHA1:	7E19490EEA1B3C4EA03266728BFBFD0DCF1FFDD5
SHA-256:	30BD3844025CE22907000E34629E594CCF126B14AAF53CF99C2675A694204C32
SHA-512:	32CA8A83A49F5FCC87DB47DD09AF400E55F04BDA7897932CEB774D0AADDEF9B1A52848FA7CA9D4FB1B7AFEACE5659968E08443206155B0AEAA086ABFB81C82A0
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.976619871966806
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	pYcFueZgOd.exe
File size:	49'199'285 bytes
MD5:	196bba4588947b52ece8dc38cd566b24
SHA1:	cb31b0ce35428b4d8ad22a52547c04a517d89e68
SHA256:	5c66f9bca9f767940d4cb22b59f77a5459c8625bdcc4824fbe42af548e5e5d83
SHA512:	1192bf94fe97de25a1fcaf70ba76c67fbf823500656ad8d6615b5169b9fd7879ddeb3f1f348988839bd838be90153c906ed1084c9abe8bb63d101d19274ee036
SSDEEP:	786432:KVfExzYbFwhkPMvMGp+X7l+AOeMlcft9qjpsP7qLr3HbpGwCTPxtYVqbqR0/pNj0:fUBowMvMl+ot9Wpsz2rXbpDCTptDJx+/
TLSH:	3AB72330364EC52BDA6615B0292C9A9F552D7E750B71A8C7B3CC2D2E1BB49C34732E27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{.3.x...{.3.~.X.{.3.}...{.......{...x...{...~...{.3.....{.3.z...{.3.\|...{...z.8.{.\.r...{.\.....{.......{.\.y...{

File Icon


Icon Hash:	9713331b4d3b2f0c

Static PE Info

General

Entrypoint:	0x596c64
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6213B2EE [Mon Feb 21 15:42:38 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	836688c7d21e39394af41ce9a8c2d728

Entrypoint Preview

Instruction
call 00007F9A8D61781Dh
jmp 00007F9A8D616FBFh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F9A8D616613h
jmp 00007F9A8D617122h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29cb94	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a7000	0x3d564	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e5000	0x256bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x246778	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x246800	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x219f38	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x218000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x299f88	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x216c3f	0x216e00	b670db57563315716440578ee99e5466	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x218000	0x85b8c	0x85c00	59a6fbcfc1f150b26bf16fdd47452e43	False	0.3120947721962617	data	4.605894063170113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29e000	0x89f0	0x6a00	1cea180402edcf39ea7c6193312cce32	False	0.14180424528301888	DOS executable (block device driver 0aY)	2.8670521481443174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2a7000	0x3d564	0x3d600	e7d02ce3727ddc83544486f0bf581520	False	0.2636161850814664	data	5.855843008118312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e5000	0x256bc	0x25800	08f0f06260e93e98732bfb4145f07cca	False	0.446171875	data	6.512576488264422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x2a7bf0	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
IMAGE_FILE	0x2a7bf8	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
RTF_FILE	0x2a7c00	0x2e9	Rich Text Format data, version 1, ANSI, code page 1252	English	United States	0.5503355704697986
RTF_FILE	0x2a7eec	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	English	United States	0.906832298136646
RT_BITMAP	0x2a7f90	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x2a80d0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x2a88f8	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x2ad1a0	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x2adc0c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x2add60	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x2ae588	0x7c5a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9958534899792675
RT_ICON	0x2b61e4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.142848692771797
RT_ICON	0x2c6a0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.29470954356846474
RT_ICON	0x2c8fb4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3621013133208255
RT_ICON	0x2ca05c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.45819672131147543
RT_MENU	0x2ca9e4	0x5c	data	English	United States	0.8478260869565217
RT_MENU	0x2caa40	0x2a	data	English	United States	1.0714285714285714
RT_DIALOG	0x2caa6c	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x2cab18	0x2a6	data	English	United States	0.5132743362831859
RT_DIALOG	0x2cadc0	0x3b4	data	English	United States	0.43248945147679324
RT_DIALOG	0x2cb174	0xbc	data	English	United States	0.7180851063829787
RT_DIALOG	0x2cb230	0x204	data	English	United States	0.560077519379845
RT_DIALOG	0x2cb434	0x282	data	English	United States	0.48598130841121495
RT_DIALOG	0x2cb6b8	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x2cb784	0x146	data	English	United States	0.5736196319018405
RT_DIALOG	0x2cb8cc	0x226	data	English	United States	0.4690909090909091
RT_DIALOG	0x2cbaf4	0x388	data	English	United States	0.45464601769911506
RT_DIALOG	0x2cbe7c	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x2cc030	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x2cc168	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x2cc1b4	0x45c	data	English	United States	0.3844086021505376
RT_STRING	0x2cc610	0x344	data	English	United States	0.37320574162679426
RT_STRING	0x2cc954	0x2f8	data	English	United States	0.4039473684210526
RT_STRING	0x2ccc4c	0x598	data	English	United States	0.2807262569832402
RT_STRING	0x2cd1e4	0x3aa	StarOffice Gallery theme i, 1627418368 objects, 1st n	English	United States	0.4211087420042644
RT_STRING	0x2cd590	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x2cdb50	0x568	data	English	United States	0.32875722543352603
RT_STRING	0x2ce0b8	0x164	data	English	United States	0.5421348314606742
RT_STRING	0x2ce21c	0x520	data	English	United States	0.39176829268292684
RT_STRING	0x2ce73c	0x1a0	data	English	United States	0.45913461538461536
RT_STRING	0x2ce8dc	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x2cea68	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x2cec80	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x2cf2a4	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x2cf904	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x2cfbe8	0x4c	data	English	United States	0.7763157894736842
RT_VERSION	0x2cfc34	0x2e4	data	English	United States	0.4581081081081081
RT_HTML	0x2cff18	0x37c8	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08291316526610644
RT_HTML	0x2d36e0	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x2d49f8	0x4fa	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3626373626373626
RT_HTML	0x2d4ef4	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x2db9c4	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x2dc068	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x2dd0b4	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x2de668	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x2e06c4	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x2e3d54	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, RemoveDirectoryW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, MoveFileW, GetLastError, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, SetEvent, InitializeCriticalSection, lstrcpynW, CreateThread, WaitForSingleObject, GetProcAddress, LoadLibraryExW, Sleep, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetModuleHandleW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SystemTimeToFileTime, MultiByteToWideChar, WideCharToMultiByte, GetCurrentProcess, GetSystemInfo, WaitForMultipleObjects, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, SetUnhandledExceptionFilter, FormatMessageW, FileTimeToSystemTime, GetEnvironmentVariableW, GetEnvironmentStringsW, LocalFree, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, CreateProcessW, GetExitCodeProcess, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetLocaleInfoW, GetSystemDefaultLangID, GetUserDefaultLangID, GetWindowsDirectoryW, GetSystemTime, GetDateFormatW, GetTimeFormatW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, GetLocalTime, CreateNamedPipeW, ConnectNamedPipe, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, TerminateThread, LocalAlloc, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, GetSystemTimeAsFileTime, CompareStringEx, GetCPInfo, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, WaitForSingleObjectEx, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetFileType, GetTimeZoneInformation, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetConsoleMode, IsValidCodePage, GetACP, GetOEMCP, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	04:11:14
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\pYcFueZgOd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pYcFueZgOd.exe"
Imagebase:	0xca0000
File size:	49'199'285 bytes
MD5 hash:	196BBA4588947B52ECE8DC38CD566B24
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:11:18
Start date:	13/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7a91d0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	04:11:20
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 161E3B14046EDAE7687DCE0A2DE92319 C
Imagebase:	0xcd0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:11:20
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\pYcFueZgOd.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488858 " AI_EUIMSI=""
Imagebase:	0xcd0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:11:22
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 086D93F0B7AD81A713F30BD085B16B8B
Imagebase:	0xcd0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	99

Executed Functions

Function 00DB7D70 Relevance: 33.2, APIs: 2, Strings: 16, Instructions: 1745COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 00DB7F67
SetEvent.KERNEL32(?), ref: 00DB7FC5

Part of subcall function 00DC2AB0: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,28CB4BA0), ref: 00DC2ADB

Strings

Software\Caphyon\Advanced Installer\, xrefs: 00DB8420
Language used for UI:, xrefs: 00DB85CE
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 00DB8434
Language selected programatically for UI:, xrefs: 00DB8552
Language of a related product is:, xrefs: 00DB849C
>, xrefs: 00DB880C
%hu, xrefs: 00DB82DD
Code returned to Windows by setup:, xrefs: 00DB8121
AI_BOOTSTRAPPERLANGS, xrefs: 00DB8E29, 00DB8E3B, 00DB8E45
Languages of setup:, xrefs: 00DB907D
A valid language was received from commnad line. This is:, xrefs: 00DB82AF
h[, xrefs: 00DB8EB8
h, xrefs: 00DB7FB8
l, xrefs: 00DB7FAC
W, xrefs: 00DB8761
Advinst_Extract_, xrefs: 00DB7DC5, 00DB7DD7, 00DB7DE1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: EventInit_thread_footer$DeleteFileFindHeapProcessResource
String ID: W$%hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\$h[$h$l$>
API String ID: 4144826820-2286512649
Opcode ID: 82506c46efda586acb84b2ec38e47b6f0761b7ec1178537e6c5e3526961bae1b
Instruction ID: 16f408752f5bf57be649ea509b285c04cccfe2dc96ae338567bd30276b313518
Opcode Fuzzy Hash: 82506c46efda586acb84b2ec38e47b6f0761b7ec1178537e6c5e3526961bae1b
Instruction Fuzzy Hash: F2E2C37090064ADFDB00DBA8C845BEEF7B5FF45314F188269E416EB292EB349D05DBA1

Function 00DDB350 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SELECT `Value` FROM `Property` WHERE `Property` = '%s', xrefs: 00DDB3BE
PackageCode, xrefs: 00DDB69B

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: PackageCode$SELECT `Value` FROM `Property` WHERE `Property` = '%s'
API String ID: 0-2409377028
Opcode ID: 2ef98742e7dcfc07124e387dde8946ad46f2a4e8e584a80587c68750aeb08f1c
Instruction ID: a80028fadeb920a5f32d7fddb52285491282c0dd83a7efb8883cab9d1e13c662
Opcode Fuzzy Hash: 2ef98742e7dcfc07124e387dde8946ad46f2a4e8e584a80587c68750aeb08f1c
Instruction Fuzzy Hash: 3F12F271A00209EFDB10DF68DC49BAEBBB8EF45324F15412AF915AB391DB75E900DB60

Function 00CBA950 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 877fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 00CBAA5F
PathIsUNCW.SHLWAPI(00000001,*.*), ref: 00CBAAC3
FindFirstFileW.KERNEL32(00000001,?,*.*), ref: 00CBAD0C
GetFullPathNameW.KERNEL32(00000001,00000000,00000000,00000000), ref: 00CBAD26
GetFullPathNameW.KERNEL32(00000001,00000000,00000000,00000000), ref: 00CBAD5A
FindClose.KERNEL32(00000000), ref: 00CBADCB
SetLastError.KERNEL32(0000007B), ref: 00CBADD5
PathIsUNCW.SHLWAPI(?,?,28CB4BA0,?,00000000), ref: 00CBB00E

Strings

\\?\UNC\, xrefs: 00CBAAE3, 00CBABFF, 00CBB02E, 00CBB13A
*.*, xrefs: 00CBAA8A, 00CBAA94
\\?\, xrefs: 00CBAC1A, 00CBACD0, 00CBB155, 00CBB209

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Path$Find$CloseFullName$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 2310598285-1700010636
Opcode ID: 71567b0543c6d96958099faf7b6d6b6a7957c97af921d562c3fd75c1e6f9df86
Instruction ID: 2e7f99b5b62b0c198a86e587ffc524d675a177710d22eceea6723c33a3814bea
Opcode Fuzzy Hash: 71567b0543c6d96958099faf7b6d6b6a7957c97af921d562c3fd75c1e6f9df86
Instruction Fuzzy Hash: 32620371A006069FDB14DF68C889BAEB7B5FF44314F148668E865EB391DB71EE00CB91

Function 00DCEAB0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00DCEAF8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00DCEB05
GetLastError.KERNEL32 ref: 00DCEB0F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 00DCEB39
GetLastError.KERNEL32 ref: 00DCEB3F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,?,?,?), ref: 00DCEB65
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00DCEB98
EqualSid.ADVAPI32(00000000,?), ref: 00DCEBA7
FreeSid.ADVAPI32(?), ref: 00DCEBB6
CloseHandle.KERNEL32(00000000), ref: 00DCEBF0

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: aa0cf89f1b3c29c6571ff7cdf2228168de519641898660d80017d7c32cc4880c
Instruction ID: 9d03a0313bb2d858c606ddc5fe850cf4795ac8c228a721088213a1c04dc4d699
Opcode Fuzzy Hash: aa0cf89f1b3c29c6571ff7cdf2228168de519641898660d80017d7c32cc4880c
Instruction Fuzzy Hash: CB4128B590020AAFDF119FA4CD49FEEBBB9FF08314F144119E811B3290DB75AA08DB64

Function 00DC14D0 Relevance: 15.7, APIs: 10, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: a726f760ceb7714a2bc1bcdbde5ac21a7a302e333cfaff5247d15ec4039354b5
Instruction ID: 8b8617c1571a6e97a43152b49034d2d1f39990102ce9cf41dcc6e7d04901e4c4
Opcode Fuzzy Hash: a726f760ceb7714a2bc1bcdbde5ac21a7a302e333cfaff5247d15ec4039354b5
Instruction Fuzzy Hash: FA62B03490025ADFDB10DFA8C984B9EBBF5BF46314F18829DE415AB292DB709E45CF60

Function 00DC4050 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

GetLocaleInfoW.KERNEL32(?,00000002,00EC337C,00000000), ref: 00DC40C1
GetLocaleInfoW.KERNEL32(?,00000002,00DC3B85,-00000001,00000078,-00000001), ref: 00DC40FD
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 00DC4181
PeekMessageW.USER32(?,00000000), ref: 00DC41C7
TranslateMessage.USER32(00000000), ref: 00DC41D2
DispatchMessageW.USER32(00000000), ref: 00DC41D9
MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 00DC41EB

Strings

%d-%s, xrefs: 00DC4107

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Message$InfoInit_thread_footerLocaleMultipleObjectsWait$DispatchHeapPeekProcessTranslate
String ID: %d-%s
API String ID: 445213441-1781338863
Opcode ID: fa6e293237d6ccbff2f1e1809b6fe173f6ed6483555c2a5005cf0a0cf1f8d66d
Instruction ID: 91c7b6d0dd2342f07855c21cbe63bf6e17898e29fd0fd5408b323c3079857342
Opcode Fuzzy Hash: fa6e293237d6ccbff2f1e1809b6fe173f6ed6483555c2a5005cf0a0cf1f8d66d
Instruction Fuzzy Hash: 4151F47194030AABE710DF58CC45FAABBB8EF45724F144229F614A72D0DB71A905CB60

Function 00DA2350 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,28CB4BA0,00000000,?,00000000), ref: 00DA238E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00DA23B1
FreeLibrary.KERNEL32(00000000), ref: 00DA242F

Strings

,(, xrefs: 00DA2423
=-, xrefs: 00DA23DD
LoadIconMetric, xrefs: 00DA23AB
ComCtl32.dll, xrefs: 00DA2382

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ,($=-$ComCtl32.dll$LoadIconMetric
API String ID: 145871493-3367511128
Opcode ID: 9be8407bfa78ef7c089f271a1e45d1ef973de9de87fb71e1b48867721cc0d6cf
Instruction ID: 1ee1591a7e7b1af4904af4dd7b564e8aacf90f7b16027b73c050de4fd3956af2
Opcode Fuzzy Hash: 9be8407bfa78ef7c089f271a1e45d1ef973de9de87fb71e1b48867721cc0d6cf
Instruction Fuzzy Hash: 72318471904219AFDF148F99CD45BAFBBF8EB49750F04412EF915A7380D7B98904CBA0

Function 00DDA240 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00DDA2CE
GetLastError.KERNEL32 ref: 00DDA2D4
GetUserNameW.ADVAPI32(00000000,?), ref: 00DDA31C
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00DDA352
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00DDA39C

Strings

UserDomain, xrefs: 00DDA34D, 00DDA397

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: EnvironmentNameUserVariable$ErrorLast
String ID: UserDomain
API String ID: 3567734997-2275544873
Opcode ID: 5e7b34d6287c227416e3545bf2cc1a2cd3c89eb7b34e38848b4a5288433e10a9
Instruction ID: 7dfb952d6f112904f6628d3f38c60d22e072bfae29a0c17e242a6fe3970a5376
Opcode Fuzzy Hash: 5e7b34d6287c227416e3545bf2cc1a2cd3c89eb7b34e38848b4a5288433e10a9
Instruction Fuzzy Hash: 06610571A00209DFDB14DFA8C955BEEBBB5FF08304F14412AE401B7280DB75AA4ACBA1

Function 00D61FB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00D61FF1

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

_wcschr.LIBVCRUNTIME ref: 00D620AF

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

LoadLibraryExW.KERNEL32(?,00000000,00000000,-00000010), ref: 00D620C4

Strings

Kernel32.dll, xrefs: 00D61FCC, 00D6209F, 00D620A0, 00D62134

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem_wcschr
String ID: Kernel32.dll
API String ID: 1122257418-1926710522
Opcode ID: a3adfbfc27c0721f7a0c1c28b1f9cf8efd65063da715ec036b77845f64096706
Instruction ID: 307d9c762b987710553b5ef0662d1a7ac993f195e27aff95d59c52a89f4fa433
Opcode Fuzzy Hash: a3adfbfc27c0721f7a0c1c28b1f9cf8efd65063da715ec036b77845f64096706
Instruction Fuzzy Hash: D4A18AB0501B45EFE714CF64C819BAABBF4FF04318F14825DD8599B681D7BAA618CF90

Function 00DCC990 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00DCCA6A

Strings

\, xrefs: 00DCC9EC
\, xrefs: 00DCC9E4
\, xrefs: 00DCCA0E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: d9be91c4d8462ed407dd825513eb351e49416e33294897716797bc70a5ec2d51
Instruction ID: 19d21eb00f8097b7d91c68e5caf458af8cc88374051feb6b7e35c78ce92fb78d
Opcode Fuzzy Hash: d9be91c4d8462ed407dd825513eb351e49416e33294897716797bc70a5ec2d51
Instruction Fuzzy Hash: 9741E62292421A86CB30DF248449FABB7F4FF94354F19661EEACDD3140F7708C8587A5

Function 00E35D0D Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,00CB0DC7,?,?,00CB0B74,?), ref: 00E35D12
HeapAlloc.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35D19
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00CB0B74,?), ref: 00E35D5F
HeapFree.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35D66

Part of subcall function 00E35BAB: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00E35D55,00000000,?,?,00CB0B74,?), ref: 00E35BCF
Part of subcall function 00E35BAB: HeapAlloc.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35BD6

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: 6b8365a3b3581fdc9fcbe35da0113579134af985b6576aa26d28aeeec5832b51
Instruction ID: 7513a63bc491524fd2860757e625db3dafbbbc0b0953d1905dc9c7fdbbef6351
Opcode Fuzzy Hash: 6b8365a3b3581fdc9fcbe35da0113579134af985b6576aa26d28aeeec5832b51
Instruction Fuzzy Hash: 83F0B433604F125BD7253FB9BD0CA5B2EADAF80791F025528F506F6354DE20C805DB60

Function 00DA43B0 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 00DA444F
FindClose.KERNEL32(00000000), ref: 00DA44AE

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID:
API String ID: 2507753907-0
Opcode ID: 2e3b29a5342001944eeaef472b0fb15a1eca5b6710d517a13ffbf3d8ab3e36c4
Instruction ID: 0f580fb4238c31acf4c30609f4f6df1e1ad28a5f6fd64f166cbb570ae9b170d1
Opcode Fuzzy Hash: 2e3b29a5342001944eeaef472b0fb15a1eca5b6710d517a13ffbf3d8ab3e36c4
Instruction Fuzzy Hash: 05310130905218DBDB38DF54CC49BAAB7F4FB89314F24866AE919A7380D7F19D44CBA0

Function 00DC2380 Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: 9510ef2980162730115b95b130ec100a46332ff020b18fcc22760268333d1273
Instruction ID: 0779eb6b068672509c114f7be6c66c8901c1d8b80dc6106ec65a00e79a0bf194
Opcode Fuzzy Hash: 9510ef2980162730115b95b130ec100a46332ff020b18fcc22760268333d1273
Instruction Fuzzy Hash: B7E16D70A0064ADFDB14DFA8CC85FAEB7B4FF45324F18816DE815AB291DB74A905CB60

Function 00DA3DE0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f37c99c6c114097e24867574e48e74cab473ee63ea7fbce319e6ed3fa5f7c998
Instruction ID: 6061500d381f4613eaf7d47d6943ebafe1635c6c8758a8b7c6a768d44d088eb7
Opcode Fuzzy Hash: f37c99c6c114097e24867574e48e74cab473ee63ea7fbce319e6ed3fa5f7c998
Instruction Fuzzy Hash: EF415A319116499FDB24DF68C959BEAB7B5FF11320F188229F825A72D1EB709E04CB60

Function 00DDBB20 Relevance: 3.1, APIs: 2, Instructions: 85filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,28CB4BA0,28CB4BA0,?,?,?,00000000,00EA6015), ref: 00DDBBA8
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,28CB4BA0,28CB4BA0,?,?,?,00000000,00EA6015,000000FF), ref: 00DDBBCA

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: 0be21065670027ae898440ca2436b598838d5d1138b2c5b1c7ca803bb0d41efe
Instruction ID: 48c680c05956192abf2914d0ae7c6bb6e15da22b33d729fdd3d969559c80bbad
Opcode Fuzzy Hash: 0be21065670027ae898440ca2436b598838d5d1138b2c5b1c7ca803bb0d41efe
Instruction Fuzzy Hash: 3831D231684745AFD7218F14CC01B96BBA5EB05720F14865FF9A5AB7D0DB71A900CB54

Function 00CD21E0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 00CD21F8
SetUnhandledExceptionFilter.KERNEL32(00DA0760), ref: 00CD220E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: ed8422ec33cd381af97493309fd8d0cd32b763360b79d64a6337dfba66d2085c
Instruction ID: 7139e214c752db0974433378e1d596350de961bc3425abec6618657adfc564e6
Opcode Fuzzy Hash: ed8422ec33cd381af97493309fd8d0cd32b763360b79d64a6337dfba66d2085c
Instruction Fuzzy Hash: 82E0267A9003002EC31253619C0EF4B3FA4ABA3B11F054049F608A3262C770640CC772

Function 00DE6D50 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA2890: __Init_thread_footer.LIBCMT ref: 00DA2970

CoCreateInstance.COMBASE(00EC31D8,00000000,00000001,00EDF490,000000B0), ref: 00DE6DCE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: e93b4d84384f9143d56a4869217b4cc3f4c558f7a65f9481897282fb831da366
Instruction ID: 3b67b5740c8c9d4e57f40249e4277b9d3ebfcca362afa956a8ba27ec31ed79f5
Opcode Fuzzy Hash: e93b4d84384f9143d56a4869217b4cc3f4c558f7a65f9481897282fb831da366
Instruction Fuzzy Hash: 6711ED71604344EFD720CF59CC05B86BBF8EB06B20F10461EE825AB7C0C7B6A404CBA0

Function 00DE15E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$CreateHeapInstanceProcess
String ID:
API String ID: 3807588171-0
Opcode ID: b954390aaf924a981bac3727238d7fd17f76f4e1933f7e9c8acda4ce8ab4d480
Instruction ID: 086d31494ac00c8af5a8f34631bc2e4cd190a388cab82777f8a34f1e8a3dcdb0
Opcode Fuzzy Hash: b954390aaf924a981bac3727238d7fd17f76f4e1933f7e9c8acda4ce8ab4d480
Instruction Fuzzy Hash: 4B6186B5500744CFE710DF65C54938ABBF0FF05308F248A5DD88AAB382D7B9A60ADB90

Function 00DA2BA0 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00DA2C0E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00DA2C55
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00DA2C74
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00DA2CA3
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00DA2D18
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 00DA2D81
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 00DA2DE4
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 00DA2E36
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 00DA2ED3
GetProcAddress.KERNEL32(00000000), ref: 00DA2EDA
__Init_thread_footer.LIBCMT ref: 00DA2EEE
GetCurrentProcess.KERNEL32(?), ref: 00DA2F11
IsWow64Process.KERNEL32(00000000), ref: 00DA2F18
RegCloseKey.ADVAPI32(00000000), ref: 00DA2F52

Strings

CurrentMajorVersionNumber, xrefs: 00DA2C4A
IsWow64Process, xrefs: 00DA2EC9
co_release, xrefs: 00DA2D89
kernel32, xrefs: 00DA2ECE
ReleaseId, xrefs: 00DA2DD9
CurrentMinorVersionNumber, xrefs: 00DA2C69
rs_prerelease, xrefs: 00DA2DA1
CurrentVersion, xrefs: 00DA2C98
CSDVersion, xrefs: 00DA2E2B
BuildBranch, xrefs: 00DA2D76
CurrentBuildNumber, xrefs: 00DA2D0D
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 00DA2C04

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 1906320730-525127412
Opcode ID: 10286c5b96dd48e6a07238be58aa93db83a4eb6648eb0ac0be9a77755e61a1a7
Instruction ID: 756676d83ea0c36e711115dc27165d5417cb203aee79c8ed27f9e5806e3f16f2
Opcode Fuzzy Hash: 10286c5b96dd48e6a07238be58aa93db83a4eb6648eb0ac0be9a77755e61a1a7
Instruction Fuzzy Hash: 70A1A27190031CDEDB20DF25CC45BAAB7F8FB16714F0441AAE848F6290EB749A84CF91

Function 00DA2F80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 00DA2FF0
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 00DA302B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 00DA30A6
RegCloseKey.KERNEL32(00000000), ref: 00DA327E

Strings

Small Business(Restricted), xrefs: 00DA315D
Small Business, xrefs: 00DA30E0
Storage Server, xrefs: 00DA3205
Security Appliance, xrefs: 00DA31EE
EmbeddedNT, xrefs: 00DA3176
DataCenter, xrefs: 00DA318F
Terminal Server, xrefs: 00DA3144
Blade, xrefs: 00DA31C0
BackOffice, xrefs: 00DA3112
Personal, xrefs: 00DA31A9
CommunicationServer, xrefs: 00DA312B
ServerNT, xrefs: 00DA3054
Enterprise, xrefs: 00DA30F9
Embedded(Restricted), xrefs: 00DA31D7
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 00DA2FE6
WinNT, xrefs: 00DA3031
Compute Server, xrefs: 00DA321C
ProductType, xrefs: 00DA3020
ProductSuite, xrefs: 00DA309B

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: db3f683faccc30db17a30c7e335b880eb669c46aec0dce9e97d09b6dce09570b
Instruction ID: 9d6edfd05ae25c9b0dcde914fd428c1462fd6e7e6d3c4d9d353297f1c623c1e1
Opcode Fuzzy Hash: db3f683faccc30db17a30c7e335b880eb669c46aec0dce9e97d09b6dce09570b
Instruction Fuzzy Hash: 2F71E6307003499BDB209B24CC567AAB266EB93344F185079F905BB381EB38DF46DB76

Function 00DC4960 Relevance: 37.0, APIs: 2, Strings: 19, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 00DC49DC

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Part of subcall function 00CB2970: RaiseException.KERNEL32(?,?,00000000,00000000,00E35A3C,C000008C,00000001,?,00E35A6D,00000000,?,00CA91C7,00000000,28CB4BA0,00000001,?), ref: 00CB297C

__Init_thread_footer.LIBCMT ref: 00DC4A2C

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

Strings

AppDataFolder, xrefs: 00DC69C8, 00DC6A05
TempFolder, xrefs: 00DC64BF
ProgramFilesFolder, xrefs: 00DC68E7
ProgramFiles, xrefs: 00DC6960, 00DC6975, 00DC697D
SystemFolder, xrefs: 00DC613F, 00DC6154, 00DC615E
Shlwapi.dll, xrefs: 00DC6877
Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86, xrefs: 00DC4B03
WindowsFolder, xrefs: 00DC6344, 00DC6359, 00DC6363
ProgramFiles64Folder, xrefs: 00DC6008
System32Folder, xrefs: 00DC625D, 00DC6272, 00DC627C
SETUPEXEDIR, xrefs: 00DC654C
SHGetFolderPathW, xrefs: 00DC6707
shfolder.dll, xrefs: 00DC66D6
Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64, xrefs: 00DC4A64
WindowsVolume, xrefs: 00DC6424, 00DC6439, 00DC6443
ProgramW6432, xrefs: 00DC6064
PROGRAMFILES, xrefs: 00DC6A3D
APPDATA, xrefs: 00DC6A57, 00DC6A5F
Shell32.dll, xrefs: 00DC68A3

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AllocConditionExceptionHeapRaiseVariableWake
String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFiles64Folder$ProgramFilesFolder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$Shell32.dll$Shlwapi.dll$System32Folder$SystemFolder$TempFolder$Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86$Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64$WindowsFolder$WindowsVolume$shfolder.dll
API String ID: 4172833244-3044903971
Opcode ID: f22c9cedc8c58b843063d501b790730d903c642d0b312442140053d7974de68a
Instruction ID: cb205efb03f9ff01ac6c3324f3249333a8b2c3f9af39da59d55bab2e1c695764
Opcode Fuzzy Hash: f22c9cedc8c58b843063d501b790730d903c642d0b312442140053d7974de68a
Instruction Fuzzy Hash: F27136719002079BDB10EBA8C966FBAB7B1EF21314F18456CE866E7291E771DD01C772

Function 00DDF7B0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?,00DC181B,?,?,?,?,?), ref: 00DDF7C5

Strings

,(, xrefs: 00DDF7D7, 00DDF7DD
ExtractAllFiles, xrefs: 00DDF817
GetTotalFilesSize, xrefs: 00DDF805
EndExtraction, xrefs: 00DDF829
InitExtraction, xrefs: 00DDF7FD

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: LibraryLoad
String ID: ,($EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-1556212548
Opcode ID: 06068f7b0e11064fbe7a978787c95db839f5991e30fd709c74186c6084faeed2
Instruction ID: db02f1eefcbf7762a0c3639b0c5d4689d4ef75b2b567c8df1570247f6a5a5867
Opcode Fuzzy Hash: 06068f7b0e11064fbe7a978787c95db839f5991e30fd709c74186c6084faeed2
Instruction Fuzzy Hash: E9014C7AD08619ABCB14EB28EC088467BB1FB25722700813BED1297372D6348819EF90

Function 00DB64D0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

GetTickCount.KERNEL32 ref: 00DB6554
__Xtime_get_ticks.LIBCPMT ref: 00DB655C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB65A6
__Init_thread_footer.LIBCMT ref: 00DB67A1
GetCurrentProcess.KERNEL32 ref: 00DB6B06
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00DB6B16
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 00DB6B42
CloseHandle.KERNEL32(00000000), ref: 00DB6B83

Strings

\/:*?"<>|, xrefs: 00DB6763

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footerProcess$Token$CloseCountCurrentHandleHeapInformationOpenTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 3363527671-3830478854
Opcode ID: be7a350864282cf02b25325b68422cc7eb7384c8321a495b751f41571a05dff1
Instruction ID: e736de5a13f17702e0363cdb457fb5e57eddf361f99a3f5e4ac2eab346277f4c
Opcode Fuzzy Hash: be7a350864282cf02b25325b68422cc7eb7384c8321a495b751f41571a05dff1
Instruction Fuzzy Hash: 4522AE70900219DFDB10DF68CD55BEEBBB4FF15308F144298E809AB282DBB49A44DFA1

Function 00E35A9F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,00E35DE5,00F44C90,?,?,?,00D000E6,?,28CB4BA0,?,?,?,00D481B7), ref: 00E35AB1
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00E35DE5,00F44C90,?,?,?,00D000E6,?,28CB4BA0,?,?), ref: 00E35AC6
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D481B7), ref: 00E35B42

Strings

AtlThunk_DataToCode, xrefs: 00E35B05
AtlThunk_InitData, xrefs: 00E35AEE
AtlThunk_AllocateData, xrefs: 00E35AD7
atlthunk.dll, xrefs: 00E35AC1
AtlThunk_FreeData, xrefs: 00E35B1C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 5b1be7f1d79399e198da10ee352b99b8c501348a3933b861a49ed84102001ba1
Instruction ID: 11c079eb74c5ebdc20fe1f26161fd3a14466197fdc140b69b2eec148cce97449
Opcode Fuzzy Hash: 5b1be7f1d79399e198da10ee352b99b8c501348a3933b861a49ed84102001ba1
Instruction Fuzzy Hash: 3601F972642B04BFCB21A7209D4BFEBBF995F1274AF081050FD0677392EB91D908D196

Function 00DE0BE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00DA29D0: __Init_thread_footer.LIBCMT ref: 00DA2AA2

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,28CB4BA0,00000000,00000000), ref: 00DE0C34
GetTempPathW.KERNEL32(00000104,?), ref: 00DE0CC9
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00DE0CFA
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00DE0D2D
CopyFileW.KERNEL32(?,?,00000000), ref: 00DE0D4F
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00DE0D7E

Strings

shim_clone, xrefs: 00DE0CEE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderInit_thread_footerNameRevert
String ID: shim_clone
API String ID: 4264308349-3944563459
Opcode ID: be1a82056a4e65085a4d3aa0b7bd7eca64567d4d8d2f065baa8ac580ad7523ca
Instruction ID: 4eb461fbbd32df3508fe9e096b7ad13eb3c5e454577493773341a0612bc5b9cb
Opcode Fuzzy Hash: be1a82056a4e65085a4d3aa0b7bd7eca64567d4d8d2f065baa8ac580ad7523ca
Instruction Fuzzy Hash: 7C512930A402589EDB20EF65CC45BAEBBF9EF44700F1441A9F409A72C1DBB09E84CBA0

Function 00DC2810 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 224
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 00DC29D1
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 00DC2A30
SetEndOfFile.KERNEL32(?), ref: 00DC2A39
CloseHandle.KERNEL32(?), ref: 00DC2A52

Strings

Not enough disk space to extract file:, xrefs: 00DC28DB
%sholder%d.aiph, xrefs: 00DC29AD

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:
API String ID: 22866420-929304071
Opcode ID: 6e5e759cdcbc0f3d7db4803a71cca3ab962b0ad4b1738e680fb44de04a1fd941
Instruction ID: 249db76b75d3970c4c6e0a3ec039e7855b88daac1efa93dca49db8457f7c1bc5
Opcode Fuzzy Hash: 6e5e759cdcbc0f3d7db4803a71cca3ab962b0ad4b1738e680fb44de04a1fd941
Instruction Fuzzy Hash: B2818F71A0020A9FDB10DF68CC45BAEB7A5EF49714F18462DF925E7391EB319D01CBA0

Function 00DE1080 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,28CB4BA0,28CB4BA0,?,00F44C50,?,?,00DC3989,?,28CB4BA0,?,?,?,00000000,00EA10D5), ref: 00DE10E5
GetFileVersionInfoW.KERNELBASE(?,?,00000000,?,00000000,?,00F44C50,?,?,00DC3989,?,28CB4BA0,?,?,?,00000000), ref: 00DE1133
VerQueryValueW.KERNELBASE(?,\VarFileInfo\Translation,00DC3989,?,?,00F44C50,?,?,00DC3989,?,28CB4BA0,?,?,?,00000000,00EA10D5), ref: 00DE116D

Strings

\VarFileInfo\Translation, xrefs: 00DE1167
ProductName, xrefs: 00DE1193
\StringFileInfo\%04x%04x\%s, xrefs: 00DE119D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2179348866-2149928195
Opcode ID: d4d92bd9e5cb1651a9ee6452e82defcc113ba479dfea9f886341aeeedc34da2c
Instruction ID: 90c20756fad00a44b2468f5d0dacd9019690ca56763f75449ec7e263c4616407
Opcode Fuzzy Hash: d4d92bd9e5cb1651a9ee6452e82defcc113ba479dfea9f886341aeeedc34da2c
Instruction Fuzzy Hash: 0F71B375A0124A9FDB14EFA9CC46AAEB7F9FF05314F188169E911E7291D7309D00CBA0

Function 00DDF2F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,-00000400,?,00000002,00000400,28CB4BA0,?,?,?,?,?), ref: 00DDF396
GetLastError.KERNEL32(?,?,?,?), ref: 00DDF3A4
ReadFile.KERNEL32(?,00000000,00000400,000000FF,00000000,?,?,?,?), ref: 00DDF3BF

Strings

ADVINSTSFX, xrefs: 00DDF3F3, 00DDF4AE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 03bcfedd92a5bc073cafa1034ad10d8791d99e7d52ea01b35efa419528bdba9f
Instruction ID: 2a99b6209dc356ed9c244d1a480ebad74a9b2d4b31a3164a10f170bea8891366
Opcode Fuzzy Hash: 03bcfedd92a5bc073cafa1034ad10d8791d99e7d52ea01b35efa419528bdba9f
Instruction Fuzzy Hash: DA61A171A002099BDB10CFA8C985BAFBBB9FF45324F294266E516A7381D734DD46CB70

Function 00CB27B1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,00000024), ref: 00CB2850
GetWindowLongW.USER32(?,000000FC), ref: 00CB2865
CallWindowProcW.USER32(?,?,00000082,?,00000024), ref: 00CB287B
GetWindowLongW.USER32(?,000000FC), ref: 00CB2895
SetWindowLongW.USER32(?,000000FC,?), ref: 00CB28A5

Strings

$, xrefs: 00CB27F9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: d88a83f0b23b1ace31faffd6e91b06cdee0463148d637a32fb999e1b2d73b755
Instruction ID: 4406caa3763b4ac25baa94ab08fb367aa951def651fd3585d314db4ec2f1432c
Opcode Fuzzy Hash: d88a83f0b23b1ace31faffd6e91b06cdee0463148d637a32fb999e1b2d73b755
Instruction Fuzzy Hash: 35411272508700AFC720DF19D884A5BBBF5FF99720F504A1DF9A6836A0D772E9448F51

Function 00D8DDA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,28CB4BA0,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 00D8DDE3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00D8DE0C
RegCreateKeyExW.KERNEL32(?,00CB7229,00000000,00000000,00000000,?,00000000,00000000,?,28CB4BA0,?,?,?,00000000,?,Function_001BDD00), ref: 00D8DE59
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 00D8DE6C

Strings

Advapi32.dll, xrefs: 00D8DDDE
RegCreateKeyTransactedW, xrefs: 00D8DE06

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-2994018265
Opcode ID: 4224e47394831791f49411056e05967b2582f7dd487e9210dc70f99322053047
Instruction ID: 14d1543c214b05033f4fcc199ba74d1d63cf05a638bbac52da056e9968fad4ee
Opcode Fuzzy Hash: 4224e47394831791f49411056e05967b2582f7dd487e9210dc70f99322053047
Instruction Fuzzy Hash: 2B31B472640209AFEB259F45DC45FABB7A9FB54B50F14412AF905EB2C0E771A800C7A0

Function 00D6D900 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,28CB4BA0,?,?,?,?,?,Function_001BDD00,000000FF,?,00D9EE1C,?,?,000000FF), ref: 00D6D943
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 00D6D96C
RegOpenKeyExW.KERNEL32(?,28CB4BA0,00000000,?,00000000,28CB4BA0,?,?,?,?,?,Function_001BDD00,000000FF,?,00D9EE1C,?), ref: 00D6D9A5
RegCloseKey.ADVAPI32(00000000,?,?,?,Function_001BDD00,000000FF,?,00D9EE1C,?,?,000000FF), ref: 00D6D9B8

Strings

Advapi32.dll, xrefs: 00D6D93E
RegOpenKeyTransactedW, xrefs: 00D6D966

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 807aa7a8d00bb085607755a4c97369de23c8b8a50dac662d7f81250fd01e5007
Instruction ID: ce351339e27a7021085c71e33d40115ad540cb5364abf47a14d9bab713fa587e
Opcode Fuzzy Hash: 807aa7a8d00bb085607755a4c97369de23c8b8a50dac662d7f81250fd01e5007
Instruction Fuzzy Hash: 8B21A372B04209EFEB158F55EC45B6BBBB9FB45750F04852BF815E7290E771A800CB60

Function 00DBD210 Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 00DBD230
GetWindowRect.USER32(00000000,?), ref: 00DBD246
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00DBCFF7,?,00000000), ref: 00DBD25F
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,00DBCFF7,?), ref: 00DBD26A
GetDlgItem.USER32(?,000003E9), ref: 00DBD27C
GetWindowRect.USER32(00000000,?), ref: 00DBD292
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206), ref: 00DBD2D8

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: 2dcbd4b9b82546852634c31fbc2a0c03402e90269d091c972b4f125c9a914cb8
Instruction ID: 0431257f830eeb783f8493ac1fb5e9dffeccd9f389910514f37759e5345164ba
Opcode Fuzzy Hash: 2dcbd4b9b82546852634c31fbc2a0c03402e90269d091c972b4f125c9a914cb8
Instruction Fuzzy Hash: 6F217A74614304AFE300DF34DC49B6ABBE9EF89304F108619F859AA2A1E770E945CB62

Function 00DC0FF0 Relevance: 9.4, APIs: 6, Instructions: 354fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,28CB4BA0,?,?,00000002,?,?,?,?,?,?,00000000,00EA0932), ref: 00DC1047
GetLastError.KERNEL32(?,00000002), ref: 00DC12D9
GetLastError.KERNEL32(?,00000002), ref: 00DC1383
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,00EA0932,000000FF,?,00DBFF4A,00000010), ref: 00DC1056

Part of subcall function 00DA2230: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,28CB4BA0,00000008,00000000), ref: 00DA227B
Part of subcall function 00DA2230: GetLastError.KERNEL32 ref: 00DA2285

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 00DC1118
ReadFile.KERNEL32(?,28CB4BA0,00000000,00000000,00000000,00000001,?,00000002), ref: 00DC1195

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: 91f4c976733624ef17da0a500b737c7e3b2638b2a0f699d7549b82957a3873e8
Instruction ID: 9924fb971d6be2d49e13fc4cbec760514e07963402a5a4b179d30c9448e703ee
Opcode Fuzzy Hash: 91f4c976733624ef17da0a500b737c7e3b2638b2a0f699d7549b82957a3873e8
Instruction Fuzzy Hash: 9FD19475D0021ADFDB00DFA8C885BAEF7B5FF45314F188269E815AB392DB749905CBA0

Function 00DE0F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00DE0BE0: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,28CB4BA0,00000000,00000000), ref: 00DE0C34
Part of subcall function 00DE0BE0: GetTempPathW.KERNEL32(00000104,?), ref: 00DE0CC9
Part of subcall function 00DE0BE0: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 00DE0CFA
Part of subcall function 00DE0BE0: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 00DE0D2D

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,28CB4BA0,00000000,?,?,00000000,00EA70A5,000000FF,Shlwapi.dll,00DE0F26,?,?,00000010), ref: 00DE0FBD
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,00000010), ref: 00DE0FE9
GetLastError.KERNEL32(?,00000010), ref: 00DE102E
DeleteFileW.KERNEL32(?), ref: 00DE1041

Strings

Shlwapi.dll, xrefs: 00DE0F70, 00DE0FA8

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$InfoPathTempVersionWow64$DeleteDisableErrorFolderLastNameRedirectionSize
String ID: Shlwapi.dll
API String ID: 1841109139-1687636465
Opcode ID: 3a470e834994dfe22badc07db438672d0d1227a4abc99bfa0933bece00c7570b
Instruction ID: 0f7179be64dd13cec7d91f265a4d317f7cf5919ab32a27e6976bbd1640718c47
Opcode Fuzzy Hash: 3a470e834994dfe22badc07db438672d0d1227a4abc99bfa0933bece00c7570b
Instruction Fuzzy Hash: 33316575A002499BDB21DFA5C944BEFBBB8FF05350F14411AE815B3280D7359A45CB71

Function 00DE0810 Relevance: 7.7, APIs: 5, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,28CB4BA0,?,?,00000000,?,?,?,?,00EA6FED,000000FF,?,00DC1C3D), ref: 00DE0850
CreateThread.KERNEL32(00000000,00000000,00DE0BD0,?,00000000,?), ref: 00DE0886
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00DE098F
GetExitCodeThread.KERNEL32(00000000,?), ref: 00DE099A
CloseHandle.KERNEL32(00000000), ref: 00DE09BA

Part of subcall function 00CB2970: RaiseException.KERNEL32(?,?,00000000,00000000,00E35A3C,C000008C,00000001,?,00E35A6D,00000000,?,00CA91C7,00000000,28CB4BA0,00000001,?), ref: 00CB297C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateThread$CloseCodeEventExceptionExitHandleObjectRaiseSingleWait
String ID:
API String ID: 3595790897-0
Opcode ID: c5b2bfb03ea229f603c5a0fee3821fa65a5da7127745da3deac5eb824cf8cfd2
Instruction ID: b3895a4f13dfaffcffc26888b89cc1ec4bef613409890dcaaba0f6773de8a5a1
Opcode Fuzzy Hash: c5b2bfb03ea229f603c5a0fee3821fa65a5da7127745da3deac5eb824cf8cfd2
Instruction Fuzzy Hash: 24517A74A007099FDB10DF69C884BAEBBF4FF48710F284659E956A7392D770A844CFA0

Function 00DA45A0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

PathIsUNCW.SHLWAPI(?,?), ref: 00DA4736
_wcschr.LIBVCRUNTIME ref: 00DA4752

Strings

\\?\, xrefs: 00DA4718, 00DA471E
\\?\UNC\, xrefs: 00DA4631, 00DA46A9, 00DA46AF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$HeapPathProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 660126660-3019864461
Opcode ID: 91733d61667421faecd3f3f6e2b8cb2bf5967dd6f0705db428712c4843eb32d7
Instruction ID: 9eeefe0f8d9e8d3192d5d0a05ef24ccc30a9cdd14371b888fa59704368960938
Opcode Fuzzy Hash: 91733d61667421faecd3f3f6e2b8cb2bf5967dd6f0705db428712c4843eb32d7
Instruction Fuzzy Hash: DDC19271A016499FDB00DBA8CC45BAEF7F9FF86314F188269E415E72D1DBB49904CBA0

Function 00DBDCC0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 326COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,28CB4BA0,?,00000010,?), ref: 00DBDF8A

Part of subcall function 00DCEAB0: GetCurrentProcess.KERNEL32 ref: 00DCEAF8
Part of subcall function 00DCEAB0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 00DCEB05
Part of subcall function 00DCEAB0: GetLastError.KERNEL32 ref: 00DCEB0F
Part of subcall function 00DCEAB0: CloseHandle.KERNEL32(00000000), ref: 00DCEBF0

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

Strings

Extraction path set to:, xrefs: 00DBDFDD
[WindowsVolume], xrefs: 00DBDD50, 00DBDD62, 00DBDD6C
\\?\, xrefs: 00DBDF97

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Process$Init_thread_footer$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$[WindowsVolume]$\\?\
API String ID: 699919280-3538578949
Opcode ID: d6d358bfe781c3546c8ba00280b32875e8ade89a050ac3c36ad8d98a8d56a3cd
Instruction ID: 99b815cef16ad73b6b04008bcb55a53193a7b01ff0c1b50a78302867fbae6693
Opcode Fuzzy Hash: d6d358bfe781c3546c8ba00280b32875e8ade89a050ac3c36ad8d98a8d56a3cd
Instruction Fuzzy Hash: 0FC1C230A01646DFDB10DF68C885BEEF7B5EF45314F148268E456AB292EB70DD05CBA1

Function 00DDC240 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 229filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,28CB4BA0,?,000000FF,?,00000000,00EA62A6,000000FF,?,00DDC45A,000000FF,?,00000001), ref: 00DDC27A
GetLastError.KERNEL32(?,00DDC45A,000000FF,?,00000001), ref: 00DDC284

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

ReadFile.KERNEL32(?,?,00007F90,00000000,00000000,28CB4BA0,?,000000FF,?,00000000,00EA62A6,000000FF,?,00DDC45A,000000FF,?), ref: 00DDC2C7

Strings

\\.\pipe\ToServer, xrefs: 00DDC4E4, 00DDC4F5, 00DDC4FF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: ffbc6eceeece3ed928e3090371fc4cb91e28a641b39e546d27d021611509014a
Instruction ID: 0f88b679f26ef530a78716fa72309494ea4b0169ce69611a203fa6cc09f17a75
Opcode Fuzzy Hash: ffbc6eceeece3ed928e3090371fc4cb91e28a641b39e546d27d021611509014a
Instruction Fuzzy Hash: F271D371604209EFDB14DF58D805BAEB7B9FF45724F14862EF8259B380DB75A900DBA0

Function 00DB6200 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,28CB4BA0,?,00000010,?,00DB9550,?), ref: 00DB6266
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 00DB62AF
ReadFile.KERNEL32(00000000,28CB4BA0,?,?,00000000,00000078,?), ref: 00DB62ED
CloseHandle.KERNEL32(00000000), ref: 00DB6339

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: f01d08169383b9f43136e6c314f0cf41f67e638935ffa3a7b06246b150c32441
Instruction ID: baf1bd3ad2163a3957a8e19cab2110c82a6a4b2273e5b8960b2919f6bb9cdc2a
Opcode Fuzzy Hash: f01d08169383b9f43136e6c314f0cf41f67e638935ffa3a7b06246b150c32441
Instruction Fuzzy Hash: CF419D70900609EBDB10DF98CD89BEEB7B9EF45724F188259E412B72D1D7749D04CB60

Function 00DE12C0 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,?,28CB4BA0,?,?,00000000,00E5D670,000000FF,?,00DE12A8,00000000,80004005,?,00F44C50,?,?), ref: 00DE12F7
GetExitCodeThread.KERNEL32(00000001,80004005,?,?,00000000,00E5D670,000000FF,?,00DE12A8,00000000), ref: 00DE1311
TerminateThread.KERNEL32(00000001,00000000,?,?,00000000,00E5D670,000000FF,?,00DE12A8,00000000), ref: 00DE1329
CloseHandle.KERNEL32(00000001,?,?,00000000,00E5D670,000000FF,?,00DE12A8,00000000,80004005,?,00F44C50,?,?,00DC3989), ref: 00DE1332

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: 19ba66868cb481cbf8ddb3d40f297e3e4ce7f72003625509653233a880514c6f
Instruction ID: a824537643d4dba8be2bb019ead1b2768e560b95ab42393ff3380335628ae3c1
Opcode Fuzzy Hash: 19ba66868cb481cbf8ddb3d40f297e3e4ce7f72003625509653233a880514c6f
Instruction Fuzzy Hash: AA01B575504745EFD7209F55CD05BA7B7FDFB04720F00472DE866A2AA0DB70A804CB50

Function 00DBCFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00DBC783,00000000), ref: 00DBCFA0
DestroyWindow.USER32(?), ref: 00DBD057

Strings

(0, xrefs: 00DBD031

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID: (0
API String ID: 1182162058-3012264354
Opcode ID: 2ae16935b32fd3d10e27845292b1a3e9995290e156aaacab06a4df04762be8f4
Instruction ID: 294cf2e882c5c121096d73e48518e648f16aba23795e21602dada6ae9da6b30e
Opcode Fuzzy Hash: 2ae16935b32fd3d10e27845292b1a3e9995290e156aaacab06a4df04762be8f4
Instruction Fuzzy Hash: 032127716001098BEB20AF18EC027EA77A4EB55320F040266FC05C7390DB76EC61DBF1

Function 00E4EF42 Relevance: 4.7, APIs: 3, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 00E4F0F1

Part of subcall function 00E4DC17: RtlAllocateHeap.NTDLL(00000000,00000000,00E4D0E1,?,00E4EE85,?,00000000,?,00E3F625,00000000,00E4D0E1,?,?,?,?,00E4CEDB), ref: 00E4DC49

__freea.LIBCMT ref: 00E4F106
__freea.LIBCMT ref: 00E4F116

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID:
API String ID: 2243444508-0
Opcode ID: e92e016b0fe966bee3bb9347e6fb1da827a22895826301500af8a86724c6e1f5
Instruction ID: 09110dd2b06dbd6303c15c7fa24cf087b6871a011dc98ec07c02a7d857c0cc4b
Opcode Fuzzy Hash: e92e016b0fe966bee3bb9347e6fb1da827a22895826301500af8a86724c6e1f5
Instruction Fuzzy Hash: 2E51C272601216AFEB249F64EC81EBB7AA9EB44758F151138FC08F7242EB70DD148760

Function 00DC0B10 Relevance: 4.7, APIs: 3, Instructions: 196fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,28CB4BA0,?,?), ref: 00DC0B77
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 00DC0C84

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 2a20e061c6e2e273d869e1021af16b26e99064ae3ce0653db4427ea3736a78a7
Instruction ID: 9540f49b46717e617f37514b2c698ee0c334edc83d6cc498fe7715fc089486f3
Opcode Fuzzy Hash: 2a20e061c6e2e273d869e1021af16b26e99064ae3ce0653db4427ea3736a78a7
Instruction Fuzzy Hash: BB616F71D00609DFDB14DFA8D945B9DFBB4FF09720F14826AE825A7390DB75A904CBA0

Function 00DBE0A0 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,28CB4BA0,?,?,?,80004005,?,00000000), ref: 00DBE13E
GetLastError.KERNEL32(?,?,?,80004005,?,00000000), ref: 00DBE176
GetLastError.KERNEL32(?,?,?,?,80004005,?,00000000), ref: 00DBE20F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 7290f00bdbd8acc3f95c1a1313a8b7a5557866d43b5dc6bd57a22a34f57ae8c6
Instruction ID: dddc8545a50a82790dbd46d1cd2281fa03564d435a4c637d5b8e87a57a6c40ea
Opcode Fuzzy Hash: 7290f00bdbd8acc3f95c1a1313a8b7a5557866d43b5dc6bd57a22a34f57ae8c6
Instruction Fuzzy Hash: B351E271A00A05DFDB20DF69CC41BEAF7B5FF45320F148669E92697390EB71A905CBA0

Function 00DA4920 Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,28CB4BA0,?,?,7622E010,00000000,00E9AAC5,000000FF,?,00DE32A7,00000000,.part,00000005), ref: 00DA496B
CreateDirectoryW.KERNEL32(000000FF,00000000,?,?,00ED2A4C,00000001,?), ref: 00DA4A2A
GetLastError.KERNEL32 ref: 00DA4A38

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: d9bfa0bf39118844b43e2706d28b30de7dd9d97932113bbfd9dc016d731b074c
Instruction ID: a17a99aa8af89d49a0fe6519a997c468a0fb76892e8d85fc5c53991702d7b8a1
Opcode Fuzzy Hash: d9bfa0bf39118844b43e2706d28b30de7dd9d97932113bbfd9dc016d731b074c
Instruction Fuzzy Hash: AD619E31E002099FDB10DFA8C886BAEFBF4EF56324F248259E415A72D1DB75A905CB70

Function 00E4C63C Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00E4C636,?,00E3AD12,?,?,28CB4BA0,00E3AD12,?), ref: 00E4C64D
TerminateProcess.KERNEL32(00000000,?,00E4C636,?,00E3AD12,?,?,28CB4BA0,00E3AD12,?), ref: 00E4C654
ExitProcess.KERNEL32 ref: 00E4C666

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 850b51503323ec033171a6129a65bf5a1470d2df7c031be65aafc3b92937bbf5
Instruction ID: 8fd82f923482837d5e354218d9026726c4faeea9e3bcb2baeb7ec754b25f9961
Opcode Fuzzy Hash: 850b51503323ec033171a6129a65bf5a1470d2df7c031be65aafc3b92937bbf5
Instruction Fuzzy Hash: 73D09E31002504AFCF412F65ED0D85E3F69EF44745B25B150B90676231CF719956DA94

Function 00DB6660 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 312COMMON

Download Yara Rule

APIs

Part of subcall function 00DB64D0: GetTickCount.KERNEL32 ref: 00DB6554
Part of subcall function 00DB64D0: __Xtime_get_ticks.LIBCPMT ref: 00DB655C
Part of subcall function 00DB64D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DB65A6

Part of subcall function 00DDA240: GetUserNameW.ADVAPI32(00000000,?), ref: 00DDA2CE
Part of subcall function 00DDA240: GetLastError.KERNEL32 ref: 00DDA2D4
Part of subcall function 00DDA240: GetUserNameW.ADVAPI32(00000000,?), ref: 00DDA31C
Part of subcall function 00DDA240: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 00DDA352
Part of subcall function 00DDA240: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 00DDA39C

__Init_thread_footer.LIBCMT ref: 00DB67A1

Strings

\/:*?"<>|, xrefs: 00DB6763

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: EnvironmentNameUserVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|
API String ID: 2099558200-3830478854
Opcode ID: 11d0888ae680b18e0fbda6d6a8b46849c55672e4e99b105c78e1c1e83b2c423b
Instruction ID: 3ad8db15cfc2cbb73e0c8526e9ff5ba67a825bf39c72827d4802c67606c6be82
Opcode Fuzzy Hash: 11d0888ae680b18e0fbda6d6a8b46849c55672e4e99b105c78e1c1e83b2c423b
Instruction Fuzzy Hash: F7D1B074D00258DFDB14DF64C855BEDBBB1BF16308F184298D409AB282DBB45E48DFA1

Function 00DA4C60 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,28CB4BA0), ref: 00DA4E00

Part of subcall function 00DA4EC0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 00DA4ECD

Strings

USERPROFILE, xrefs: 00DA4CAE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: 68306f99df2ae3edfbefefd7c51a78897889d336621fb2b4d7492a94761c1bb4
Instruction ID: e294781d6962b0f5bf352a51f8b0f6e14b5828a179c17fbc7f193d5493ee3b07
Opcode Fuzzy Hash: 68306f99df2ae3edfbefefd7c51a78897889d336621fb2b4d7492a94761c1bb4
Instruction Fuzzy Hash: 7561C271A006099FDB14DF68C859BAEB7B4FF85324F14866DF819DB391DB709A00CBA1

Function 00D04BF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 00D04CC1

Strings

$, xrefs: 00D04C2D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: LongWindow
String ID: $
API String ID: 1378638983-3993045852
Opcode ID: d8ab8f68778b34d4fb10e8a2065ae419fa2af44faf3d5cc693f16890870ebad9
Instruction ID: e45baf26f37d34c01254978ee1c0c6c9b3f99738f47ef5ee95a6fbd82c005860
Opcode Fuzzy Hash: d8ab8f68778b34d4fb10e8a2065ae419fa2af44faf3d5cc693f16890870ebad9
Instruction Fuzzy Hash: 0331BCB1104340DFDB149F09C884B1ABBF0BF88710F08455DFA998B2A5D376D954CBA1

Function 00E5327C Relevance: 3.2, APIs: 2, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E52DAC: GetOEMCP.KERNEL32(00000000,?,?,?,?), ref: 00E52DD7

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,?,?,?,?,00E530C3,?,00000000,?,?,?), ref: 00E532DD
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E530C3,?,00000000,?,?,?), ref: 00E5331F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: bbe52cf0f81e5e0d167d0fcfb28607c88de513e396b38947bbe9dd536c3d2357
Instruction ID: a8e32ab6a69b41ea748752b2dcba617e21ae44e34c6a2f950693d92d4da23d0e
Opcode Fuzzy Hash: bbe52cf0f81e5e0d167d0fcfb28607c88de513e396b38947bbe9dd536c3d2357
Instruction Fuzzy Hash: E2516970A003048FDB21CF75C8406AEFBF5EF41345F14986ED8A6A7252DB749A0DCB50

Function 00DE18E0 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00DE1931
EndDialog.USER32(00000000,00000001), ref: 00DE1940

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: 4e79cb10a0507fac7c57838b9bdf52547af6c1df71fdece194b3ad8bf77049ba
Instruction ID: 3717a76a98dea7190b62013fe7007c16e9c2bd96e11b364e0b69c65712309dde
Opcode Fuzzy Hash: 4e79cb10a0507fac7c57838b9bdf52547af6c1df71fdece194b3ad8bf77049ba
Instruction Fuzzy Hash: 63518B34A01B85DFD711CF69C948B4AFBF4FF49310F1882ADD455AB2A1D770AA04CBA1

Function 00DDF6D0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 00DDF735
CloseHandle.KERNEL32(?), ref: 00DDF789

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID:
API String ID: 10933145-0
Opcode ID: ed49bb67792d712aeaa1f79496747eadcb0b9f30093f99965f0e1d4dc2d6430e
Instruction ID: 7581cf8aaacdca959ca5fc26f700b51a489b01be266cb6a20702559be502d250
Opcode Fuzzy Hash: ed49bb67792d712aeaa1f79496747eadcb0b9f30093f99965f0e1d4dc2d6430e
Instruction Fuzzy Hash: 05216075A08A09AFD304DF19DC48B96B7F8FB05714F04422AE825D73A1EB78D904DB90

Function 00DA0F40 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA2350: LoadLibraryW.KERNEL32(ComCtl32.dll,28CB4BA0,00000000,?,00000000), ref: 00DA238E
Part of subcall function 00DA2350: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00DA23B1
Part of subcall function 00DA2350: FreeLibrary.KERNEL32(00000000), ref: 00DA242F

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00DA0F84
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DA0F8F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: 883f28fedbb253709906240877af6a480a042fd44364a536c84efbb7c72073c3
Instruction ID: fe5a76f8cf9b5a81287f03d15574156500138e5e295b29da53e1403d3b84f87a
Opcode Fuzzy Hash: 883f28fedbb253709906240877af6a480a042fd44364a536c84efbb7c72073c3
Instruction Fuzzy Hash: 5CF030327812183BFA60215A5C47F67B64DD786B64F14426AFB98AB6C2ECC77C0102E8

Function 00E50308 Relevance: 3.0, APIs: 2, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,00E4F030,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00E5033C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,00E4F030,?,?,00000000,?,00000000), ref: 00E5035A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: String
String ID:
API String ID: 2568140703-0
Opcode ID: 66f5e7f7c2ac2cee786e8a2a0d0025698baaf626af0ee417952728fe6c6c29eb
Instruction ID: 24dbf634918f952c617197d4b59a035649cbfb86c5f1d1b983874a70026ef3aa
Opcode Fuzzy Hash: 66f5e7f7c2ac2cee786e8a2a0d0025698baaf626af0ee417952728fe6c6c29eb
Instruction Fuzzy Hash: F5F0643650051ABBCF126F91DC09EDE3F6ABB487A1F058520FE1825130CA32D871AB94

Function 00E4DBDD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,00E5221D,?,00000000,?,?,00E524BE,?,00000007,?,?,00E52B18,?,?), ref: 00E4DBF3
GetLastError.KERNEL32(?,?,00E5221D,?,00000000,?,?,00E524BE,?,00000007,?,?,00E52B18,?,?), ref: 00E4DBFE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 0b8a1d2e72f00ef2ec49191ee4cef075ceff7e9b4b59c6f7de0f6ac214446964
Instruction ID: c88b2d85194ddeb57bda64dfbeb25cddc9f9c3ff7cb2037592d4467ab32f0fab
Opcode Fuzzy Hash: 0b8a1d2e72f00ef2ec49191ee4cef075ceff7e9b4b59c6f7de0f6ac214446964
Instruction Fuzzy Hash: F1E08631104214AFDB113FA5BD0D79A7BA9AB00795F045024F609AA161DA709884CB90

Function 00DC3E40 Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,00DC4020,?), ref: 00DC3E8B

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: 9f15ae25ba12c374f2a1156d683ab265f42d154c78276f1ae08096d955b352c7
Instruction ID: 65ef0ecc4c237268f94c41857657944ce932063ec882f0c4d7d749a994ee12db
Opcode Fuzzy Hash: 9f15ae25ba12c374f2a1156d683ab265f42d154c78276f1ae08096d955b352c7
Instruction Fuzzy Hash: C1616C71A0160A9FDB14DF68C885F9ABBF4FF08304F14466DE914AB681E771EE45CBA0

Function 00E52E80 Relevance: 1.6, APIs: 1, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,00E530CF,00E530C3,00000000), ref: 00E52EB2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Info
String ID:
API String ID: 1807457897-0
Opcode ID: 2d7327990828a1b7c90a5feca65e2dd0668a1188d4c912088b0a3088ed46c628
Instruction ID: ddb42d4ab09e067b4adf88b528f60eed804394d976a5c562a4062ad903113afc
Opcode Fuzzy Hash: 2d7327990828a1b7c90a5feca65e2dd0668a1188d4c912088b0a3088ed46c628
Instruction Fuzzy Hash: 73516E716042489ADB218A24DC84AF67BB8EB56304F2419EDE99AF7182D3319D4ADF30

Function 00DC2AB0 Relevance: 1.6, APIs: 1, Instructions: 138fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,28CB4BA0), ref: 00DC2ADB

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 026ea5e1cde5f0ac7e21d8bbc756ec4c0d71f900b049cbbaaf1a478ba817fc66
Instruction ID: 6baa3f810d7f83ab1b1f2083fbb7d3dbdb4a82636ef17c114af1583db71ca1e7
Opcode Fuzzy Hash: 026ea5e1cde5f0ac7e21d8bbc756ec4c0d71f900b049cbbaaf1a478ba817fc66
Instruction Fuzzy Hash: E041F071900616EFDB10DF68C985FAAFBB4FB04710F0482A9E914EB296D771AD00CBB0

Function 00DA2890 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00DA2B00: __Init_thread_footer.LIBCMT ref: 00DA2B76

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

__Init_thread_footer.LIBCMT ref: 00DA2970

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: 989e86fa2e2b699bd93c4ac89728e6ff0ccdafa4a0a0afdcc66fab90fe1401a0
Instruction ID: f39de31bda94be6adca2dca4ec099073556415e9b42791ad4ca544f86e6becda
Opcode Fuzzy Hash: 989e86fa2e2b699bd93c4ac89728e6ff0ccdafa4a0a0afdcc66fab90fe1401a0
Instruction Fuzzy Hash: F531F0B49806489BD710DF08EC86B66B7E1F723B14F114229EC11CB7D0D7B6A804EFA6

Function 00DDF850 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,00DC1B50,?,00000000,00000000,?,?), ref: 00DDF86D

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Part of subcall function 00DDF940: WaitForSingleObject.KERNEL32(?,000000FF,28CB4BA0,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DDF974

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AllocCreateFileHeapObjectSingleWait
String ID:
API String ID: 2723504993-0
Opcode ID: d361c16da8aa54dcde422a7e2be8279beeb1b2f05fdd275fce0b9b8a69ecd013
Instruction ID: 5cb945503e0fdabe5bc191e10766e55a2b07060c859e990492d3dbe3fd8c5393
Opcode Fuzzy Hash: d361c16da8aa54dcde422a7e2be8279beeb1b2f05fdd275fce0b9b8a69ecd013
Instruction Fuzzy Hash: 7D311974604B019FD324DF28D898B1AB7E0FF88304F24896EE59BD7360D731A950CB65

Function 00E4EE70 Relevance: 1.5, APIs: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E4DC17: RtlAllocateHeap.NTDLL(00000000,00000000,00E4D0E1,?,00E4EE85,?,00000000,?,00E3F625,00000000,00E4D0E1,?,?,?,?,00E4CEDB), ref: 00E4DC49

RtlReAllocateHeap.NTDLL(00000000,00000000,?,00E4D0E1,00000000,?,00E3F625,00000000,00E4D0E1,?,?,?,?,00E4CEDB,?,?), ref: 00E4EECD

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5a1c6b1d024484c18be2d3f77300f84734435e5c2d3e5f414d5efe155b499d58
Instruction ID: ff56f79b4c998adeb51e5559c758cfa2f9a7984f16d7f04ad850f6aa86c54bdc
Opcode Fuzzy Hash: 5a1c6b1d024484c18be2d3f77300f84734435e5c2d3e5f414d5efe155b499d58
Instruction Fuzzy Hash: E5F09632505615AADB213F26BC01FAF3BD9AF917B0F152129F928BA3A1DF70D84095A1

Function 00D87FE0 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

__Init_thread_footer.LIBCMT ref: 00D88052

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID:
API String ID: 2296764815-0
Opcode ID: 6d7a283f952ad4baa6bfd7766ff1d6d163399575b2cac00b009d7b7e0233c508
Instruction ID: 5065f951fb15e575ce35beef6fa70fd03bae3d1bd486f290f49a5a57acb11b5e
Opcode Fuzzy Hash: 6d7a283f952ad4baa6bfd7766ff1d6d163399575b2cac00b009d7b7e0233c508
Instruction Fuzzy Hash: 2201D4B1904744EBDB14DB68D946B49B7A0E746B20F104679E816D33E1DB35A904E722

Function 00DA2B00 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

Part of subcall function 00DA2BA0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 00DA2C0E
Part of subcall function 00DA2BA0: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 00DA2C55
Part of subcall function 00DA2BA0: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 00DA2C74
Part of subcall function 00DA2BA0: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 00DA2CA3
Part of subcall function 00DA2BA0: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 00DA2D18

__Init_thread_footer.LIBCMT ref: 00DA2B76

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: 92b6173444d0506daca2dc111703d142a49543422383a52492ae25915052b831
Instruction ID: cffb505d524453abf8421bfcb947a02dda95ea99c8894ee6845b6f680b52a5aa
Opcode Fuzzy Hash: 92b6173444d0506daca2dc111703d142a49543422383a52492ae25915052b831
Instruction Fuzzy Hash: 8001A2B1A40604EFCB10DF6CD946B197BA4EB06B20F144269ED25D77C5D734A90096A3

Function 00E4DC17 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,00E4D0E1,?,00E4EE85,?,00000000,?,00E3F625,00000000,00E4D0E1,?,?,?,?,00E4CEDB), ref: 00E4DC49

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: bf36728ef3f54d311c8372da6d8950ac388c0acbfab71460938bede6c4ca5c7e
Instruction ID: 7d71f4d55e49cf4c7bdb50c156084471b3357f7750b79ae8ab0a64943e578ff9
Opcode Fuzzy Hash: bf36728ef3f54d311c8372da6d8950ac388c0acbfab71460938bede6c4ca5c7e
Instruction Fuzzy Hash: 3FE0E5216086205BD7213E66BD49B5BB68C9B813A0F142110BC01FA191DBD0CC00C1A0

Function 00E4D049 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00E4D050

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: df4d15faea5114f62cdcd307508976fa15da06f1b63f39339f3c72eca88d2a66
Instruction ID: 55dcde645a39ac70ffd90b93702dd01ab82f4d142984216f374afbd9e0ea092f
Opcode Fuzzy Hash: df4d15faea5114f62cdcd307508976fa15da06f1b63f39339f3c72eca88d2a66
Instruction Fuzzy Hash: 82E09AB6C0120EAADB40DFE4C456BEFBBF8EB08310F509426A245F7141EA785744CBA1

Function 00CA8750 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00CA875B

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b82ae4e8cb293e48ab7d55f084c465b42f464f9d74854547e23e8087f946355d
Instruction ID: 23b70b63f35d21e10ff295af0c3c2fafc3af9d3b4ffee86dfc594c99c49b1dbe
Opcode Fuzzy Hash: b82ae4e8cb293e48ab7d55f084c465b42f464f9d74854547e23e8087f946355d
Instruction Fuzzy Hash: 6EC08C302007114BD7306B18BA0878332DC5B04704F004419B419D3200CB70DC08C654

Non-executed Functions

Function 00CA2F40 Relevance: 170.0, Strings: 134, Instructions: 2486COMMON

Download Yara Rule

Strings

AI_CountRowAction, xrefs: 00CA6223
WriteRegistryValues, xrefs: 00CA4FED
InstallInitialize, xrefs: 00CA5829
ODBCDataSource, xrefs: 00CA4115, 00CA5222
AppId, xrefs: 00CA4439, 00CA4E19
AI_XmlUninstall, xrefs: 00CA609A, 00CA6120
PatchSize, xrefs: 00CA4C44
AI_UninstallGroups, xrefs: 00CA5D2F
UnpublishComponents, xrefs: 00CA3DCB
6000, xrefs: 00CA5000
InstallODBC, xrefs: 00CA51FC, 00CA5282, 00CA5308
RemoveEnvironmentStrings, xrefs: 00CA47BD
RegisterTypeLibraries, xrefs: 00CA538E
AI_AppSearchEx, xrefs: 00CA5EA6, 00CA5ECC
Location, xrefs: 00CA5983, 00CA5A09
Complus, xrefs: 00CA4009, 00CA54B7
MsiAssembly, xrefs: 00CA5755
AI_DefaultActionCost, xrefs: 00CA62A0
AI_InstallPrerequisite, xrefs: 00CA5A2F
CostFinalize, xrefs: 00CA36DC
RemoveDuplicateFiles, xrefs: 00CA4843
WriteIniValues, xrefs: 00CA5073
AI_DownloadPrereq, xrefs: 00CA5923
RegisterProgIdInfo, xrefs: 00CA4EED
ODBCDriver, xrefs: 00CA4221, 00CA532E
AI_UninstallTasks, xrefs: 00CA5DAC
InstallServices, xrefs: 00CA5517
SelfReg, xrefs: 00CA408F, 00CA543A
AI_UninstallAccounts, xrefs: 00CA5CB2
ProgId, xrefs: 00CA4545, 00CA4F13
Registry, xrefs: 00CA432D, 00CA5013
FileSize, xrefs: 00CA4BBE
PublishComponents, xrefs: 00CA56A9
500, xrefs: 00CA5EB9
RegisterClassInfo, xrefs: 00CA4DF3
1500000, xrefs: 00CA552A
120000, xrefs: 00CA474A
30000, xrefs: 00CA3CD1, 00CA5086, 00CA5742
MIME, xrefs: 00CA45CB, 00CA4F90
AI_PreRequisite, xrefs: 00CA5949, 00CA59CF, 00CA5A55, 00CA5ADB
3000, xrefs: 00CA3AEF, 00CA3DDE, 00CA3E64, 00CA3FF6, 00CA431A, 00CA43A0, 00CA4426, 00CA44AC, 00CA4532, 00CA45B8, 00CA47D0, 00CA4E06, 00CA4F7D, 00CA53A1, 00CA54A4
RegisterFonts, xrefs: 00CA517F
1500, xrefs: 00CA4639, 00CA46C4, 00CA5BCB, 00CA6133
PatchFiles, xrefs: 00CA4BE4
Feature, xrefs: 00CA3E77, 00CA57D2
20000, xrefs: 00CA5636
BindImage, xrefs: 00CA4CF0, 00CA4D16
AI_ExtractPrereq, xrefs: 00CA59A9
RemoveFolders, xrefs: 00CA49CC
CreateShortcuts, xrefs: 00CA4D6D
100000, xrefs: 00CA58B9
RemoveShortcuts, xrefs: 00CA4737
UnregisterExtensionInfo, xrefs: 00CA4499
15000, xrefs: 00CA3EEA, 00CA3F70, 00CA4AEB, 00CA4C7D, 00CA4E83, 00CA55B0, 00CA57BF
RemoveFiles, xrefs: 00CA48C9, 00CA494F
AI_XmlInstall, xrefs: 00CA5B3B, 00CA5BB8
DuplicateFiles, xrefs: 00CA4C6A
UnregisterProgIdInfo, xrefs: 00CA451F
ProcessComponents, xrefs: 00CA3AA0
CostInitialize, xrefs: 00CA332D
AI_UserAccounts, xrefs: 00CA5CD8, 00CA5FC6
RemoveFile, xrefs: 00CA4975
AI_GxUninstall, xrefs: 00CA5E29
AI_Game, xrefs: 00CA5C5B, 00CA5E4F
3000000, xrefs: 00CA510C
IniFile, xrefs: 00CA46D7, 00CA5099
RemoveIniValues, xrefs: 00CA462B, 00CA46B1
RemoveExistingProducts, xrefs: 00CA2F64
AI_ProcessAccounts, xrefs: 00CA5FA0
8000, xrefs: 00CA407C, 00CA4294, 00CA5192, 00CA5427
AI_XmlElement, xrefs: 00CA5B61, 00CA60C0
FileCost, xrefs: 00CA3514
InstallFinalize, xrefs: 00CA58A6
AI_ProcessGroups, xrefs: 00CA5F23
Shortcut, xrefs: 00CA475D, 00CA4D93
12000, xrefs: 00CA4102, 00CA4188, 00CA420E, 00CA4856, 00CA48DC, 00CA4962, 00CA49DF, 00CA4A65, 00CA4D80, 00CA520F, 00CA5295, 00CA531B
RegisterMIMEInfo, xrefs: 00CA4F6A
~, xrefs: 00CA5A99
UnregisterClassInfo, xrefs: 00CA4413
Feature_, xrefs: 00CA3D20, 00CA44D2, 00CA4EA7, 00CA5766, 00CA595C, 00CA59E2, 00CA5A68, 00CA5AEE
DuplicateFile, xrefs: 00CA4869, 00CA4C90
CreateFolder, xrefs: 00CA49F2, 00CA4A78
InstallValidate, xrefs: 00CA38BE
PublishFeatures, xrefs: 00CA57AC
10000, xrefs: 00CA56BC, 00CA62B3
CreateFolders, xrefs: 00CA4A52
5000, xrefs: 00CA4D03
RegisterComPlus, xrefs: 00CA548C
MoveFile, xrefs: 00CA4AFE
ODBCTranslator, xrefs: 00CA419B, 00CA52A8
RemoveRegistryValues, xrefs: 00CA4307, 00CA438D
AI_XmlAttribute, xrefs: 00CA5BDE, 00CA6141
1800, xrefs: 00CA5B4E, 00CA60AD
UnregisterFonts, xrefs: 00CA4281
ServiceInstall, xrefs: 00CA553D
2000, xrefs: 00CA3185, 00CA5C48, 00CA5CC5, 00CA5D42, 00CA5DBF, 00CA5F36, 00CA5FB3, 00CA6030
Font, xrefs: 00CA42A7, 00CA51A5
RegisterExtensionInfo, xrefs: 00CA4E70
AI_GxInstall, xrefs: 00CA5C35
File, xrefs: 00CA3598, 00CA48EF, 00CA4B7F
AI_InstallPostPrerequisite, xrefs: 00CA5AB5
ServiceControl, xrefs: 00CA3EFD, 00CA3F83, 00CA5649
TypeLib, xrefs: 00CA53B4
Options, xrefs: 00CA5A8F, 00CA5B10
SelfUnregModules, xrefs: 00CA4069
100, xrefs: 00CA4BF7, 00CA4F00, 00CA5E3C
InstallFiles, xrefs: 00CA4B5E
UnpublishFeatures, xrefs: 00CA3E4C
AI_ScheduledTasks, xrefs: 00CA6043
Environment, xrefs: 00CA47E3, 00CA511F
Patch, xrefs: 00CA4C0A
AI_UserGroups, xrefs: 00CA5D55, 00CA5F49
StopServices, xrefs: 00CA3ED7, 00CA3F5D
UnregisterComPlus, xrefs: 00CA3FE3
RemoveODBC, xrefs: 00CA40EF, 00CA4175, 00CA41FB
MoveFiles, xrefs: 00CA4AD8
800, xrefs: 00CA390D
StartServices, xrefs: 00CA5623
AppSearch, xrefs: 00CA314B, 00CA31D4
Component, xrefs: 00CA33B6, 00CA377A, 00CA395C, 00CA3B3E
RemoveIniFile, xrefs: 00CA4651
MsiUnpublishAssemblies, xrefs: 00CA3C82
WriteEnvironmentStrings, xrefs: 00CA50F9
AI_ProcessTasks, xrefs: 00CA601D
MsiPublishAssemblies, xrefs: 00CA572F
Extension, xrefs: 00CA44BF, 00CA4E96
PublishComponent, xrefs: 00CA3DF1, 00CA56CF
RemoveRegistry, xrefs: 00CA43B3
AI_ChainProductsPseudo, xrefs: 00CA61A6
UnregisterMIMEInfo, xrefs: 00CA45A5
MsiConfigureServices, xrefs: 00CA559D, 00CA55C3
200000, xrefs: 00CA583C
Component_, xrefs: 00CA3E04, 00CA3F10, 00CA3FA5, 00CA401C, 00CA4128, 00CA41AE, 00CA4248, 00CA4340, 00CA43C6, 00CA4664, 00CA46EA, 00CA4770, 00CA47F6, 00CA487C, 00CA4902, 00CA4A05, 00CA4A8B, 00CA4B11, 00CA4B97, 00CA4CA3, 00CA4DA6, 00CA5026, 00CA50AC, 00CA5132, 00CA5235, 00CA52BB, 00CA5346, 00CA53C7, 00CA54CA, 00CA5550, 00CA55E5, 00CA565C, 00CA56E2
SelfRegModules, xrefs: 00CA5414

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: 100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$800$8000$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$~
API String ID: 0-2910470256
Opcode ID: 3984b806bff4083597aaeb15eecdfe6e6c060fde7e7f0f2f9fef8865601ac6c5
Instruction ID: a6c839af26cede5050aca2b291db32af13b36cc975bea67bf3c4a75f1519aca5
Opcode Fuzzy Hash: 3984b806bff4083597aaeb15eecdfe6e6c060fde7e7f0f2f9fef8865601ac6c5
Instruction Fuzzy Hash: 4133C520E853C9EAD700EBB89A1A71D3D619B53718F5452ACE5523B2E3CFB90B4CB351

Function 00CC41B0 Relevance: 48.2, APIs: 16, Strings: 11, Instructions: 961memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CC420A
VariantClear.OLEAUT32(?), ref: 00CC423C
VariantClear.OLEAUT32(?), ref: 00CC435F
VariantClear.OLEAUT32(?), ref: 00CC438E
SysFreeString.OLEAUT32(00000000), ref: 00CC4395
SysAllocString.OLEAUT32(00000000), ref: 00CC43E8
VariantClear.OLEAUT32(?), ref: 00CC4476
VariantClear.OLEAUT32(?), ref: 00CC44A8
VariantClear.OLEAUT32(?), ref: 00CC4609
VariantClear.OLEAUT32(?), ref: 00CC463C
SysFreeString.OLEAUT32(00000000), ref: 00CC4647
SysAllocString.OLEAUT32(00000000), ref: 00CC468A
SysFreeString.OLEAUT32(00000000), ref: 00CC4845

Part of subcall function 00CC5120: VariantClear.OLEAUT32(?), ref: 00CC5129

VariantClear.OLEAUT32(?), ref: 00CC47FB
VariantClear.OLEAUT32(?), ref: 00CC4837
SysAllocString.OLEAUT32(00000000), ref: 00CC4869

Strings

GetFontHeight, xrefs: 00CC5054
MsiGetBinaryPathIndirect, xrefs: 00CC4C6C
MsiGetBytesCountText, xrefs: 00CC4EC4
MsiResolveFormatted, xrefs: 00CC4AF7
MsiSetProperty, xrefs: 00CC48F0
MessageBox, xrefs: 00CC4DFC
MsiGetProperty, xrefs: 00CC499D
MsiEvaluateCondition, xrefs: 00CC4A5C
MsiGetFormattedError, xrefs: 00CC4FA1
MsiGetBinaryPath, xrefs: 00CC4BAA
MsiPublishEvents, xrefs: 00CC4D34

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 1305860026-3153392536
Opcode ID: 8a0598ae10cb577ba90f9a4d2d4c810a04ec0757102d330a571658e51dccdaaf
Instruction ID: 483ed12b5c13583250a7625cf989b85abf30c6ca2759509d3c550597038d0ff1
Opcode Fuzzy Hash: 8a0598ae10cb577ba90f9a4d2d4c810a04ec0757102d330a571658e51dccdaaf
Instruction Fuzzy Hash: 10926770D00219DFDB24CFA4CC94BDEBBB4BF49314F108299E459A7281EB74AA85DF94

Function 00DD77C0 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 514fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00F46078,C0000000,00000003,00000000,00000004,00000080,00000000,28CB4BA0,00F46054,00F4606C,?), ref: 00DD7837
GetLastError.KERNEL32 ref: 00DD7854
OutputDebugStringW.KERNEL32(00000000,00000020), ref: 00DD78CF
OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 00DD79CB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 00DD7A3C
WriteFile.KERNEL32(00000000,00F45920,00000000,00000000,00000000,?,0000001C), ref: 00DD7A6C
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,00EC58A8,00000002), ref: 00DD7B17
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00DD7B20
FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 00DD7A71

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 00DD7C12
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,0000001D), ref: 00DD7C98
FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 00DD7CA3
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,00EC58A8,00000002,?,?,CPU: ,00000005), ref: 00DD7D17
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00DD7D20
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,00EC58A8,00000002), ref: 00DD7DA5
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 00DD7DAE

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Strings

LOGGER->Reusing LOG file at:, xrefs: 00DD7973, 00DD7985, 00DD798F
workstation, xrefs: 00DD7ABE
LOGGER->failed to create LOG at:, xrefs: 00DD788A, 00DD789C, 00DD78A6
x64, xrefs: 00DD7AB1, 00DD7ABD
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 00DD7AE7
CPU: , xrefs: 00DD7B68, 00DD7B7E, 00DD7CAC
x86, xrefs: 00DD7AA8
LOGGER->Creating LOG file at:, xrefs: 00DD7BBA, 00DD7BCC, 00DD7BD6
server, xrefs: 00DD7AC3, 00DD7ACB

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$Init_thread_footer$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 4051163352-1312762833
Opcode ID: 79e61e8533d81e0c22e3810747ec3896c06b4161b563e97fb2bcaca62f6a0e06
Instruction ID: c737292248b5ed97c2a0dc00a3aebd52246cff7cd3d0b6c87fdf7a54b965f3fd
Opcode Fuzzy Hash: 79e61e8533d81e0c22e3810747ec3896c06b4161b563e97fb2bcaca62f6a0e06
Instruction Fuzzy Hash: F5128E70A016069FDB10DF68CD49B6EBBB5FF45314F1482A9E815AB3A2EB30DD05CB60

Function 00CC35A0 Relevance: 33.7, APIs: 22, Instructions: 727memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CC35FA
VariantClear.OLEAUT32(?), ref: 00CC362C
VariantClear.OLEAUT32(?), ref: 00CC3726
VariantClear.OLEAUT32(?), ref: 00CC3755
SysFreeString.OLEAUT32(00000000), ref: 00CC375C
SysAllocString.OLEAUT32(00000000), ref: 00CC37A3
VariantClear.OLEAUT32(?), ref: 00CC3827
VariantClear.OLEAUT32(?), ref: 00CC3859
VariantClear.OLEAUT32(?), ref: 00CC3959
VariantClear.OLEAUT32(?), ref: 00CC398C
SysFreeString.OLEAUT32(00000000), ref: 00CC3997
SysAllocString.OLEAUT32(00000000), ref: 00CC39DD
VariantClear.OLEAUT32(?), ref: 00CC3A5A
VariantClear.OLEAUT32(?), ref: 00CC3A8C
VariantClear.OLEAUT32(?), ref: 00CC3BAC
VariantClear.OLEAUT32(?), ref: 00CC3BDB
SysFreeString.OLEAUT32(00000000), ref: 00CC3BE2
SysAllocString.OLEAUT32(00000000), ref: 00CC3C35
VariantClear.OLEAUT32(?), ref: 00CC3CBA
VariantClear.OLEAUT32(?), ref: 00CC3CEC
VariantClear.OLEAUT32(?), ref: 00CC3DDD
VariantClear.OLEAUT32(?), ref: 00CC3E0A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: 5d8d87770e4aeeb5c2e48f3086fb57cadb170a3a83a4b1d6b2cb31a2facec4d7
Instruction ID: f94cd6c7f71fd9dec22f4101c8a724e317faae46e19bcf13c6bc0e8f49021540
Opcode Fuzzy Hash: 5d8d87770e4aeeb5c2e48f3086fb57cadb170a3a83a4b1d6b2cb31a2facec4d7
Instruction Fuzzy Hash: F4429D71900249DFCB00DFA8D849BEEBBB4FF09314F14826DE415E7291E778AA45DBA1

Function 00CAF190 Relevance: 30.1, APIs: 15, Strings: 2, Instructions: 374memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00CAF5F0: EnterCriticalSection.KERNEL32(00F46250,28CB4BA0,00000000,?,?,?,?,?,?,00CAEE50,00E5F68D,000000FF), ref: 00CAF62D
Part of subcall function 00CAF5F0: LoadCursorW.USER32(00000000,00007F00), ref: 00CAF6A8
Part of subcall function 00CAF5F0: LoadCursorW.USER32(00000000,00007F00), ref: 00CAF74E

SysFreeString.OLEAUT32(00000000), ref: 00CAF233
SysAllocString.OLEAUT32(00000000), ref: 00CAF264
GetWindowLongW.USER32(?,000000EC), ref: 00CAF33B
GetWindowLongW.USER32(?,000000EC), ref: 00CAF34B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CAF356
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 00CAF364
GetWindowLongW.USER32(?,000000EB), ref: 00CAF372
SetWindowTextW.USER32(?,00EC337C), ref: 00CAF411
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00CAF448
GlobalLock.KERNEL32(00000000), ref: 00CAF456
GlobalUnlock.KERNEL32(?), ref: 00CAF47A
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00CAF501
SysFreeString.OLEAUT32(00000000), ref: 00CAF516
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 00CAF55D
SysFreeString.OLEAUT32(00000000), ref: 00CAF585

Strings

~4, xrefs: 00CAF382
L4, xrefs: 00CAF487

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID: L4$~4
API String ID: 4180125975-2895323252
Opcode ID: c871493ad06b169ec1a3b59f5c682bf4325c20712e00d65f070cd9c278481287
Instruction ID: 251cd432da611c8a8f2c700d891ce94103e8bf897a927b04b033aa688d29dcdf
Opcode Fuzzy Hash: c871493ad06b169ec1a3b59f5c682bf4325c20712e00d65f070cd9c278481287
Instruction Fuzzy Hash: 3FD1A07190020AEFDB11DFE4CC48BAFBBB8EF46718F14416CE911A7290D7759A06DBA1

Function 00CB8CD0 Relevance: 26.8, APIs: 14, Strings: 1, Instructions: 520windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00CB8D83
ShowWindow.USER32(00000000,?), ref: 00CB8DA2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00CB8DB0
GetWindowRect.USER32(00000000,?), ref: 00CB8DC7
ShowWindow.USER32(00000000,?), ref: 00CB8DE8
SetWindowLongW.USER32(?,000000EB,?), ref: 00CB8DFF

Part of subcall function 00CB2970: RaiseException.KERNEL32(?,?,00000000,00000000,00E35A3C,C000008C,00000001,?,00E35A6D,00000000,?,00CA91C7,00000000,28CB4BA0,00000001,?), ref: 00CB297C

ShowWindow.USER32(?,?), ref: 00CB8F43
GetWindowLongW.USER32(?,000000EB), ref: 00CB8F79
ShowWindow.USER32(?,?), ref: 00CB8F96
GetWindowRect.USER32(?,?), ref: 00CB8FBB
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00CB90F8
GetWindowRect.USER32(?,?), ref: 00CB91B5
GetWindowRect.USER32(?,?), ref: 00CB9207
SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 00CB9243

Strings

L/, xrefs: 00CB90CE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$LongRectShow$MessageSend$ExceptionRaise
String ID: L/
API String ID: 1022490566-3611498470
Opcode ID: 0cbfb0c5d96b19cd29cf52251011f33fb8396080edd85ae066431474b1c54b0a
Instruction ID: 7dbcc8789a1bb0ddd0ead7cf6e561712248a9c6a035584fb85898d2d314df0c6
Opcode Fuzzy Hash: 0cbfb0c5d96b19cd29cf52251011f33fb8396080edd85ae066431474b1c54b0a
Instruction Fuzzy Hash: F512AB71904605AFDB25CF68C884BAEBBF9FF99304F00491DF996A7260DB30E949CB51

Function 00CAEBE0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 293nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00CAECCB
GetWindowLongW.USER32(00000004,000000EC), ref: 00CAECDB
SetWindowLongW.USER32(00000004,000000EC,00000000), ref: 00CAECE6
NtdllDefWindowProc_W.NTDLL(00000004,?,00000001,?), ref: 00CAECF4
GetWindowLongW.USER32(00000004,000000EB), ref: 00CAED02
SetWindowTextW.USER32(00000004,00EC337C), ref: 00CAEDA1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00CAEDD8
GlobalLock.KERNEL32(00000000), ref: 00CAEDE6
GlobalUnlock.KERNEL32(?), ref: 00CAEE0A
SetWindowLongW.USER32(00000004,000000EB,00000000), ref: 00CAEE6F
NtdllDefWindowProc_W.NTDLL(00000004,?,00000000,00000000), ref: 00CAEEBD

Strings

~4, xrefs: 00CAED12
L4, xrefs: 00CAEE17

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID: L4$~4
API String ID: 3555041256-2895323252
Opcode ID: a623b8324735e3c8d8f0f5f72ecfb25f4b8a708d932b6fb436c0fad2f1bd4ce1
Instruction ID: 8b6d4c0f2c1fd74f7a100eae35728252fd1ab9b4296106f732ed466d8803a0c7
Opcode Fuzzy Hash: a623b8324735e3c8d8f0f5f72ecfb25f4b8a708d932b6fb436c0fad2f1bd4ce1
Instruction Fuzzy Hash: F3A1C371901206EFDB10DFA4CC48BAFBBB9EF46318F144618F925A7291DB359E04CBA1

Function 00DAC0B0 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 00DAC452
FindClose.KERNEL32(00000000), ref: 00DAC480
FindClose.KERNEL32(00000000), ref: 00DAC509

Strings

An acceptable version was found., xrefs: 00DAC8CF
No acceptable version found., xrefs: 00DAC8F9
Not selected for install., xrefs: 00DAC900
No acceptable version found. It must be installed from package., xrefs: 00DAC8D6
No acceptable version found. It is already downloaded and it will be installed., xrefs: 00DAC8F2
No acceptable version found. It must be downloaded., xrefs: 00DAC8DD
No acceptable version found. Operating System not supported., xrefs: 00DAC8EB
No acceptable version found. It must be downloaded manually from a site., xrefs: 00DAC8E4

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: 728a412a940a0d096a9444bccbd1ec542fe1338eac04c19deed0fea3a2618e05
Instruction ID: fee0c329af61aa045f3bda10e3084662d35c1bb08a443bdc5bc64199938a0ef8
Opcode Fuzzy Hash: 728a412a940a0d096a9444bccbd1ec542fe1338eac04c19deed0fea3a2618e05
Instruction Fuzzy Hash: ABF1A23090060ACFDB10DF68C8487AEFBF1EF46324F188699D4599B392EB34D945DBA1

Function 00CFFA40 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 253windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00CFFC1B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00CFFC2B
SendMessageW.USER32(00000000,00000421,?,?), ref: 00CFFC40
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00CFFC51
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00CFFC64
GetWindowRect.USER32(?,?), ref: 00CFFC92

Part of subcall function 00D012B0: CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D0130F
Part of subcall function 00D012B0: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,00CFFDEC,00000000,28CB4BA0,?,?), ref: 00D01328

Part of subcall function 00CB0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00CB0DE6

SendMessageW.USER32(00000000,00000412,00000000), ref: 00CFFCF4
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00CFFD04

Strings

,, xrefs: 00CFFBC1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,
API String ID: 1954517558-3772416878
Opcode ID: 6e4b684ecdb21f2e564cf5f4113f02cb5f4446cf44cda17c14ce6ea1ee1d2aeb
Instruction ID: e216107e5fcc9435c9ee400ded95543c3bb71e180a20e582b2f6713010a9e4be
Opcode Fuzzy Hash: 6e4b684ecdb21f2e564cf5f4113f02cb5f4446cf44cda17c14ce6ea1ee1d2aeb
Instruction Fuzzy Hash: 54A10971A002199FDB14CFA9CC85BAEBBF9FF48300F50462EE916EB291D774A905DB50

Function 00CC6070 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 512windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00CC6143

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

__Init_thread_footer.LIBCMT ref: 00CC610F

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

SendMessageW.USER32(?,0000104D,00000000,?), ref: 00CC643F
SendMessageW.USER32(?,0000102B,?,?), ref: 00CC64CF
SendMessageW.USER32(?,00001003,00000001,?), ref: 00CC6555
SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 00CC6695

Part of subcall function 00CAC3F0: __floor_pentium4.LIBCMT ref: 00CAC40D

Strings

AiFeatIco, xrefs: 00CC636D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake__floor_pentium4
String ID: AiFeatIco
API String ID: 4294328693-859831556
Opcode ID: 586b9a702679d15f15030c1d19216fcc7861462b2ba2e7e848a83d9db5440dbc
Instruction ID: fc2bbe1e219c3237bfce80cfb31408116f60bef04ff36b026a50f55492f1648e
Opcode Fuzzy Hash: 586b9a702679d15f15030c1d19216fcc7861462b2ba2e7e848a83d9db5440dbc
Instruction Fuzzy Hash: 5822E071900249DFDF14DF68C989BEDBBB1FF59304F184169E815AF292DB70AA40DBA0

Function 00D82A50 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 313windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00D82C80
SendMessageW.USER32(?,00000443,00000000), ref: 00D82CEA
MulDiv.KERNEL32(?,00000000), ref: 00D82D21

Strings

;3, xrefs: 00D82D46
NumberValidationTipTitle, xrefs: 00D82AC4
Segoe UI, xrefs: 00D82CF8
NumberValidationTipMsg, xrefs: 00D82B8B

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSendWindow
String ID: ;3$NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 701072176-1447288369
Opcode ID: 07d0841ff5a5bbbc8503f0da2a7e02d3964839bbdd16fc99834480bfb6c2cdb3
Instruction ID: fe867c6d830314e7ef7a29071ea982d4adcf154bf3c0b670a78df55579f6fd3f
Opcode Fuzzy Hash: 07d0841ff5a5bbbc8503f0da2a7e02d3964839bbdd16fc99834480bfb6c2cdb3
Instruction Fuzzy Hash: 22C1AB71A00709AFEB14CF64CC55BEAB7F1FB49304F008299E556AB2D1DB746A49CFA0

Function 00DCA620 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

_wcschr.LIBVCRUNTIME ref: 00DCA6D9
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 00DCA82E
GetDriveTypeW.KERNEL32(?), ref: 00DCA84A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00DCAA37
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 00DCAAC1

Strings

]%!, xrefs: 00DCA7C9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection$DisableHeapLogicalProcessRevertStringsType_wcschr
String ID: ]%!
API String ID: 2638324580-1069524040
Opcode ID: 9c9a4021ffe8afb68ea9132e394762f20f2c564533454e9ab7c528e447ab578a
Instruction ID: 57e4657c4846c0ff8163b1337cf714e917ad0111edbe88b45ab75a6e8ea4b93f
Opcode Fuzzy Hash: 9c9a4021ffe8afb68ea9132e394762f20f2c564533454e9ab7c528e447ab578a
Instruction Fuzzy Hash: 76F1BF7090065ADFDB24DB6CCC84BADB7B5EF04314F1482E9E45AA7291DB709E84CFA1

Function 00E53B80 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

GetACP.KERNEL32(?,?,?,?,?,?,00E493AE,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E53C41
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00E493AE,?,?,?,00000055,?,-00000050,?,?), ref: 00E53C6C
_wcschr.LIBVCRUNTIME ref: 00E53D00
_wcschr.LIBVCRUNTIME ref: 00E53D0E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00E53DCF

Strings

utf8, xrefs: 00E53D3E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 49ca41e53579b250ddda467130e7747fa7fc9f130a5a0464e5bd0015c11b4df5
Instruction ID: d754a8befe1dc42347a9c251dae2f8ccd405b84b8c38cf18ad29112a8f0eff75
Opcode Fuzzy Hash: 49ca41e53579b250ddda467130e7747fa7fc9f130a5a0464e5bd0015c11b4df5
Instruction Fuzzy Hash: 0571D571A00305AAD725AB79DC46BA7B3F8EF44786F146829FD05FB181EA70DE48C760

Function 00E58B95 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00E58D79

Strings

1#INF, xrefs: 00E58CCB
1#SNAN, xrefs: 00E58CA1
1#IND, xrefs: 00E58C9A
1#QNAN, xrefs: 00E58CA8

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 4fdc05f9a8ed91792a6cc349f3e939f205af458d7d64a2451dc343951562eef8
Instruction ID: 04fceb6170c214a91a5421abe6952e6bfa41afabf3e64cf3f5a3d18e49a00775
Opcode Fuzzy Hash: 4fdc05f9a8ed91792a6cc349f3e939f205af458d7d64a2451dc343951562eef8
Instruction Fuzzy Hash: 50D22871E08228CBDB65CE24DD407EAB7B5EB44306F1459EAD80DB7241DB78AE898F41

Function 00DDFB20 Relevance: 9.2, APIs: 6, Instructions: 196fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,28CB4BA0,?,00000000,00000000), ref: 00DDFBF1
FindNextFileW.KERNEL32(?,00000000), ref: 00DDFC0C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 6e7c5d364aa89e454e1a87edebc0050ebf04fc2184ec3365c3e725300f5b17e5
Instruction ID: b3916149b34ed11d68764660d82d9d215c65b2a98236a75c5c13d05060efc34e
Opcode Fuzzy Hash: 6e7c5d364aa89e454e1a87edebc0050ebf04fc2184ec3365c3e725300f5b17e5
Instruction Fuzzy Hash: A0717F71900289DFDB10DFA9CD48BDEBBB8FF05314F188169E815AB291DB749E04CB60

Function 00DA3A50 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 321fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 00DA3BA8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00000000), ref: 00DA3C45
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00DA3C6B
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 00DA3CB5

Strings

P3, xrefs: 00DA3B4D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer$HeapProcess
String ID: P3
API String ID: 3625725927-1755088194
Opcode ID: 979e6695cf85bab62ec00b376fe004be8665e40a5edcf96be77eb0100df85677
Instruction ID: e04cbc91bd816e0a28ae2723c6fcc252b56e11cd1f64f51d7cbb820870d1a3bc
Opcode Fuzzy Hash: 979e6695cf85bab62ec00b376fe004be8665e40a5edcf96be77eb0100df85677
Instruction Fuzzy Hash: 24A1D471A002459FDB14DF68CC49BAEB7F6FF41324F14862AF815E7380E7B59A048BA0

Function 00D00BAA Relevance: 9.1, APIs: 6, Instructions: 70nativeCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00D00B67
ShowWindow.USER32(?,00000005), ref: 00D00B93
GetWindowLongW.USER32(?,000000F0), ref: 00D00BC5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D00BE3
NtdllDefWindowProc_W.NTDLL(?,0000000C,?,?), ref: 00D00BF6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D00C0D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$Show$NtdllProc_
String ID:
API String ID: 3227303085-0
Opcode ID: 83a37b26ee23205f4816aaeda3f245dae212e15f4a32dc5391fa480a26cfa5bd
Instruction ID: 001b113d784f612514b26f8d7bb3eee27701ea270abcd37ca25e8add1790f02b
Opcode Fuzzy Hash: 83a37b26ee23205f4816aaeda3f245dae212e15f4a32dc5391fa480a26cfa5bd
Instruction Fuzzy Hash: 9C212A35604219EFDB15DF58D845B69BBB1FF49321F210269E816A73F1CB366810DB50

Function 00E35CA1 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00E35BBD,00000000,?,00E35D55,00000000,?,?,00CB0B74,?), ref: 00E35CA3
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,00CB0B74,?), ref: 00E35CCA
HeapAlloc.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35CD1
InitializeSListHead.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35CDE
GetProcessHeap.KERNEL32(00000000,00000000,?,?,00CB0B74,?), ref: 00E35CF3
HeapFree.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35CFA

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: cdf391e92e832e8ddabee89e24f5fece719cd67a355f686169b2a28394344c39
Instruction ID: 51130a1cbdf1b7818921f000c4e974a0277e9de1f3aa532b06875b5e98ed8476
Opcode Fuzzy Hash: cdf391e92e832e8ddabee89e24f5fece719cd67a355f686169b2a28394344c39
Instruction Fuzzy Hash: A2F08C36601A019FE710AF2AAD4CB077BACBB98756F044528EA42E3360DF70D808DA60

Function 00E5430F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00E5462D,00000002,00000000,?,?,?,00E5462D,?,00000000), ref: 00E543A8
GetLocaleInfoW.KERNEL32(?,20001004,00E5462D,00000002,00000000,?,?,?,00E5462D,?,00000000), ref: 00E543D1
GetACP.KERNEL32(?,?,00E5462D,?,00000000), ref: 00E543E6

Strings

OCP, xrefs: 00E54363
ACP, xrefs: 00E5432D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: cc1adf7b567bdc816d47f930970a3c444a956ec3924689d242faa3ada9f20871
Instruction ID: d2ee803b44aaa1f0eef47d649b1403cafabbf7bb6dc71ec0f4d908e64f2a0468
Opcode Fuzzy Hash: cc1adf7b567bdc816d47f930970a3c444a956ec3924689d242faa3ada9f20871
Instruction Fuzzy Hash: 7221E2B2601100AAD7249F54C901ADB73AAAB54B5EB566C34ED0AF72A0E732DD88C340

Function 00E544E4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00E545F0
IsValidCodePage.KERNEL32(00000000), ref: 00E54639
IsValidLocale.KERNEL32(?,00000001), ref: 00E54648
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00E54690
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00E546AF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: cae22bec5c96c948524104fce20371f4f30e8faf749cdb4702cd714cafd1115f
Instruction ID: 9727d321b1cc7c032c2c8ef97aa0c950401d20cfe3415cd4f1fb6657188b566a
Opcode Fuzzy Hash: cae22bec5c96c948524104fce20371f4f30e8faf749cdb4702cd714cafd1115f
Instruction Fuzzy Hash: 9A5190B2900205AFDF11DFA9DC45ABA73B8BF0570AF045929F914F71D0EBB09A48CB61

Function 00CBC4F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000003,000000FC), ref: 00CBC546
SetWindowLongW.USER32(00000003,000000FC,?), ref: 00CBC558
DeleteCriticalSection.KERNEL32(?,28CB4BA0,?,?,?,?,00E619C4,000000FF), ref: 00CBC583

Strings

PV, xrefs: 00CBC5AA

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: LongWindow$CriticalDeleteSection
String ID: PV
API String ID: 1978754570-1684308595
Opcode ID: a5c83916ef7bc1593750b49150a37dba6e6fa9329c1367f2dde667b906b376f5
Instruction ID: 9e8bb4896ae20735e1070e61743ebfa64f6bb22e7d90a17f974095121b774f79
Opcode Fuzzy Hash: a5c83916ef7bc1593750b49150a37dba6e6fa9329c1367f2dde667b906b376f5
Instruction Fuzzy Hash: D731CF75A00646ABCB20CF24CD49B9ABFE8BF16320F144259E824A3691D771EA14EB90

Function 00E4DD6A Relevance: 6.3, APIs: 4, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E4DDF7

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 61616e26537ace8c997b701a72d866b1042ed0193a591e10dac063b8da873d44
Instruction ID: 1e0aae6b834404d0babbcca9933d10fb2c638eb6e2ec2da5ff2b037902e57d04
Opcode Fuzzy Hash: 61616e26537ace8c997b701a72d866b1042ed0193a591e10dac063b8da873d44
Instruction Fuzzy Hash: 9DB13332E082459FDB258F28DC81BFEBBE5EF59314F14916AE815BB341D2749D05CBA0

Function 00DCB3D0 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1967bd4a28651f341092d337d346ee5eb31740c1c862b71413ca9ca0dfb048
Instruction ID: f4d55f8aa5083417cdec6ba306b60ec3f107ebf6c54ceadf38f5d036aa09e75c
Opcode Fuzzy Hash: 0c1967bd4a28651f341092d337d346ee5eb31740c1c862b71413ca9ca0dfb048
Instruction Fuzzy Hash: 85819171901219DFDB50DF68CC4AB99B7B4EF45324F1882DDE818AB292DB709E44CFA1

Function 00D3AB40 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,28CB4BA0,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 00D3AB88
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 00D3AB9B
LockResource.KERNEL32(00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 00D3ABAA
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 00D3ABBA

Part of subcall function 00DA1480: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,00000000,28CB4BA0,00000000,00000000), ref: 00DA14D4

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Resource$ByteCharFindLoadLockMultiSizeofWide
String ID:
API String ID: 203124936-0
Opcode ID: 2a55d9aa97e1f75f80e0779d198ac43154c53dc6f4f748a789bea57cc3885b5c
Instruction ID: 4ec67243ee10f5d74faa5f032665c9891da0b949db2dd2f35388b852a5600fb4
Opcode Fuzzy Hash: 2a55d9aa97e1f75f80e0779d198ac43154c53dc6f4f748a789bea57cc3885b5c
Instruction Fuzzy Hash: 1C312275E04705ABDB209F78DD05BABB7F8EB08750F044729E855A73C0EB70A908C7A1

Function 00D00CE3 Relevance: 6.1, APIs: 4, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00D00D3E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D00D5C
NtdllDefWindowProc_W.NTDLL(?,00000086,?,00000000), ref: 00D00D6E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D00D80

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: c534947c39755f5e871b054a64d97a37af4bf07caf66f7f3ca0087bdabc18838
Instruction ID: 2672f1eba5f23f7859481e342591e94088ecca1151b565b6953bc5c3a35a228b
Opcode Fuzzy Hash: c534947c39755f5e871b054a64d97a37af4bf07caf66f7f3ca0087bdabc18838
Instruction Fuzzy Hash: E2319A70A04258AFDB11CF68DD85B59BFF1EF46320F14429AE815AB3E1CBB1AD14DB60

Function 00D00C22 Relevance: 6.0, APIs: 4, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00D00C3C
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D00C5A
NtdllDefWindowProc_W.NTDLL(?,00000080,?,?), ref: 00D00C70
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D00C87

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: 04ed81c86da28fc78512d2e72d77a282805a613318e13c5fe1d3e92dc774f385
Instruction ID: eb2e52f73de3ccccf6c5ea62dd934a6a61c17319d578e94ba9cb513811282304
Opcode Fuzzy Hash: 04ed81c86da28fc78512d2e72d77a282805a613318e13c5fe1d3e92dc774f385
Instruction Fuzzy Hash: FB112A76A04258AFDB21DF58DC44B9DBBF1FB49320F21032AF965A33E0CB7129109B40

Function 00E1D550 Relevance: 5.5, Strings: 4, Instructions: 529COMMON

Download Yara Rule

Strings

yxxx, xrefs: 00E1D944
yxxx, xrefs: 00E1D904
yxxx, xrefs: 00E1D91D
yxxx, xrefs: 00E1DA08

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: yxxx$yxxx$yxxx$yxxx
API String ID: 0-3504637693
Opcode ID: d8c38588a5664d3a7b5e5e221eb86b82cd2eb28c5ad7f616112e8fe8546425d3
Instruction ID: 821ff3a7fc93d1bc6d6d2c9d3d94573982e5bf4fef1e5434b8748014fde0de11
Opcode Fuzzy Hash: d8c38588a5664d3a7b5e5e221eb86b82cd2eb28c5ad7f616112e8fe8546425d3
Instruction Fuzzy Hash: 5B0295B1A045099FCB18DF68CD81AEEBBF5EF88300F148629E915EB395D770E941CB90

Function 00DCB7D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 00DCB88C
FindClose.KERNEL32(00000000), ref: 00DCB9D7

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Strings

%d.%d.%d.%d, xrefs: 00DCB969

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Find$AllocCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 2507753907-3491811756
Opcode ID: 88cec16abd676d39b38137b277f4bca664e8973d966e8d6e6ff4d293d9f69c92
Instruction ID: a767967a62e0d278643be3e54d7adaf5e52a5d9163f830c985e74ceb80b8e159
Opcode Fuzzy Hash: 88cec16abd676d39b38137b277f4bca664e8973d966e8d6e6ff4d293d9f69c92
Instruction Fuzzy Hash: 39617D70905219DFDF20DF28CC4AB9DBBB4EF05314F14829AE859AB291DB719E84CF90

Function 00CBE290 Relevance: 5.3, Strings: 4, Instructions: 346COMMON

Download Yara Rule

Strings

AI_CONTROL_VISUAL_STYLE, xrefs: 00CBE2F8
AI_NO_BORDER_HOVER, xrefs: 00CBE3DB
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 00CBE5B8
AI_NO_BORDER_NORMAL, xrefs: 00CBE360

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: 1600019a96ff17dc760268912b478de038c3a8aa0599a6ffb9a120e4cdea0688
Instruction ID: 488e809670bde5b24ea9489cf939077ddf557d51d298eab3a6bef3a821d99e09
Opcode Fuzzy Hash: 1600019a96ff17dc760268912b478de038c3a8aa0599a6ffb9a120e4cdea0688
Instruction Fuzzy Hash: 87D16E70D00218DFDB04CFA9CD45BEEBBF1BF45304F108269E455AB286D778AA09DBA1

Function 00E53F93 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E53FE7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E54031
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E540F7

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: 4c802cf5e2b9c8180e4b3b953e1e5fe0bc405bab702ba487b2a20b9a50399ef6
Instruction ID: 9abf589041ee1e01eb056a07f692cbabb3c18777b3fc443797ee6c71aeaf4a48
Opcode Fuzzy Hash: 4c802cf5e2b9c8180e4b3b953e1e5fe0bc405bab702ba487b2a20b9a50399ef6
Instruction Fuzzy Hash: 1B61F0B19115179FDB289F28CD82BBAB3A8EF1430AF105579EE05E62C0E734D9C9DB10

Function 00D13FC0 Relevance: 4.7, Strings: 3, Instructions: 907COMMON

Download Yara Rule

Strings

&, xrefs: 00D14CB2
<a>, xrefs: 00D142DD
</a>, xrefs: 00D14308

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer
String ID: &$</a>$<a>
API String ID: 1385522511-4150034113
Opcode ID: a2f3549a360f626ce2e01d45a013d1fd73628a542c3af8f4a33bf69df2b266ea
Instruction ID: 415cc3710204902a600b53c116337d1fb8de6044c01ff61d6af5b448d7ef8f09
Opcode Fuzzy Hash: a2f3549a360f626ce2e01d45a013d1fd73628a542c3af8f4a33bf69df2b266ea
Instruction Fuzzy Hash: FE924370D012A9DFDB20DBA8CD44BDDBBB4AF14304F1481DAE10AB7292DB745A89DF61

Function 00CB8890 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 00CB88DE
GetWindowLongW.USER32(00000004,000000FC), ref: 00CB88F7
SetWindowLongW.USER32(00000004,000000FC,?), ref: 00CB8909

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 890d4b2c9816816f13239ec9dd872e6870180cf3a2fe336020c2e394df1917b0
Instruction ID: 6d4eb554fb23f51997146e76c989781dc2be3957259aae01adc3ebf0d2e29b29
Opcode Fuzzy Hash: 890d4b2c9816816f13239ec9dd872e6870180cf3a2fe336020c2e394df1917b0
Instruction Fuzzy Hash: 64419FB0A01A46EFDB10CF64D908B5AFBF8FF05310F044258E424A7A90DB76F914CB91

Function 00E3AD13 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00E3AE0B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00E3AE15
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00E3AE22

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: adde3e4d45515d6eab8b65b28b78044f58cc91f74ce220515f2fb7b528ad6991
Instruction ID: 262982cfb76f6eef3f64b313487081f7dcc8c1b76a59b5a703591a758b86987a
Opcode Fuzzy Hash: adde3e4d45515d6eab8b65b28b78044f58cc91f74ce220515f2fb7b528ad6991
Instruction Fuzzy Hash: 1A31B3759012189BCB21DF65D98978DBBF8AF08310F5051EAE40CA72A0EB709B85CF45

Function 00CB1670 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000FC), ref: 00CB1689
SetWindowLongW.USER32(?,000000FC,?), ref: 00CB1697
DestroyWindow.USER32(?,?,?,?,?,?,80004003,?,00000001,?,?,00000001,?,?,00EC383C), ref: 00CB16C3

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: d8ab0436d5d3325c1ccd00a092107cb2400802b8f250a7579423c1588c8b8583
Instruction ID: 4801779192579e0a1246aa890051310d2af2e07c1a9732fa8c2466d863c51b63
Opcode Fuzzy Hash: d8ab0436d5d3325c1ccd00a092107cb2400802b8f250a7579423c1588c8b8583
Instruction Fuzzy Hash: 15F01D35004A119BD7609F28ED08B827BE4BB05721F084B1DECBA929F0C720E840DB00

Function 00CC7630 Relevance: 3.3, APIs: 2, Instructions: 252windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,?), ref: 00CC774D
SendMessageW.USER32(?,0000102B,0000009B,?), ref: 00CC7932

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: faca47407deffde6c8a6557a59e9e2682728ca0a35af1d1120f61f292470d663
Instruction ID: c613ab40f9443192da2092f57ffb5250c399e9671757204a163034f44d68fbc7
Opcode Fuzzy Hash: faca47407deffde6c8a6557a59e9e2682728ca0a35af1d1120f61f292470d663
Instruction Fuzzy Hash: 19A1E371A04646AFDB18CF24C999FA9FBF5FB15300F14826EE469DB291D734EA01CB90

Function 00DBE3A0 Relevance: 3.1, APIs: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000003,28CB4BA0,00000000,?,00000000), ref: 00DBE48E
FindClose.KERNEL32(00000000,?,00000000), ref: 00DBE4D9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ebeb1daeac1b6302ab7d506f2fa4d0339ecc1d4d5940a89ea73a8d84242606f2
Instruction ID: 0417756c74b8236b34083adf4173fb6d34475557e5478afe499dafb4d113c5a4
Opcode Fuzzy Hash: ebeb1daeac1b6302ab7d506f2fa4d0339ecc1d4d5940a89ea73a8d84242606f2
Instruction Fuzzy Hash: 7D51A07190060ACFEB20DF68C849BEEBBF4FF44318F144559E816AB381D774AA05CBA1

Function 00DA2230 Relevance: 3.1, APIs: 2, Instructions: 105windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,28CB4BA0,00000008,00000000), ref: 00DA227B
GetLastError.KERNEL32 ref: 00DA2285

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 605fd3818730f5be01d18dd18d9ff43bd7136fd092922dd3b8d10befdbecdbb8
Instruction ID: 103f44e39b80fb700193abb2632ac1f789ef30ac33dd2aabded25aa2370bb771
Opcode Fuzzy Hash: 605fd3818730f5be01d18dd18d9ff43bd7136fd092922dd3b8d10befdbecdbb8
Instruction Fuzzy Hash: 2C319371A002099FEB10DF9DDC45BAEBBF8FB45714F14062EE518E7380DBB5990487A5

Function 00D00010 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 00D0007F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 00D0008D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 4c0e4b120bce5220d1285b346e0348233678fb5c84d3ddc6549f80370bc9fda4
Instruction ID: f64488fd89dbcc2c35c46cb67fff307596aac3ac653ec3abac6bee26b8dac391
Opcode Fuzzy Hash: 4c0e4b120bce5220d1285b346e0348233678fb5c84d3ddc6549f80370bc9fda4
Instruction Fuzzy Hash: 43315971900649EFCB10DF69C944B9AFFF4FB05320F148269E828A77E1D776A950CBA0

Function 00DCE610 Relevance: 3.1, APIs: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,28CB4BA0,?,00000000,00000000,00000000,00EA351D,000000FF), ref: 00DCE678
FindClose.KERNEL32(00000000,?,28CB4BA0,?,00000000,00000000,00000000,00EA351D,000000FF), ref: 00DCE6C2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: afcc94fe5db4a41c055846e15638866f1d3802986e694c9829615536dd0d7d50
Instruction ID: 92b2cd68bfbdb4cc2e802a4efbb9657cb10f879999a7cf1806848b55dc176ff9
Opcode Fuzzy Hash: afcc94fe5db4a41c055846e15638866f1d3802986e694c9829615536dd0d7d50
Instruction Fuzzy Hash: 4921B5719005499FD710DF68CD49B9EF7B8FF84324F14472AE825A72D0EB705A08CB94

Function 014DF770 Relevance: 2.5, Strings: 1, Instructions: 1216COMMON

Download Yara Rule

Strings

1:", xrefs: 014DF7F0

Memory Dump Source

Source File: 00000000.00000003.2281368116.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, Offset: 014DC000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_14dc000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: 1:"
API String ID: 0-706857256
Opcode ID: 849ef93d9a8d943deec08a6f79db78c569d26bdb1412f1ec2073612e53243cb1
Instruction ID: 0a98f66774be4fbeb0d6995570409a6d65077d7ff3382483e7eacb6cd405dfcf
Opcode Fuzzy Hash: 849ef93d9a8d943deec08a6f79db78c569d26bdb1412f1ec2073612e53243cb1
Instruction Fuzzy Hash: CA81FC2104E3C15FCB538B388CBA2E67FB1AE1722471E85DBD4C5CF5A3D229494AC766

Function 01502CB4 Relevance: 1.9, Instructions: 1913COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2282022156.00000000014FE000.00000004.00000020.00020000.00000000.sdmp, Offset: 014FE000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_14fe000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54d4f64106bbd4af412d79bd89e1fc8e9d7aff1c0fd408eb15ac30d121a7fa9
Instruction ID: ec159b06d1a6af7f816f8280885a7ecb844ccea858e7270c386c84baae565c67
Opcode Fuzzy Hash: d54d4f64106bbd4af412d79bd89e1fc8e9d7aff1c0fd408eb15ac30d121a7fa9
Instruction Fuzzy Hash: B0622D6548E3C25FD3138BB49CB66917FB0AE17224B0E86DBC4C0CF0A3D25D599AD722

Function 00CD52F0 Relevance: 1.9, Strings: 1, Instructions: 617COMMON

Download Yara Rule

Strings

2, xrefs: 00CD5576

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: 9224ce1e8ea6783e56bcc8d9305f100afd1e42487b73ca6c7525b8f706237646
Instruction ID: e9979b1c0bba3425471d6dd685eadaca562a11fd0ccea3b97a2aa53331728ae3
Opcode Fuzzy Hash: 9224ce1e8ea6783e56bcc8d9305f100afd1e42487b73ca6c7525b8f706237646
Instruction Fuzzy Hash: 0B32D1B1A047518BCB10DF26D98056BB7E5AF94308F44493EF5CBC7281EA34EA48D7A3

Function 00E541E6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E5423A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 9f426e8ded2311318b2249fc5f124ecd9781286b23e2fb6feb971f708a677b87
Instruction ID: 9ffa615d91de8afdb2b678fa1822691980603cbee7f3ac737e7005a32257b79b
Opcode Fuzzy Hash: 9f426e8ded2311318b2249fc5f124ecd9781286b23e2fb6feb971f708a677b87
Instruction Fuzzy Hash: 332107B6500216ABDB289F25DC42ABB77ECEF44309F102479FD05E6291EB74DC85C710

Function 00E53E6D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

EnumSystemLocalesW.KERNEL32(00E53F93,00000001,00000000,?,-00000050,?,00E545C4,00000000,?,?,?,00000055,?), ref: 00E53EDF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 561a7aab89b09754b5382f3e89789e861aec7050c0a76b85b0f193958232a6e9
Instruction ID: fdc22aa264ccc254b487ff240fc9e2ca3ac27e764d7af00eb5fede21f340937a
Opcode Fuzzy Hash: 561a7aab89b09754b5382f3e89789e861aec7050c0a76b85b0f193958232a6e9
Instruction Fuzzy Hash: 0A1129376047019FDB189F39C8956BABBE2FF80359B14482DE94797A40E7716906C740

Function 00E54415 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00E541AF,00000000,00000000,?), ref: 00E54441

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 58ba5ea545e7f0ddaf2f7290a0a444a3302683a972313dd3198bb37a1b6cd68f
Instruction ID: 1c8dcc13f8d11cf88c744a345eefc8dc7cb8dd8892e21437386c5467cd4f7c06
Opcode Fuzzy Hash: 58ba5ea545e7f0ddaf2f7290a0a444a3302683a972313dd3198bb37a1b6cd68f
Instruction Fuzzy Hash: 20F0F972A501117BDB2856258C057FA7768EB4075DF154824ED65B31C0EB34FF87C6A0

Function 00E53D7B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00E53DCF

Strings

utf8, xrefs: 00E53D3E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 8e3d06adba8a32b94d5311dc10427f444b859bc49cfcf9bf7883ebc2308fb430
Instruction ID: 3cda3027a5de33eba360fa55da54d36782b248b224cc67d7f5462c825e5b807a
Opcode Fuzzy Hash: 8e3d06adba8a32b94d5311dc10427f444b859bc49cfcf9bf7883ebc2308fb430
Instruction Fuzzy Hash: E4F0C832A11105ABC728AB38DC4AABA77ECDF49355F105179FA06E7281EA74AD05C750

Function 00E53F08 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

EnumSystemLocalesW.KERNEL32(00E541E6,00000001,?,?,-00000050,?,00E54588,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00E53F52

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e95d15bc744e22709699fda0ad8f340a6016a6e441542b78997ef6195a1cf0c5
Instruction ID: aec7327605e5cd38038e69d8355935e52ee64131257766f2ae357b1dc1d34e22
Opcode Fuzzy Hash: e95d15bc744e22709699fda0ad8f340a6016a6e441542b78997ef6195a1cf0c5
Instruction Fuzzy Hash: 0AF046367043046FCB245F399C81ABA7BE4FF807ADF14482CFD059B680D6B19D46C620

Function 00E4FC09 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4A89A: EnterCriticalSection.KERNEL32(-00F45108,?,00E4CE16,00CA9F56,00F39668,0000000C,00E4D0E1,?), ref: 00E4A8A9

EnumSystemLocalesW.KERNEL32(00E4FBFC,00000001,00F397A8,0000000C,00E5002B,00000000), ref: 00E4FC41

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 4b321e0d2a7394a0caadac52dcd3bc6317f7856fa852380119c55d5fc5baed97
Instruction ID: 4a8c36b0cfeb50e1983003720cbae2c32cd768031d8bd190d03ef3f140d13eed
Opcode Fuzzy Hash: 4b321e0d2a7394a0caadac52dcd3bc6317f7856fa852380119c55d5fc5baed97
Instruction Fuzzy Hash: E3F04F76A40204DFD714EFA8E842B9D77F0FB05B21F10412AF814EB2A1CBB54941DB51

Function 00E53E22 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E4D836: GetLastError.KERNEL32(?,00000008,00E4F453), ref: 00E4D83A
Part of subcall function 00E4D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 00E4D8DC

EnumSystemLocalesW.KERNEL32(00E53D7B,00000001,?,?,?,00E545E6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00E53E59

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: eee627fb1223ab54c9508b35c76a64817941a132debcc9180a9859a95a817091
Instruction ID: 3ecd4764bd386c3dec8f24d736dd044dd55e68d780d170350885ab222dbbf9eb
Opcode Fuzzy Hash: eee627fb1223ab54c9508b35c76a64817941a132debcc9180a9859a95a817091
Instruction Fuzzy Hash: B1F0553630030557CB049F3AE84666ABFE4EFC1795F0A0059EE099B260CA329947C750

Function 00CC15F0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,00CBFD16,?,?,?,?,?,?,?,?,00CBFB78,?,?), ref: 00CC1640

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 4efef1c4628d8ccc081117132e09dad8fc5797023e4b5c73bbd3448bc401b0f1
Instruction ID: 77c595e95b04ba91f26bfbbd8653723f0538635886b69e0c46c2562fbefdf5cb
Opcode Fuzzy Hash: 4efef1c4628d8ccc081117132e09dad8fc5797023e4b5c73bbd3448bc401b0f1
Instruction Fuzzy Hash: A5F05874004185DEE3008F16C898F69BBAAFB47346F4C45F9F9A8C5462C239CE54DF10

Function 00E50186 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00E49F14,?,20001004,00000000,00000002,?,?,00E49516), ref: 00E501BA

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 5f2ee7ccbcb212d6c748c03ebcbf530c090671f95c766ac297bf20264cf5b39a
Instruction ID: 6bf866f76819e2276ece56e448377ee32390b8530a566fa62c7be2bfc2dc830a
Opcode Fuzzy Hash: 5f2ee7ccbcb212d6c748c03ebcbf530c090671f95c766ac297bf20264cf5b39a
Instruction Fuzzy Hash: 07E04F31502528BBCF122F61ED05AAE7F69FF44751F004420FD0575221CB319925EAD5

Function 00CF6EE0 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

1, xrefs: 00CF72E7

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: fc03b5945b5a1a3d7cf7bc1e17a0a4e5b3a3900ccba4da89e4f82882fc274d2a
Instruction ID: c14db5ee89120ec81b464d5d916df66176b06e6a44959b22067f2f66289153c3
Opcode Fuzzy Hash: fc03b5945b5a1a3d7cf7bc1e17a0a4e5b3a3900ccba4da89e4f82882fc274d2a
Instruction Fuzzy Hash: 69D115B050578AEFE709CF64C55878AFBF4BF05308F24824DD4686B281D3BAA618CBD1

Function 00D47F20 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

{, xrefs: 00D47F8C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: {
API String ID: 0-2739055043
Opcode ID: f03d65f404e731966419f7e63bd55b602a31335508d8e129144a7d87bbed746d
Instruction ID: dade65e8b60ca65defdb3af5ba7d3c087a7ad744ad9e5f65e1389d3eea55cc4e
Opcode Fuzzy Hash: f03d65f404e731966419f7e63bd55b602a31335508d8e129144a7d87bbed746d
Instruction Fuzzy Hash: F941D6B0905749EED704CF69C50978AFBF0BB09318F10869DD458AB781D3BAA619CBD1

Function 00CB8720 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

`V, xrefs: 00CB878D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: `V
API String ID: 0-3309648629
Opcode ID: 337a8fdfd13b0a57bd1754ff134a16b5ef27fbc7dd6ff537bf8c5f5a697d9461
Instruction ID: c87b76adccd6fcc2aaba160459dd0f546177d4220c9b9352432da65330ad1320
Opcode Fuzzy Hash: 337a8fdfd13b0a57bd1754ff134a16b5ef27fbc7dd6ff537bf8c5f5a697d9461
Instruction Fuzzy Hash: 1731EDB1405B84CEE321CF29C658747BFF0BB15728F108A4DD4A25BB91C3BAB648CB91

Function 00D7B7A0 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9260779f8dff2f6dc8266571569031f2b41d8e95c0008389178d65e09e244fb0
Instruction ID: e0e249a76c0034c24141002b3d52a7caedbbcffba978dba5db974e0a9eebc532
Opcode Fuzzy Hash: 9260779f8dff2f6dc8266571569031f2b41d8e95c0008389178d65e09e244fb0
Instruction Fuzzy Hash: 6802CB75A002159FDB18DF6CC885BAEB7F5EB55320F14822EE815E7351E730AD04CBA1

Function 00E3E64C Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733b094125585bc0793c6c5b651e6eb080b77c9130cd350b5d2f838ca270ba6e
Instruction ID: e2ff559ca8f1def0f19d057402dc64d6db0f6e4bc1fc5fa6102f333614959334
Opcode Fuzzy Hash: 733b094125585bc0793c6c5b651e6eb080b77c9130cd350b5d2f838ca270ba6e
Instruction Fuzzy Hash: 44E1AC74A006058FCB28CF68C489AAABBF1FF84318F24665AD456BB3D1D730ED46CB51

Function 00E3E2BE Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9c4a220dff9b2185c4e70b9d8119cd7217065a0fca14faf9274004294fe8d9
Instruction ID: 3abcd1e545fec44c399f47f27366a8adea51280583166803fdc212282ac39ab8
Opcode Fuzzy Hash: 2c9c4a220dff9b2185c4e70b9d8119cd7217065a0fca14faf9274004294fe8d9
Instruction Fuzzy Hash: 82C1AC70A00646CFCB28CE68C4996BEBFE1AF49318F246619D496B73D2D730ED46CB51

Function 00E53631 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLastProcess$CurrentFeatureInfoLocalePresentProcessorTerminate
String ID:
API String ID: 3471368781-0
Opcode ID: 2fa58192a7dba19555285f769416028f05130d256c481943225ae521d67ce810
Instruction ID: e0715c44a884cdad4db6a18c2ad2dbb49e1a17fb1e835046ed9374859ee65f6b
Opcode Fuzzy Hash: 2fa58192a7dba19555285f769416028f05130d256c481943225ae521d67ce810
Instruction Fuzzy Hash: AAB119B55007059BCB3C9B34CC92AB7B3E8EF44349F545D2DED42E6680E675EA89C710

Function 00CAF7C0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead7c49b448a36af15fa716e57910e1b158605891ec7f9adf4b5c285f2761c3b
Instruction ID: d40093d3473a658145caf16556431b110de69c63796aa55e1890a4c527ec97dc
Opcode Fuzzy Hash: ead7c49b448a36af15fa716e57910e1b158605891ec7f9adf4b5c285f2761c3b
Instruction Fuzzy Hash: 0171E9B0805B48DFE761CF64C95478ABFF0BB05314F108A5EC4A9AB391D3B96648DF91

Function 00CB2250 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83120eec94942e9b07a4b47218a8444c20105e18acb263035035a1b6957ec27d
Instruction ID: a17ae209f2b960e55d0d5f18e9bb08efef2422f28c946ed6c277d26fe43eae31
Opcode Fuzzy Hash: 83120eec94942e9b07a4b47218a8444c20105e18acb263035035a1b6957ec27d
Instruction Fuzzy Hash: 792149B0804788CFD710CF68C944B8ABBF4FB59324F1186AED455AB791D3B9AA44CF90

Function 00CB1C90 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fda12f4d97ff8a3888650f930cf56f6d97be51ff550bdcc37c8f4762b511024d
Instruction ID: b1be72d0f22846fddd2e30e85c1effc55db4a4a464c656e0732c11bee955e56a
Opcode Fuzzy Hash: fda12f4d97ff8a3888650f930cf56f6d97be51ff550bdcc37c8f4762b511024d
Instruction Fuzzy Hash: 07213BB1804788DFD710CF68C944B8ABBF4FB19324F1186AED455AB791D3B9AA44CB90

Function 00CCD320 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3591a4a5c516805fc9e275369bb7ba2eeb5ac6486c907da7c5f2eab5997ca75
Instruction ID: d64f22920e069ddc32ffc70b5a0e8cad878cb504418e6ad6f0afa035d5e3d2f6
Opcode Fuzzy Hash: a3591a4a5c516805fc9e275369bb7ba2eeb5ac6486c907da7c5f2eab5997ca75
Instruction Fuzzy Hash: 8811E9B5904248DFCB44CF58D545B49BBF4FB09728F2082AEE8289B781D3769A06DF80

Function 00E5783E Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction ID: 42cde96dd789bb51df9dc89188f1e500604ded28c3956af039e79b4ee2e53333
Opcode Fuzzy Hash: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction Fuzzy Hash: 7EE08C32A19238EBCB18DB99E908D8AF3ECEB45F01B1104AAF901E3200C270DE04C7D0

Function 00E4C66D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144c5401b694974f51f95ed054cfd58255e5e3608f4b0faf65206ff88c737fe7
Instruction ID: a3baab3a56ea4e79c75b608014ff4867232d233d64a08c86d9767faba1763be3
Opcode Fuzzy Hash: 144c5401b694974f51f95ed054cfd58255e5e3608f4b0faf65206ff88c737fe7
Instruction Fuzzy Hash: 6FC08C7440390057CE298924A2713A43394A3A1B86FA238CCC8421BA42C51E9C8AD7A0

Function 00D8A2B0 Relevance: 56.2, APIs: 7, Strings: 25, Instructions: 238libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

GetModuleHandleW.KERNEL32(kernel32,28CB4BA0,?,?,00000000), ref: 00D8A3B3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00D8A3FB
__Init_thread_footer.LIBCMT ref: 00D8A40E
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 00D8A456
__Init_thread_footer.LIBCMT ref: 00D8A469
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00D8A4B1
__Init_thread_footer.LIBCMT ref: 00D8A4C4

Part of subcall function 00D61FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00D61FF1
Part of subcall function 00D61FB0: _wcschr.LIBVCRUNTIME ref: 00D620AF

Strings

0|, xrefs: 00D8A500
SetSearchPathMode, xrefs: 00D8A3F5
SetDllDirectory, xrefs: 00D8A450
P*, xrefs: 00D8A582
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00D8A327, 00D8A32F
kernel32.dll, xrefs: 00D8A60D
|, xrefs: 00D8A55A
~, xrefs: 00D8A653
l~, xrefs: 00D8A630
d}, xrefs: 00D8A5A0
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00D8A340, 00D8A34F
x|, xrefs: 00D8A4F6
T~, xrefs: 00D8A5E3
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 00D8A322
@|, xrefs: 00D8A50A
H}, xrefs: 00D8A596
$~, xrefs: 00D8A61B
0}, xrefs: 00D8A550
0|, xrefs: 00D8A5F8
T|, xrefs: 00D8A4EC
kernel32, xrefs: 00D8A3AE
SetDefaultDllDirectories, xrefs: 00D8A4AB
x}, xrefs: 00D8A56E
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 00D8A347
<~, xrefs: 00D8A5DC

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$DirectoryHandleHeapModuleProcessSystem_wcschr
String ID: $~$0|$0|$0}$<~$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@|$H}$P*$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$T|$T~$d}$kernel32$kernel32.dll$l~$x|$x}$|$~
API String ID: 1258094593-3981691408
Opcode ID: ada768fc68f85c8e598de941aff628cbb24e45baa4b56a1e1fab0d1a276d65c2
Instruction ID: 55b22702a877290b296455d39960fd14d69f3cf5466ad81f2df08358e66d8ca4
Opcode Fuzzy Hash: ada768fc68f85c8e598de941aff628cbb24e45baa4b56a1e1fab0d1a276d65c2
Instruction Fuzzy Hash: 5BA1C1B09042189FDB20DF58C84A79EBBB0FF82714F50519AE858BB381E7B0594ACF61

Function 00DE2F90 Relevance: 51.2, APIs: 26, Strings: 3, Instructions: 487timefilememoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,00000000,00000000,0000005C,Everyone,10000000,00000000,?,00000000), ref: 00DE2FA9
LocalFree.KERNEL32(?,00000000,00000000,0000005C,Everyone,10000000,00000000,?,00000000), ref: 00DE2FB9
GetLastError.KERNEL32(?,00000000), ref: 00DE2FF7
LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 00DE3036
GetLastError.KERNEL32(?,00000000), ref: 00DE3050
LocalFree.KERNEL32(?,?,00000000), ref: 00DE3061
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,28CB4BA0,7622F530,?,?), ref: 00DE3100
GetLastError.KERNEL32 ref: 00DE311E
GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 00DE314B
GetLastError.KERNEL32 ref: 00DE3155
FileTimeToSystemTime.KERNEL32(?,?), ref: 00DE31DA
GetLastError.KERNEL32 ref: 00DE31E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 00DE321C
SystemTimeToFileTime.KERNEL32(00000000,00EC341C), ref: 00DE323D
CompareFileTime.KERNEL32(00EC341C,?), ref: 00DE324F
PathFileExistsW.SHLWAPI(?,00000005), ref: 00DE32EC
CreateFileW.KERNEL32(?,C0000000,00000000,0000000C,00000002,00000080,00000000,00000001,S-1-1-0,10000000,00000001), ref: 00DE3387
GetLastError.KERNEL32 ref: 00DE3397
CloseHandle.KERNEL32(00000000), ref: 00DE339F

Strings

S-1-5-18, xrefs: 00DE3352
.part, xrefs: 00DE3291
S-1-1-0, xrefs: 00DE3341

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FileTime$ErrorLast$Local$FreeSystem$Create$AllocCloseCompareExistsHandlePath
String ID: .part$S-1-1-0$S-1-5-18
API String ID: 1123205858-2727065896
Opcode ID: 1f0e35830f35f01852aa041fcb7ae45b7be15391053ff6eacc7d67368c938374
Instruction ID: b55637b6e916d33b433a0c13f78b98dcf82958c0af90be453b403b9b3d2153f0
Opcode Fuzzy Hash: 1f0e35830f35f01852aa041fcb7ae45b7be15391053ff6eacc7d67368c938374
Instruction Fuzzy Hash: 6A129F706007859FDB21EF6ACD49BAABBF4FF44304F18451DE546A76A0DB70EA44CB60

Function 00DD4B10 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 335COMMON

Download Yara Rule

Strings

powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 00DD4C6F
Unable to retrieve PowerShell output from file: , xrefs: 00DD4E6F
ps1, xrefs: 00DD4BB6, 00DD4BC8, 00DD4BD2
txt, xrefs: 00DD4BE3
Unable to retrieve exit code from process., xrefs: 00DD4E92
Unable to create process: , xrefs: 00DD4D15
Unable to get a temp file for script output, temp path: , xrefs: 00DD4C1F
Unable to find file , xrefs: 00DD4B43

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: ed5d05abea2006eae1e011b9dc717c80f080ae555acfc88768b4114b4ebc6919
Instruction ID: 9db45eee992381bb0163432cdcccb611184c5beff315197768b1789e479d840c
Opcode Fuzzy Hash: ed5d05abea2006eae1e011b9dc717c80f080ae555acfc88768b4114b4ebc6919
Instruction Fuzzy Hash: 7FC18F7190164AAFDB10DFA8CD45BAEBBB5FF05314F14825AF414BB391DB74AA04CB60

Function 00DADB40 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 167COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(?,28CB4BA0,?,?,?,00E9C4C5,000000FF,?,00DE04CF,?,?,?,00000000), ref: 00DADCD8
GetActiveWindow.USER32 ref: 00DADC3A

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Strings

MSINEWINSTANCE=1 , xrefs: 00DAE8E6
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 00DAE8FF
|3, xrefs: 00DAE992
AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00DAEB95
TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 00DAE8B7
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00DAE818
TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 00DAE910
.mst, xrefs: 00DAE797, 00DAE7FE, 00DAECBE
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 00DAED93
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 00DAE7B2
|3, xrefs: 00DAEA9F
%s , xrefs: 00DAEA4C, 00DAED81
.msi, xrefs: 00DAE747, 00DAEC40
majorupgrade-content.mst, xrefs: 00DAE756, 00DAEC4F
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 00DAECDF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$ActiveDebugHeapOutputProcessStringWindow
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $.msi$.mst$majorupgrade-content.mst$|3$|3
API String ID: 758407959-886929426
Opcode ID: ba2b45448e1e97ef854ea70b7f47d4ca40295225411dcf78c8c0396616388a22
Instruction ID: 4bde9693ca2bde835201b61c3e7b25c04a3ad1464ed82a5b02eeb0b030f42a06
Opcode Fuzzy Hash: ba2b45448e1e97ef854ea70b7f47d4ca40295225411dcf78c8c0396616388a22
Instruction Fuzzy Hash: A851C075A002059FDB14DB6CC8457AEBBF5EF4A320F18829DE816E7391DB319D00CBA1

Function 00CB16D0 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 359stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00CB1770
GetParent.USER32(?), ref: 00CB17B1
lstrcmpW.KERNEL32(?,#32770), ref: 00CB17D1
GetWindowLongW.USER32(?,000000F0), ref: 00CB1871

Strings

#32770, xrefs: 00CB17C8
L4, xrefs: 00CB19B9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$LongParentlstrcmp
String ID: #32770$L4
API String ID: 4031819654-2928383255
Opcode ID: 5df4e7ef8e9021da4d1e3812c6d24642ed9863232726bb527cadc067cc8d709d
Instruction ID: 256dd1635208023b0a8e595bb3fb132db8e3ae55a5d1b8fb54623c9cdf346636
Opcode Fuzzy Hash: 5df4e7ef8e9021da4d1e3812c6d24642ed9863232726bb527cadc067cc8d709d
Instruction Fuzzy Hash: 07E19E74A00219EFDB14CFA4C858BEEBBB5FF09710F588158E811B7290D735AE44DB60

Function 00DA9E90 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000001F6), ref: 00DA9EDE
GetDlgItem.USER32(?,000001F8), ref: 00DA9EEB
GetDlgItem.USER32(?,000001F7), ref: 00DA9F38
SetWindowTextW.USER32(00000000,00000000), ref: 00DA9F47
ShowWindow.USER32(?,00000005), ref: 00DA9F67

Part of subcall function 00DA93B0: GetWindowLongW.USER32(?,000000F0), ref: 00DA93EF
Part of subcall function 00DA93B0: GetWindowLongW.USER32(?,000000F0), ref: 00DA9400
Part of subcall function 00DA93B0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DA9412
Part of subcall function 00DA93B0: GetWindowLongW.USER32(?,000000EC), ref: 00DA9425
Part of subcall function 00DA93B0: SetWindowLongW.USER32(?,000000EC,00000000), ref: 00DA9434
Part of subcall function 00DA93B0: SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 00DA9448
Part of subcall function 00DA93B0: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DA9457

GetDlgItem.USER32(?,000001F7), ref: 00DA9F86
SetWindowTextW.USER32(00000000,00000000), ref: 00DA9F95
ShowWindow.USER32(?,00000000), ref: 00DA9FB5
ShowWindow.USER32(?,00000000), ref: 00DA9FBC
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 00DAA005
GetDlgItem.USER32(00000000,00000000), ref: 00DAA039
IsWindow.USER32(00000000), ref: 00DAA043
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,00000616), ref: 00DAA090

Strings

Details <<, xrefs: 00DA9F1F
Details >>, xrefs: 00DA9F6D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$ItemLong$Show$MessageSendText
String ID: Details <<$Details >>
API String ID: 1573988680-3763984547
Opcode ID: a4b27bcf7ce6340bb6a79edcb042ae175cb32b804547b186c0b69ef5d32794d2
Instruction ID: 3fc2b7b4fb597d7079d8dd3456933f9fcef30e4dfae18eb703082277b1192592
Opcode Fuzzy Hash: a4b27bcf7ce6340bb6a79edcb042ae175cb32b804547b186c0b69ef5d32794d2
Instruction Fuzzy Hash: D471BC71900208ABDB20DFA8DC56BAEFBF5EF59704F24861DF901B62A0D771A841DB60

Function 00CD2860 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 404memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

CreateThread.KERNEL32(00000000,00000000,00CD29B0,00EC7458,00000000,?), ref: 00CD292A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00CD2943
CloseHandle.KERNEL32(00000000), ref: 00CD2959
CoInitializeEx.COMBASE(00000000,00000000), ref: 00CD2A09
GetProcessHeap.KERNEL32(?,00000000), ref: 00CD2B0B
HeapFree.KERNEL32(00000000,?,00000000), ref: 00CD2B11
GetProcessHeap.KERNEL32(?,00000000), ref: 00CD2B90
HeapFree.KERNEL32(00000000,?,00000000), ref: 00CD2B96
CoUninitialize.COMBASE ref: 00CD2CEA
Concurrency::cancel_current_task.LIBCPMT ref: 00CD2D6B

Strings

|3, xrefs: 00CD2AE5
Xt, xrefs: 00CD2902
|3, xrefs: 00CD2B69
$t, xrefs: 00CD2BCE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseConcurrency::cancel_current_taskCreateHandleInitializeObjectSingleThreadUninitializeWait
String ID: $t$Xt$|3$|3
API String ID: 1779960141-1773862339
Opcode ID: 9455241e11ec095866739ea50d9cdd01eab9fea611ad013314aa6ee46a360a55
Instruction ID: 5b359672b924b8feab13e382e5f9522872543c6421c0ef7a060bf6961d69cff1
Opcode Fuzzy Hash: 9455241e11ec095866739ea50d9cdd01eab9fea611ad013314aa6ee46a360a55
Instruction Fuzzy Hash: 05F17B70D00248DFDB10DFA8C945BAEBBF8FF54304F20815AE915AB391DB749A49DBA1

Function 00DE2A10 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 390libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,28CB4BA0,00000000,00000000), ref: 00DE2AA1
GetLastError.KERNEL32 ref: 00DE2ACF

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 00DE2AE5
FreeLibrary.KERNEL32(00000000), ref: 00DE2AFE
GetLastError.KERNEL32 ref: 00DE2B0B
GetLastError.KERNEL32 ref: 00DE2CF9
GetLastError.KERNEL32 ref: 00DE2D5E

Strings

Advapi32.dll, xrefs: 00DE2A9C
ConvertStringSidToSidW, xrefs: 00DE2ADF
,(, xrefs: 00DE2B30

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLast$Library$AddressAllocFreeHeapLoadProc
String ID: ,($Advapi32.dll$ConvertStringSidToSidW
API String ID: 1560807876-1024809297
Opcode ID: a51636e404bec7900a62fe29d958cfbb915f6ff39f1264a150030cc82d17287f
Instruction ID: 7d3eee948012a28a8dd33ef46efc58fdb6d10dc68c84ab9e89ad4251de213759
Opcode Fuzzy Hash: a51636e404bec7900a62fe29d958cfbb915f6ff39f1264a150030cc82d17287f
Instruction Fuzzy Hash: C2F17CB1C01259EFDB00EFA5C9457EEBBB8FF14314F248219E915B7280D770AA59CBA1

Function 00CDD6E0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,28CB4BA0,?,?,00000000,?,?,?,?,?,?,28CB4BA0,00E68E95,000000FF), ref: 00CDD74D
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00CDD753
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,28CB4BA0,00E68E95,000000FF,?,00CF45FA,00ECB84C,28CB4BA0,28CB4BA0), ref: 00CDD783
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00CDD789

Strings

.dll, xrefs: 00CDD8A6
CoIncrementMTAUsage, xrefs: 00CDD779
RoGetActivationFactory, xrefs: 00CDD743
|3, xrefs: 00CDD81D
combase.dll, xrefs: 00CDD748, 00CDD77E
DllGetActivationFactory, xrefs: 00CDD902

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$|3
API String ID: 2574300362-3126793432
Opcode ID: 975111a0be7e4b409ba059e15c3e15b95853ca9a04b40151a8be55aa7069cc9e
Instruction ID: a007b8ddfe74c34d1c413c91065e2f9d67c15f42bd093cc39d027f3581cd2212
Opcode Fuzzy Hash: 975111a0be7e4b409ba059e15c3e15b95853ca9a04b40151a8be55aa7069cc9e
Instruction Fuzzy Hash: 92A18A71D00209EFDF15EFA8C895BAEBBF4EF08310F14412AE622B7291DB719A45DB51

Function 00CD3400 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 222libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,28CB4BA0,?,?,?,?,?,?,?,28CB4BA0,00E664A5,000000FF,?,00CD371A,00EC74D0), ref: 00CD3467
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00CD346D
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,28CB4BA0,00E664A5,000000FF,?,00CD371A,00EC74D0,28CB4BA0,28CB4BA0), ref: 00CD349E
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00CD34A4

Strings

.dll, xrefs: 00CD35A9
CoIncrementMTAUsage, xrefs: 00CD3494
RoGetActivationFactory, xrefs: 00CD345D
|3, xrefs: 00CD353A
combase.dll, xrefs: 00CD3462, 00CD3499
DllGetActivationFactory, xrefs: 00CD35E9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$|3
API String ID: 2574300362-3126793432
Opcode ID: 263ffe338dfba13beecb19c6a8743dd164778c8c55d4cb03f598dfd0c66a169e
Instruction ID: c1ea4db548ab4e4032c52efe6c4a2b5bb5b64195e9ebe4e8e078a263537e084b
Opcode Fuzzy Hash: 263ffe338dfba13beecb19c6a8743dd164778c8c55d4cb03f598dfd0c66a169e
Instruction Fuzzy Hash: 3A818C70900248EFDB15DFA8D995BEEBBB4FF08310F14412AEA21B7391DB749A05CB61

Function 00DD74C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00F46054,28CB4BA0,?,00000010), ref: 00DD74FC

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

EnterCriticalSection.KERNEL32(00000010,28CB4BA0,?,00000010), ref: 00DD7509
WriteFile.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00DD753B
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00DD7544
WriteFile.KERNEL32(00000000,00DC3C07,6054B9EC,00EA500D,00000000,00EC334C,00000001,?,?,000000FF,00000000), ref: 00DD75C6
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 00DD75CF
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00DD7605
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00DD760E
WriteFile.KERNEL32(00000000,?,?,?,00000000,00EC58A8,00000002,?,?,?,00000000,?,?,000000FF,00000000), ref: 00DD766F
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00DD7678
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 00DD76A8

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Strings

4w, xrefs: 00DD76A8
L3, xrefs: 00DD7589

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocEnterFindHeapInitializeLeaveResource
String ID: 4w$L3
API String ID: 3436934177-2921611606
Opcode ID: 4b5a59e0669f41d8e2576cd4553bfaabec50715190036a096ce2abf029cdb331
Instruction ID: 20a6f009f76d2d2a264433777f807ac118302265e271d0715d8a689d83853273
Opcode Fuzzy Hash: 4b5a59e0669f41d8e2576cd4553bfaabec50715190036a096ce2abf029cdb331
Instruction Fuzzy Hash: 5361C031905645EFDB00DF68CD49BAABBB8FF05314F148259F805A73A1EB31A918DBA0

Function 00CFA430 Relevance: 21.2, APIs: 14, Instructions: 243COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00CFA49E
SetWindowLongW.USER32(?,000000F0,00C80000), ref: 00CFA4CC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00CFA4E1
GetWindowLongW.USER32(?,000000EC), ref: 00CFA518
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00CFA545
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00CFA559
GetWindowLongW.USER32(?,000000F0), ref: 00CFA57B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00CFA592
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00CFA5A6
GetWindowRect.USER32(?,?), ref: 00CFA5F6
GetWindowLongW.USER32(?,000000EC), ref: 00CFA61C
GetWindowRect.USER32(?,?), ref: 00CFA66A
SetWindowPos.USER32(?,00000000,?,?,?,?,00000604,?,?), ref: 00CFA6A0
SetWindowTextW.USER32(?,?), ref: 00CFA6E1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$Rect$Text
String ID:
API String ID: 445026432-0
Opcode ID: 7a22adfb16b284e6a47742d1d12a3b002ae5bb3c1e24dc47204946b617948ab2
Instruction ID: 7cee46dc08302fe33f9d9f354a2aa54bb08a1dc0f13efeb55f389fdee02991e5
Opcode Fuzzy Hash: 7a22adfb16b284e6a47742d1d12a3b002ae5bb3c1e24dc47204946b617948ab2
Instruction Fuzzy Hash: F0917F75A00609AFDB04DFA8DC45BEDBBB5FF58310F204229F926E72A4DB35A910DB50

Function 00DA8440 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 223threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00F4611C,28CB4BA0,?,?,00000000,?,?,?,?,?,00000000,00E9B407,000000FF), ref: 00DA84B3
EnterCriticalSection.KERNEL32(?,28CB4BA0,?,?,00000000,?,?,?,?,?,00000000,00E9B407,000000FF), ref: 00DA84C5
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,00E9B407,000000FF), ref: 00DA84D2
GetCurrentThread.KERNEL32 ref: 00DA84DD
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,00000000,?,00EC337C,00000000,?,?,?,?,?,00000000,00E9B407,000000FF), ref: 00DA86BE
LeaveCriticalSection.KERNEL32(?,00EC337C,00000000,?,?,?,?,?,00000000,00E9B407,000000FF), ref: 00DA879A

Strings

*** Stack Trace (x86) ***, xrefs: 00DA85B7
MODULE_BASE_ADDRESS, xrefs: 00DA870B
4w, xrefs: 00DA879A
<--------------------MORE--FRAMES-------------------->, xrefs: 00DA8662
{t, xrefs: 00DA8502
[0x%.8Ix] , xrefs: 00DA86C5

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ 4w$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix] ${t
API String ID: 3051236879-3716644935
Opcode ID: 77a40d81d3256100f3aeabc19b322749bc1512727d11633b80f4228476da668d
Instruction ID: 2a06d39a7e84e0859aee12eeb695b2e4d5affce1a9031493b59e999beb16b4d8
Opcode Fuzzy Hash: 77a40d81d3256100f3aeabc19b322749bc1512727d11633b80f4228476da668d
Instruction Fuzzy Hash: 94A17D719003889FEF25DFA4CD45BEE7BB8BF06308F044168E959AB281DB755B08DB61

Function 00D059B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00D059F7
GetParent.USER32 ref: 00D05A0D
GetWindowRect.USER32(?,?), ref: 00D05A18
GetParent.USER32(?), ref: 00D05A20
GetWindow.USER32(?,00000004), ref: 00D05A52
GetWindowRect.USER32(?,?), ref: 00D05A60
GetWindowLongW.USER32(00000000,000000F0), ref: 00D05A6D
MonitorFromWindow.USER32(?,00000002), ref: 00D05A85
GetMonitorInfoW.USER32(00000000,?), ref: 00D05A9F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015,?,00000004), ref: 00D05B4D

Strings

$/, xrefs: 00D05A44

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$LongMonitorParentRect$FromInfo
String ID: $/
API String ID: 1820395375-2114005866
Opcode ID: 543c4e5c94a80830af75a725a89e3b8d04cbcd3d6afb47dbd274845d050afb3e
Instruction ID: 5047c72aa6ec59bc291b18825abeeeaad4c175706f994b74250c7981b3fad136
Opcode Fuzzy Hash: 543c4e5c94a80830af75a725a89e3b8d04cbcd3d6afb47dbd274845d050afb3e
Instruction Fuzzy Hash: C6514E76E005199FDB10CBA8DD45B9EBBB9EB49710F254229EC15B3294DB30BD05CF50

Function 00DA93B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00DA93EF
GetWindowLongW.USER32(?,000000F0), ref: 00DA9400
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DA9412
GetWindowLongW.USER32(?,000000EC), ref: 00DA9425
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00DA9434
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 00DA9448
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DA9457
GetWindowRect.USER32(?,?), ref: 00DA9496
GetDlgItem.USER32(?,?), ref: 00DA94D2
IsWindow.USER32(00000000), ref: 00DA94DD
GetWindowRect.USER32(?,?), ref: 00DA94F8

Strings

$/, xrefs: 00DA9509

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$MessageRectSend$Item
String ID: $/
API String ID: 661679956-2114005866
Opcode ID: 5c222c375744e481506f687a35e34be7deb4edba2f81cb39d436423b15c812b7
Instruction ID: a4735b784a95284fdaf01981d2201138eb7951c0c6c635cf398ab0d11b43fd2b
Opcode Fuzzy Hash: 5c222c375744e481506f687a35e34be7deb4edba2f81cb39d436423b15c812b7
Instruction Fuzzy Hash: 81419E355047059FD720DF68DC90B2BF7E4BF6A314F148A1DF9AAA22A1D770F8848B61

Function 00DA9D00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA2350: LoadLibraryW.KERNEL32(ComCtl32.dll,28CB4BA0,00000000,?,00000000), ref: 00DA238E
Part of subcall function 00DA2350: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 00DA23B1
Part of subcall function 00DA2350: FreeLibrary.KERNEL32(00000000), ref: 00DA242F

GetDlgItem.USER32(?,000001F4), ref: 00DA9D41
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 00DA9D52
MulDiv.KERNEL32(00000009,00000000), ref: 00DA9D6A
GetDlgItem.USER32(?,000001F6), ref: 00DA9DA4
IsWindow.USER32(00000000), ref: 00DA9DAD
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 00DA9DC4
GetDlgItem.USER32(?,000001F8), ref: 00DA9DCE
GetWindowRect.USER32(?,?), ref: 00DA9DDF
GetWindowRect.USER32(?,?), ref: 00DA9DF2
GetWindowRect.USER32(00000000,?), ref: 00DA9E02

Strings

Courier New, xrefs: 00DA9D70
;3, xrefs: 00DA9D93

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$ItemRect$LibraryMessageSend$AddressFreeLoadProc
String ID: ;3$Courier New
API String ID: 1717253393-2995846664
Opcode ID: 628127993f399d4e433f37f5292ec3a9cde6c4871c3431a7952c1c68f2535922
Instruction ID: a142462b6a486640d780ac065df32f3439a1d2cc59d5ceb2e1e5e28e24cabf03
Opcode Fuzzy Hash: 628127993f399d4e433f37f5292ec3a9cde6c4871c3431a7952c1c68f2535922
Instruction Fuzzy Hash: 9A41C771BC43087BEB149F258C52FAE77A9EF59B04F050519FB057A1D1DAB0B8408B64

Function 00CAF5F0 Relevance: 21.1, APIs: 4, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F46250,28CB4BA0,00000000,?,?,?,?,?,?,00CAEE50,00E5F68D,000000FF), ref: 00CAF62D
LoadCursorW.USER32(00000000,00007F00), ref: 00CAF6A8
LoadCursorW.USER32(00000000,00007F00), ref: 00CAF74E
LeaveCriticalSection.KERNEL32(00F46250), ref: 00CAF7A3

Strings

WM_ATLGETCONTROL, xrefs: 00CAF644
4w, xrefs: 00CAF7A3
AtlAxWin140, xrefs: 00CAF65F, 00CAF6C3
f., xrefs: 00CAF6D1, 00CAF76F
AtlAxWinLic140, xrefs: 00CAF70F, 00CAF765
0, xrefs: 00CAF733
p., xrefs: 00CAF650
WM_ATLGETHOST, xrefs: 00CAF639

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: 4w$0$AtlAxWin140$AtlAxWinLic140$WM_ATLGETCONTROL$WM_ATLGETHOST$f.$p.
API String ID: 3727441302-1818679655
Opcode ID: 4a923034f8968cb49a2105a538c5cdefcbc8a24b8fff4c4c7eebf12f0b9420db
Instruction ID: 1a8975a6d4ab02db24419f89fd1f521e7735d232788ac38fcca34f280ceff03f
Opcode Fuzzy Hash: 4a923034f8968cb49a2105a538c5cdefcbc8a24b8fff4c4c7eebf12f0b9420db
Instruction Fuzzy Hash: 8A5137B4C11319AFDB10DFE4D988BDEBFF8AB09718F10412AE804F7290DBB556059BA1

Function 00DCEC20 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 413registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\JavaSoft\Java Development Kit\,00000000,?,?,28CB4BA0,?,?), ref: 00DCEC83
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?), ref: 00DCEE19
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?,?,?,?), ref: 00DCEE75
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?), ref: 00DCEEC5
RegCloseKey.ADVAPI32(?), ref: 00DCEF05

Strings

Software\JavaSoft\Java Development Kit\, xrefs: 00DCEC75, 00DCEC7D
JavaHome, xrefs: 00DCEE6F, 00DCEEBA
Software\JavaSoft\Java Runtime Environment\, xrefs: 00DCEC66

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: OpenQueryValue$Close
String ID: JavaHome$Software\JavaSoft\Java Development Kit\$Software\JavaSoft\Java Runtime Environment\
API String ID: 2529929805-1079072530
Opcode ID: f8786f31c08c4c99d37f3e8e8c1cc2ed08bfa7b5a0f1fad9df90774cf1b9bee5
Instruction ID: 0fc00bea1251ed8ad14048d68cb372d17d9a9c06da2eb83f2d452d7e1fadb813
Opcode Fuzzy Hash: f8786f31c08c4c99d37f3e8e8c1cc2ed08bfa7b5a0f1fad9df90774cf1b9bee5
Instruction Fuzzy Hash: 4902807090526A9BDB20DF68CC89BDDB7B4EF54304F1442E9E809A7291DB75AE84CF60

Function 00DD81B0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,28CB4BA0,?,?,00F46054), ref: 00DD81F8
LoadLibraryW.KERNEL32(Shell32.dll,?,00F46054), ref: 00DD8207
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 00DD821B
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 00DD829A
SHGetMalloc.SHELL32(?), ref: 00DD82D7
PathFileExistsW.SHLWAPI(?,ADVINST_LOGS,0000000C,?,00000000), ref: 00DD832A
CreateDirectoryW.KERNEL32(?,?,Everyone,10000000,00000000,?,00000000), ref: 00DD83B5

Strings

ADVINST_LOGS, xrefs: 00DD831D
SHGetSpecialFolderPathW, xrefs: 00DD8215
Everyone, xrefs: 00DD8371
Shell32.dll, xrefs: 00DD8202

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Path$AddressCreateDirectoryExistsFileFolderFromLibraryListLoadLocationMallocProcSpecial
String ID: ADVINST_LOGS$Everyone$SHGetSpecialFolderPathW$Shell32.dll
API String ID: 1254244429-1733115844
Opcode ID: 6f0454d7b10696c84ebfaa78277ac0832f2f4ac464d2634a10e762f29fac73dd
Instruction ID: fe3785d651ba5b63bc21cd0ba326f36c22960479d47be6662d5f237f0dc2963b
Opcode Fuzzy Hash: 6f0454d7b10696c84ebfaa78277ac0832f2f4ac464d2634a10e762f29fac73dd
Instruction Fuzzy Hash: D9B1BB70D00609DFDB11DFA9C849BAEBBF4EF54310F28825AE415B73A0EB749A04DB60

Function 00CCC7D0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,28CB4BA0), ref: 00CCC85C

Part of subcall function 00CB0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00CB0DE6

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 00CCC95F
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 00CCC973
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 00CCC988
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 00CCC99D
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 00CCC9B4
GetWindowRect.USER32(?,?), ref: 00CCC9E6
SendMessageW.USER32(00000000,00000412,00000000), ref: 00CCCA48
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 00CCCA58

Strings

tooltips_class32, xrefs: 00CCC855
,, xrefs: 00CCC90E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,$tooltips_class32
API String ID: 1954517558-3856767331
Opcode ID: ce42b091aa18814f3b5b31d1a99b85090035526849e3933e11d68de1b931da30
Instruction ID: 65428758f225738e9d44b669da59e99994cc6ea4e85716801823ce8cca7fda22
Opcode Fuzzy Hash: ce42b091aa18814f3b5b31d1a99b85090035526849e3933e11d68de1b931da30
Instruction Fuzzy Hash: 26912D75A00308AFEB14CFA4DD95FAEBBF9FB08700F14452AF916EA291D774A904DB50

Function 00DA9A60 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00DA9A94
EndDialog.USER32(?,00000000), ref: 00DA9B52

Part of subcall function 00DA9550: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00DA9582
Part of subcall function 00DA9550: GetWindowLongW.USER32(?,000000F0), ref: 00DA9588
Part of subcall function 00DA9550: GetDlgItem.USER32(?,?), ref: 00DA95FA
Part of subcall function 00DA9550: GetWindowRect.USER32(00000000,?), ref: 00DA9612

Strings

U2, xrefs: 00DA9AE0
L/, xrefs: 00DA9B71

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Long$DialogItemMessageRectSend
String ID: L/$U2
API String ID: 188208873-3769047970
Opcode ID: 8cc31bbfda107241db22823e9e0b5252022f82763cc908f9c0960109e653f492
Instruction ID: 5be551eeacd3261ee67ddfd0ee3784c677bfc83d00ea5906ec3be3e89055bec9
Opcode Fuzzy Hash: 8cc31bbfda107241db22823e9e0b5252022f82763cc908f9c0960109e653f492
Instruction Fuzzy Hash: FD71B231A006099BDB14CF69CCA8BAEFBF4FB4A720F140619E812E76D0D774E940DB60

Function 00DA5310 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00DA54AE
__Init_thread_footer.LIBCMT ref: 00DA5607
GetStdHandle.KERNEL32(000000F5,?,28CB4BA0,?,?), ref: 00DA568F
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 00DA5696
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 00DA56AA
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00DA56B1

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,00000000,00000000,00EC58A8,00000002,?,?), ref: 00DA5740
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 00DA5747
IsWindow.USER32(00000000), ref: 00DA5960

Strings

Error, xrefs: 00DA58FF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalInit_thread_footerSectionText$BufferEnterInfoLeaveScreenWindow
String ID: Error
API String ID: 2811146417-2619118453
Opcode ID: 4f7204ce0fdc8a6ecaedced784530bd7434b3ee5f27dae4c29512b0b2c023f89
Instruction ID: 857479c9cd2119057ea804f3b73c79fa8a2f14ced30250289057585be9e22aed
Opcode Fuzzy Hash: 4f7204ce0fdc8a6ecaedced784530bd7434b3ee5f27dae4c29512b0b2c023f89
Instruction Fuzzy Hash: FE226A70D00708DFDB10CFA4D945B9EBBB0BF16318F244298E459B7291DBB5AA88CF61

Function 00DCF880 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 296libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D61FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00D61FF1
Part of subcall function 00D61FB0: _wcschr.LIBVCRUNTIME ref: 00D620AF

GetLastError.KERNEL32(28CB4BA0,?,?,?,000000FF,?,00DB4196,?,?), ref: 00DCF8ED
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00DCFA7A
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 00DCFADE
FreeLibrary.KERNEL32(00000000,?,?,000000FF,?,00DB4196,?,?), ref: 00DCFBD2

Strings

,(, xrefs: 00DCFBC6
x64, xrefs: 00DCF966
GetPackagePath, xrefs: 00DCFA74, 00DCFAD8
x86, xrefs: 00DCF938
Kernel32.dll, xrefs: 00DCF8C1
neutral, xrefs: 00DCF982

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem_wcschr
String ID: ,($GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 3734293021-3125337207
Opcode ID: 9b6bd68a80eb0095d160a34c8d0f60fb052a19f0f5f8b1ed6f4d4efa4c42f8af
Instruction ID: e3478a9e9d590d86b81af6daceb85d2dca996721ac8dde6e2beee862d6c4ca28
Opcode Fuzzy Hash: 9b6bd68a80eb0095d160a34c8d0f60fb052a19f0f5f8b1ed6f4d4efa4c42f8af
Instruction Fuzzy Hash: E8C15C70A002069FDB04DFA8C995B9EFBB6FF49314F14826DE815AB391DB709D45CBA0

Function 00DF2A80 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 282COMMON

Download Yara Rule

Strings

PropertyValue, xrefs: 00DF2CC9
Visible, xrefs: 00DF2B6D
Text, xrefs: 00DF2AFA
Progress, xrefs: 00DF2ABD
TimeRemaining, xrefs: 00DF2C4F
Enabled, xrefs: 00DF2BE0

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: Enabled$Progress$PropertyValue$Text$TimeRemaining$Visible
API String ID: 0-2691827946
Opcode ID: 25be65ebf49e89e2c18ea8e3924b1de5b54ef688f00a28ffe5d1cbc302c76b95
Instruction ID: 0c032bf2373faccea9b642506a6417ebfa6b6e955e9292c3269c08264971a83a
Opcode Fuzzy Hash: 25be65ebf49e89e2c18ea8e3924b1de5b54ef688f00a28ffe5d1cbc302c76b95
Instruction Fuzzy Hash: DBB1ADB1A00349DFDB14CF48D845B6EBBF1FB91320F14826EE9299B390D7759A01CBA1

Function 00DCD7C0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 121COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00DCD7F6

Strings

HKEY_CURRENT_CONFIG, xrefs: 00DCD8B9
HKEY_LOCAL_MACHINE, xrefs: 00DCD83D
HKCR, xrefs: 00DCD87D
HKCU, xrefs: 00DCD855
HKCC, xrefs: 00DCD8A5
HKEY_CURRENT_USER, xrefs: 00DCD869
HKEY_CLASSES_ROOT, xrefs: 00DCD891
HKLM, xrefs: 00DCD825

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKLM
API String ID: 2691759472-1956487666
Opcode ID: aa0fe4f7606be45dc5d4b06be54142be561a8fdb84152f2a70e4b6a686e3630f
Instruction ID: eff24362dd440d6a81fc920443ad1a8884b1ad1d71f048fb40ea2bbd1275d465
Opcode Fuzzy Hash: aa0fe4f7606be45dc5d4b06be54142be561a8fdb84152f2a70e4b6a686e3630f
Instruction Fuzzy Hash: 3541B0B6E40616AFDB105A64DC42F2AB7A9EF40721F18063EAC14B36D0EB71DC10DAB1

Function 00CC3190 Relevance: 15.3, APIs: 10, Instructions: 339memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CC31EA
VariantClear.OLEAUT32(?), ref: 00CC321C
VariantClear.OLEAUT32(?), ref: 00CC3316
VariantClear.OLEAUT32(?), ref: 00CC3345
SysFreeString.OLEAUT32(00000000), ref: 00CC334C
SysAllocString.OLEAUT32(00000000), ref: 00CC3393
VariantClear.OLEAUT32(?), ref: 00CC341A
VariantClear.OLEAUT32(?), ref: 00CC344C
VariantClear.OLEAUT32(?), ref: 00CC3527
VariantClear.OLEAUT32(?), ref: 00CC3556

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: a8bd188c27aeddfdf8b08e27daeae7b1806dc45c9130506ae6bc6b95e14dce4f
Instruction ID: 4ddc8cc03965e2d53964ee6ce0e8d23711a7c719a28a982305a2f71514ceb1c0
Opcode Fuzzy Hash: a8bd188c27aeddfdf8b08e27daeae7b1806dc45c9130506ae6bc6b95e14dce4f
Instruction Fuzzy Hash: 42C19C71900249DFCB10DFA8D848BEEBBB4FF09314F148269E415E7391E778AA45DBA4

Function 00DD2BC0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

ResetEvent.KERNEL32(?,?,?), ref: 00DD2C4A
SetEvent.KERNEL32(?,?,?,?,?,00000001,08000000,?,?,?), ref: 00DD2C83
ResetEvent.KERNEL32(?,?,?,?,?,00000001,08000000,?,?,?), ref: 00DD2E19
SetEvent.KERNEL32(?,?,?,?,?,?,00000001,08000000,?,?,?), ref: 00DD2E4B
ResetEvent.KERNEL32(?,?,?,?,?,?,00000001,08000000), ref: 00DD2F26
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000001,08000000), ref: 00DD2F43
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000001,08000000), ref: 00DD2F4A

Strings

FTP Server, xrefs: 00DD2CF6, 00DD2D08, 00DD2D12

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Event$Reset$Init_thread_footerObjectSingleWait$HeapProcess
String ID: FTP Server
API String ID: 3860647947-688436434
Opcode ID: 84cab049a3b340e411b7fa553600ff38a21c7a85d7bc62257f6f5d453ef8a885
Instruction ID: b1e79d9416fff1c97b03c96bfb728446b709d45b3f2f5b2ec575dbbd17a73fd6
Opcode Fuzzy Hash: 84cab049a3b340e411b7fa553600ff38a21c7a85d7bc62257f6f5d453ef8a885
Instruction Fuzzy Hash: 0AD19030A01249DFDB00DF69C988BAEBBB5FF59314F18825AE814AB391D774DD05CBA0

Function 00D89FD0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 232fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?), ref: 00D8A069
CloseHandle.KERNEL32(00000000), ref: 00D8A090

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Part of subcall function 00D8BC00: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,?,80070057,28CB4BA0,?,?,00000000,00E5D670,000000FF,?,00DD338D), ref: 00D8BC3D
Part of subcall function 00D8BC00: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000), ref: 00D8BC6E

WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?), ref: 00D8A105
CloseHandle.KERNEL32(00000000), ref: 00D8A157

Part of subcall function 00D8BA20: WideCharToMultiByte.KERNEL32(00000003,00000000,00DB3DCA,000000FF,00000000,00000000,00000000,00000000,?,?,?,00DB3DCA,?,?), ref: 00D8BA3C
Part of subcall function 00D8BA20: WideCharToMultiByte.KERNEL32(00000003,00000000,00DB3DCA,000000FF,?,-00000001,00000000,00000000,?,?,?,00DB3DCA,?,?), ref: 00D8BA73

Strings

3, xrefs: 00D8A18A
.bat, xrefs: 00D8A01E
EXE, xrefs: 00D8A023
open, xrefs: 00D8A183

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ByteCharMultiWide$CloseFileHandleInit_thread_footer$CreateFindHeapProcessResourceWrite
String ID: .bat$EXE$open$3
API String ID: 4275363648-2048902016
Opcode ID: c7b544bf0e04f915e16e85c930e0bff67bd0d2c670a502eb8a7ec532f053d7b9
Instruction ID: be83e588236dfc86fbf0d85e67ce639241606426c66c4d1ab9bcdcf53a166b32
Opcode Fuzzy Hash: c7b544bf0e04f915e16e85c930e0bff67bd0d2c670a502eb8a7ec532f053d7b9
Instruction Fuzzy Hash: 24A17970901649EFEB10DFA8CD48B9DFBB4FF45314F24829AE414AB2A1DB749909CF61

Function 00CCB720 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 218windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000C5,?,00000000), ref: 00CCB771
SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 00CCB7D5
lstrcpynW.KERNEL32(?,?,00000020), ref: 00CCB847
MulDiv.KERNEL32(?,00000048,00000000), ref: 00CCB884
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 00CCB8B6

Strings

t, xrefs: 00CCB892
?, xrefs: 00CCB88A
U2, xrefs: 00CCB8F2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$lstrcpyn
String ID: ?$U2$t
API String ID: 3928028829-3597738165
Opcode ID: bb864a6dc84a6bcf693dda08b60f57ab2b36c7a51c88e91e6b17541ab9c466a3
Instruction ID: 34a1f1be628b0624d964d77403598509f96ab17413483dfb786d12e0bc987bee
Opcode Fuzzy Hash: bb864a6dc84a6bcf693dda08b60f57ab2b36c7a51c88e91e6b17541ab9c466a3
Instruction Fuzzy Hash: 3F916071604344AFE721DF64CC45F9BBBE8AF89300F044A2AF699E71A1DB74E944CB52

Function 00DD4900 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,00DB4998), ref: 00DD49F3
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 00DD4A37
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 00DD4A54
CloseHandle.KERNEL32(00000000), ref: 00DD4A6E
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 00DD4AAD

Strings

Unable to save script file , xrefs: 00DD4A7D
Unable to get temp file , xrefs: 00DD49D4
ps1, xrefs: 00DD4969, 00DD497B, 00DD4985, 00DD4996

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: b2e0759cb04082aab776028730d6a937eea3f2f9ba2e03a2f44a00c1608fa659
Instruction ID: 9a375d84e260fad15192a1b6de5b6463ffcbc6ab1f7dc1cda29d24ed126a1f83
Opcode Fuzzy Hash: b2e0759cb04082aab776028730d6a937eea3f2f9ba2e03a2f44a00c1608fa659
Instruction Fuzzy Hash: 5551C670940609AFDB10DB68CD4ABAEBBB8EF05318F148259E510BB3D2D7749D04CBA4

Function 00CB2500 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F46250,28CB4BA0,00000000,00F4626C), ref: 00CB2573
LeaveCriticalSection.KERNEL32(00F46250), ref: 00CB25D7
LoadCursorW.USER32(00CA0000,?), ref: 00CB2630
LeaveCriticalSection.KERNEL32(00F46250), ref: 00CB26C8

Strings

4w, xrefs: 00CB25D7, 00CB26C8
ATL:%p, xrefs: 00CB2650
f., xrefs: 00CB2699
p., xrefs: 00CB25AA, 00CB25C1, 00CB2686

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: 4w$ATL:%p$f.$p.
API String ID: 2080323225-1471878312
Opcode ID: cc0fb209c6ee089a5a38f0626d2c32dbbb49e67c813b277695f506e1aed53080
Instruction ID: 3ba275e7dcfabd1154e80173349f659180987b4ed10996041adc278d82c444e1
Opcode Fuzzy Hash: cc0fb209c6ee089a5a38f0626d2c32dbbb49e67c813b277695f506e1aed53080
Instruction Fuzzy Hash: 5A519C70904B449BDB20CF69C9457AAFBF4FF59314F00861DECA6A3690EB70BA84CB51

Function 00DA9550 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00DA9582
GetWindowLongW.USER32(?,000000F0), ref: 00DA9588
GetDlgItem.USER32(?,?), ref: 00DA95FA
GetWindowRect.USER32(00000000,?), ref: 00DA9612
SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 00DA969F
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00DA96D3

Strings

L/, xrefs: 00DA9566
$/, xrefs: 00DA9623

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$MessageSend$ItemLongRect
String ID: $/$L/
API String ID: 3432912040-3308459630
Opcode ID: 7a251a9464cf26e56782774bca7fe015033a66f2ab1641c6ba7cf524ba49270e
Instruction ID: 978dc87a807d746d32132db7f161c86d9eb60f22262ff899a05b96bab31b423a
Opcode Fuzzy Hash: 7a251a9464cf26e56782774bca7fe015033a66f2ab1641c6ba7cf524ba49270e
Instruction Fuzzy Hash: F9518C34204304DFD724CF28C985B2ABBE1FF85718F184A1CF995AB2A5D771E844CB61

Function 00DC3C80 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 00DC3CBE
GetUserDefaultLangID.KERNEL32 ref: 00DC3CCB
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00DC3CDD
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 00DC3CF1
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 00DC3D06

Strings

kernel32.dll, xrefs: 00DC3CD4
GetUserDefaultUILanguage, xrefs: 00DC3D00
GetSystemDefaultUILanguage, xrefs: 00DC3CEB

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 2018aeefa8bbd2e60600e5e48f594f16277845038e17fd0c32615d2c6f997162
Instruction ID: 0c1e06ac0acbd4c43872bb1e65c93a59a9eaf760ac34c045fe74d5f09ab8d9e7
Opcode Fuzzy Hash: 2018aeefa8bbd2e60600e5e48f594f16277845038e17fd0c32615d2c6f997162
Instruction Fuzzy Hash: 7D41C1706043029FC744EF28D850BBAB7E5EFA8345F55591EF886D7280EB318A44CB62

Function 00E39810 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00E39847
___except_validate_context_record.LIBVCRUNTIME ref: 00E3984F
_ValidateLocalCookies.LIBCMT ref: 00E398D8
__IsNonwritableInCurrentImage.LIBCMT ref: 00E39903
_ValidateLocalCookies.LIBCMT ref: 00E39958
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00E3996E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00E39983

Strings

csm, xrefs: 00E398ED

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: 3eec3cde57724ac08d3860034fa9ede670b5df65be3e3b5db26b2746871a8b22
Instruction ID: 1d66e1659be701d66f96cc42cd8301aba0b576b5c7432028c3e87653a16974ff
Opcode Fuzzy Hash: 3eec3cde57724ac08d3860034fa9ede670b5df65be3e3b5db26b2746871a8b22
Instruction Fuzzy Hash: CE41E734D002089BCF14EF68C889A9EBFF1AF85318F1490A5E8147B393C771D905CB91

Function 00DD0260 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 454synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00DD2140: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,00DD029A,?,28CB4BA0,?,?,?,000000FF,?), ref: 00DD2154
Part of subcall function 00DD2140: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00DD029A,?,28CB4BA0,?,?,?,000000FF,?,00DCFC64), ref: 00DD2171
Part of subcall function 00DD2140: GetLastError.KERNEL32(?,28CB4BA0,?,?,?,000000FF,?,00DCFC64,?,?,00000000,00000000,28CB4BA0,?,?), ref: 00DD21D0

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

ResetEvent.KERNEL32(?,00000000,00EA38DD), ref: 00DD036A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00DD0389
WaitForSingleObject.KERNEL32(28CB4BA0,000000FF), ref: 00DD0390

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

Strings

GET, xrefs: 00DD02EA
h[, xrefs: 00DD052F
attachment, xrefs: 00DD059D
filename, xrefs: 00DD06E1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Event$CreateInit_thread_footerObjectSingleWait$ErrorFindHeapLastProcessResetResource
String ID: GET$attachment$filename$h[
API String ID: 818129584-2595992338
Opcode ID: b23a87c4fc891a0744fe7c86beafd97256c4990b03d028d70b5231d61af1e59b
Instruction ID: cae0b0debd3abd49c8ed4aea9e769c17ab1c7ea2775f5b354460809d33d8c1c6
Opcode Fuzzy Hash: b23a87c4fc891a0744fe7c86beafd97256c4990b03d028d70b5231d61af1e59b
Instruction Fuzzy Hash: B2028E70901249EFDB10DFA8C945BAEBBF4FF55314F14816AE815AB391DB70AA04CFA1

Function 00CB0E10 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00EC37FC,00000000,00000001,00EC3E84,?), ref: 00CB0EE0

Strings

>, xrefs: 00CB0EFE
:, xrefs: 00CB0ECA
{, xrefs: 00CB0F40

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateInstance
String ID: :${$>
API String ID: 542301482-2061168328
Opcode ID: 991f2da531769128cde3c7f29505b17be93fa0327582506fce5054ef75909144
Instruction ID: 7ed0fba0af064b9cec3a16964c8f62a2b05b76c13ff6911e8f99b8313e420e94
Opcode Fuzzy Hash: 991f2da531769128cde3c7f29505b17be93fa0327582506fce5054ef75909144
Instruction Fuzzy Hash: 29619F74A002959BDF249FA89855BFEB7B4EB09714F244429FC51FB280D775DE80CB60

Function 00CCDE90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 00CCDEF7
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 00CCDF1F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00CCDF37
SendMessageW.USER32(?,0000130A,00000000,?), ref: 00CCDF68
GetParent.USER32(?), ref: 00CCE044
SendMessageW.USER32(00000000,00000136,?,?), ref: 00CCE055

Strings

U2, xrefs: 00CCDFB9, 00CCE064

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$Parent
String ID: U2
API String ID: 1020955656-415264087
Opcode ID: 7277fee8e09c13333b4be3ba5d58b14057d824bff807ba446a1a084089e4f878
Instruction ID: 2ef53cc28fc2127a71f2f79f3774f87649f991274895c5e16c452136b1171183
Opcode Fuzzy Hash: 7277fee8e09c13333b4be3ba5d58b14057d824bff807ba446a1a084089e4f878
Instruction Fuzzy Hash: A2613476A10618AFDB119FE4DC09FAEBBB9FF59710F140119FA19BB2A0C7706A40DB50

Function 00D82240 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 00D822AB
GetParent.USER32(00000000), ref: 00D822FE
GetWindowRect.USER32(00000000), ref: 00D82301
GetParent.USER32(00000000), ref: 00D82310

Part of subcall function 00D3FCF0: GetWindowRect.USER32(?,?), ref: 00D3FD8B
Part of subcall function 00D3FCF0: GetWindowRect.USER32(?,?), ref: 00D3FDA3

SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00D82400
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00D82413

Strings

$/, xrefs: 00D823A6

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageRectSendWindow$Parent
String ID: $/
API String ID: 425339167-2114005866
Opcode ID: 08115280d2c6afb3940894f8bdaae65f2af8d6875209f03b21f9db0917d703ec
Instruction ID: c2c8bb7cef9077bb0b15a46730c2c497a9412fb07596dffa38c599b47d86e086
Opcode Fuzzy Hash: 08115280d2c6afb3940894f8bdaae65f2af8d6875209f03b21f9db0917d703ec
Instruction Fuzzy Hash: 7E512675D00648ABDB11DFA8CD45BDEBBF8AF5A710F144319E815B7291EB706A808B60

Function 00CB6C00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 148fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CB6CEF

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?), ref: 00CB6D43
CloseHandle.KERNEL32(00000000), ref: 00CB6D92

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 00CB6DF6
CloseHandle.KERNEL32(00000000,?), ref: 00CB6E1C

Strings

aix, xrefs: 00CB6D01
html, xrefs: 00CB6CFC

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html
API String ID: 2030708724-2369804267
Opcode ID: e6377344ce738993b3708e689ec7a7d4149972dc160118f299355954e1799633
Instruction ID: d7effcccbf30875ba1da5101282da8de9d96588d4c17088caf1614b461ca7de9
Opcode Fuzzy Hash: e6377344ce738993b3708e689ec7a7d4149972dc160118f299355954e1799633
Instruction Fuzzy Hash: C3516EB0A00248EFDF10DFA4DD59B9EBBB4FB56308F10425DE401AB291D7F95A09DB62

Function 00D82470 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00D82500

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

GetProcAddress.KERNEL32(SetWindowTheme), ref: 00D8253D
__Init_thread_footer.LIBCMT ref: 00D82554
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00D8257F

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

Part of subcall function 00D61FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00D61FF1
Part of subcall function 00D61FB0: _wcschr.LIBVCRUNTIME ref: 00D620AF

Strings

explorer, xrefs: 00D82567
SetWindowTheme, xrefs: 00D82532
UxTheme.dll, xrefs: 00D824D1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake_wcschr
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3852524043-3123591815
Opcode ID: 72b8a1ab1c33a64f4d78d2b0a779610af592e990f180129e25feed422250734f
Instruction ID: 1ae925c411b83b268ced2cbf7312aeb6ff20e84e1e69bbf73f73b3175920e689
Opcode Fuzzy Hash: 72b8a1ab1c33a64f4d78d2b0a779610af592e990f180129e25feed422250734f
Instruction Fuzzy Hash: 9E21E1B4A40308EBC720DF24ED06B59BBB4EB22720F184215FD24E73D4D770A901EBA2

Function 00CB97E0 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CB980A
GetWindow.USER32(?,00000005), ref: 00CB9817
GetWindow.USER32(00000000,00000002), ref: 00CB9952

Part of subcall function 00CB9660: GetWindowRect.USER32(?,?), ref: 00CB968C
Part of subcall function 00CB9660: GetWindowRect.USER32(?,?), ref: 00CB969C

GetWindowRect.USER32(?,?), ref: 00CB98AB
GetWindowRect.USER32(00000000,?), ref: 00CB98BB
GetWindowRect.USER32(00000000,?), ref: 00CB98D5

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: 0c6ec5a32dfc8b3e420c0bd8ad9041fcd5fa9406c62510e9666baa85b3efa07e
Instruction ID: 0de8658ad6a5a684a1c000b14bcddaae6572da7e08ee645796fe2c7fa5db3870
Opcode Fuzzy Hash: 0c6ec5a32dfc8b3e420c0bd8ad9041fcd5fa9406c62510e9666baa85b3efa07e
Instruction Fuzzy Hash: 6C41BF309087019BC721DF25C980AABF7F9FF96704F504A1DF29593661EB31E988CB12

Function 00E35BAB Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00E35D55,00000000,?,?,00CB0B74,?), ref: 00E35BCF
HeapAlloc.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35BD6

Part of subcall function 00E35CA1: IsProcessorFeaturePresent.KERNEL32(0000000C,00E35BBD,00000000,?,00E35D55,00000000,?,?,00CB0B74,?), ref: 00E35CA3

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00E35D55,00000000,?,?,00CB0B74,?), ref: 00E35BE6
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,00CB0B74,?), ref: 00E35C0D
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,00CB0B74,?), ref: 00E35C21
InterlockedPopEntrySList.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35C34
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,00CB0B74,?), ref: 00E35C47

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 32a0dd8fe9cee1b0e06e4c0194d4a0ae34b494e2bf00bb0fee3def99be43f8a4
Instruction ID: 468adaa091f25fa1494da3b0526fb4b60c8fdeeeedb6fac446acf314bba0ef02
Opcode Fuzzy Hash: 32a0dd8fe9cee1b0e06e4c0194d4a0ae34b494e2bf00bb0fee3def99be43f8a4
Instruction Fuzzy Hash: 1D119672601F15AFD7211B65AE8CF6BBA5CEB4478DF192522FA01F6350DE20DC04D670

Function 00DE6EA0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 371COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

_wcschr.LIBVCRUNTIME ref: 00DE6F6B
_wcschr.LIBVCRUNTIME ref: 00DE701D
_wcschr.LIBVCRUNTIME ref: 00DE703C

Part of subcall function 00CA9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,00CB69F0,-00000010,?,00CBAA9D,*.*), ref: 00CA93B7

_wcschr.LIBVCRUNTIME ref: 00DE70E2
GetTickCount.KERNEL32 ref: 00DE728A

Strings

0123456789AaBbCcDdEeFf, xrefs: 00DE6F01, 00DE6F13, 00DE6F1D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$CountFindHeapProcessResourceTick
String ID: 0123456789AaBbCcDdEeFf
API String ID: 2181188311-3822820098
Opcode ID: 4362c34c81e9f406d2e96b958b7f20b452d74259619f243d78a44eb88b630791
Instruction ID: 79fc12deeb563a0d5080ffe6e3cca9826017ce07cb1306239f22ca7c63465e10
Opcode Fuzzy Hash: 4362c34c81e9f406d2e96b958b7f20b452d74259619f243d78a44eb88b630791
Instruction Fuzzy Hash: 7DD11030A00A458FDB20EF69C888BAAB7F5FF44314F18865DE4659B381D734ED45CBA0

Function 00CCF780 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 369windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CCF7CD

Strings

ControlEvent, xrefs: 00CCFA59
`Dialog_`=', xrefs: 00CCF900
' AND `Control_`=', xrefs: 00CCF947
,n, xrefs: 00CCFA85
AiTabPage, xrefs: 00CCF9E3, 00CCFAEA

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend
String ID: ' AND `Control_`='$,n$AiTabPage$ControlEvent$`Dialog_`='
API String ID: 3850602802-3383718950
Opcode ID: 2db52c6f471561aa1e47eea0bdc1d0642c87953ec6e6f4ab0bfa4e77308b5e2e
Instruction ID: fbaef54e80e174223f2b406670c9ff40a62287794b6885d73a08762d907395fb
Opcode Fuzzy Hash: 2db52c6f471561aa1e47eea0bdc1d0642c87953ec6e6f4ab0bfa4e77308b5e2e
Instruction Fuzzy Hash: C1F15971900249DFDF14DF68C999BEE7BF1BF08308F140269ED15AB292D775AA05CBA0

Function 00DA09E0 Relevance: 10.8, APIs: 7, Instructions: 300fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,28CB4BA0,?,00000000), ref: 00DA0A69
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000), ref: 00DA0AEC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DA0B39
GetFileSize.KERNEL32(00000000,00000000), ref: 00DA0B42
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00DA0BA5
CloseHandle.KERNEL32(00000000), ref: 00DA0CF7
ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00DA0D7F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointerSize
String ID:
API String ID: 4181610692-0
Opcode ID: 62c5b6c0e71df1042fa76cb11bdc3402ae4166e8dd5a6238e658cc0805b8221b
Instruction ID: 70f8b201fa4b2aa9ba47abab7abab0bcf3bf4987fceded74caa30987022b7a71
Opcode Fuzzy Hash: 62c5b6c0e71df1042fa76cb11bdc3402ae4166e8dd5a6238e658cc0805b8221b
Instruction Fuzzy Hash: 4BC17D71E01308DFDB24CFA8C945BAEBBB5FF46314F248259E415BB281D770AA45CBA0

Function 00CB4E50 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F46008,28CB4BA0,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00E604E5), ref: 00CB4EBA
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00E604E5), ref: 00CB4F3A
EnterCriticalSection.KERNEL32(00F46024,?,?,?,?,?,?,?,?,?,?,?,00000000,00E604E5,000000FF), ref: 00CB50F3
LeaveCriticalSection.KERNEL32(00F46024,?,?,?,?,?,?,?,?,?,?,00000000,00E604E5,000000FF), ref: 00CB5114

Strings

4w, xrefs: 00CB510D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: 4w
API String ID: 1807155316-3778465916
Opcode ID: e8e2e0ac08b4fb40314f42f1979c3e239eac38750da875d8298bed4b8cd49033
Instruction ID: 5bc3595ac93b8f07844a47b38a000edb8e85024340cd7051246a8bca53b3aadd
Opcode Fuzzy Hash: e8e2e0ac08b4fb40314f42f1979c3e239eac38750da875d8298bed4b8cd49033
Instruction Fuzzy Hash: 88B1C170A04649DFDB11DFA8D888BEEBBB4BF19314F144198E815EB391C775AE44CBA0

Function 00CD4CC3 Relevance: 10.7, APIs: 7, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00CD4D55
SysFreeString.OLEAUT32(00000000), ref: 00CD4DCA
GetProcessHeap.KERNEL32(?,?), ref: 00CD4E30
HeapFree.KERNEL32(00000000,?,?), ref: 00CD4E36
GetProcessHeap.KERNEL32(?,00000000,?,00000000), ref: 00CD4E66
HeapFree.KERNEL32(00000000,?,00000000,?,00000000), ref: 00CD4E6C
SysFreeString.OLEAUT32(00000000), ref: 00CD4E84

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: c14391def34d30c0b168fa8ca342d20c76c682d681f1f84f8917b2a93bac1295
Instruction ID: a2609fa89aa62cbc9dc511cd40fc4119ff58a520fe5c3ca67dde7be216101941
Opcode Fuzzy Hash: c14391def34d30c0b168fa8ca342d20c76c682d681f1f84f8917b2a93bac1295
Instruction Fuzzy Hash: 3E61B370D00259DFDF14DFA8C889BAFBBB4BF01310F14415AEA61A7392C7789A05CBA1

Function 00D3FCF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D3FD8B
GetWindowRect.USER32(?,?), ref: 00D3FDA3
GetWindowRect.USER32(?,?), ref: 00D3FE10
GetWindowLongW.USER32(?,000000EC), ref: 00D3FE34

Strings

L/, xrefs: 00D3FD73
$/, xrefs: 00D3FE25

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Rect$Long
String ID: $/$L/
API String ID: 3486571012-3308459630
Opcode ID: d51b0be7afb4ae31e0f0241d58e08e6db87145830eb14b6d51bca19bc74f86e8
Instruction ID: bf131a5faf557c7e2d6d3bcc226e24c2289397208460add1912de6eed996f719
Opcode Fuzzy Hash: d51b0be7afb4ae31e0f0241d58e08e6db87145830eb14b6d51bca19bc74f86e8
Instruction Fuzzy Hash: F5417E35A083099FC700CF15D884B6BB7E8FF9A714F05462EF945A7261DB30E945CB62

Function 00DCE2C0 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,28CB4BA0,?,?), ref: 00DCE307
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,28CB4BA0,00EA344D), ref: 00DCE37F
GetLastError.KERNEL32 ref: 00DCE390
WaitForSingleObject.KERNEL32(00EA344D,000000FF), ref: 00DCE3AC
GetExitCodeProcess.KERNEL32(00EA344D,00000000), ref: 00DCE3BD
CloseHandle.KERNEL32(00EA344D), ref: 00DCE3C7
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 00DCE3E2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: a872232e8b22fb00b55db9ebc7f9485dd82142b84118bf331fedd1609beb104c
Instruction ID: d3c6c9622ec0f1a7f5af038dfea01034ddcec9da647594eadc5fa0a47966f20a
Opcode Fuzzy Hash: a872232e8b22fb00b55db9ebc7f9485dd82142b84118bf331fedd1609beb104c
Instruction Fuzzy Hash: 19417B71E0438AABDB10CFA5CD04BAEBBF8AF49311F145659E824A7290DB749A44CB60

Function 00CADB60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CADBC2
VariantClear.OLEAUT32(?), ref: 00CADC1B
VariantClear.OLEAUT32(?), ref: 00CADC25
VariantClear.OLEAUT32(?), ref: 00CADC2F
VariantClear.OLEAUT32(?), ref: 00CADC3C

Strings

e, xrefs: 00CADC09, 00CADC3E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Variant$Clear$Init
String ID: e
API String ID: 3740757921-2857170482
Opcode ID: 6f7a80a34d49aeede071c6762693744fd68ae6079aa6e47629b04393e7031d77
Instruction ID: dbf96f0396b30a61ddc173d4a3d15a602925d84195954309ab7c49a9b46033e0
Opcode Fuzzy Hash: 6f7a80a34d49aeede071c6762693744fd68ae6079aa6e47629b04393e7031d77
Instruction Fuzzy Hash: 3D313871D0424CEFDB05CFA8C944BDEBBF8EF49704F10859AE410A7290D7B5AA04CBA0

Function 00DE0E90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000010,?,00000000,00DC6881,00000000,28CB4BA0,?,00000010,00000000), ref: 00DE0EAB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00DE0EC1
FreeLibrary.KERNEL32(00000000), ref: 00DE0EFA
FreeLibrary.KERNEL32(00000000,?,00000010,?,00000000,00DC6881,00000000,28CB4BA0,?,00000010,00000000), ref: 00DE0F16

Strings

Shlwapi.dll, xrefs: 00DE0EAA
DllGetVersion, xrefs: 00DE0EBB

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: b84e9ad1ef8d9efc6f635e5adce7334275b23e5c43dd0fb40ac73c1f2918a51c
Instruction ID: 4fb93a2b0baf13e900524bcc40509f3d67aa30cc0f84d9a00bdbe135c0ec4ed2
Opcode Fuzzy Hash: b84e9ad1ef8d9efc6f635e5adce7334275b23e5c43dd0fb40ac73c1f2918a51c
Instruction Fuzzy Hash: 7121C2726043019BD314AF2AEC4166BBBE4FFD9711F80066EF989D3341EB71D849C6A2

Function 00E4FDD2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,00E4FEDF,00E4D0E1,0000000C,?,00000000,00000000,?,00E50109,00000021,FlsSetValue,00EBCF80,00EBCF88,?), ref: 00E4FE93

Strings

ext-ms-, xrefs: 00E4FE3D
api-ms-, xrefs: 00E4FE29

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 383114cae56eaaea4b115fcca4da5a6cd974e5fec618fff501d72d6c76d6c3ac
Instruction ID: dd977ec050dff2191072edde04c6f0dcf083beec1f3701e64a8ebbd1a2b81037
Opcode Fuzzy Hash: 383114cae56eaaea4b115fcca4da5a6cd974e5fec618fff501d72d6c76d6c3ac
Instruction Fuzzy Hash: 8721E735E01214ABD721AB61BC40A9B37999B41FB5F252230EA06B72A2DB30ED04C6E0

Function 00D0E970 Relevance: 9.4, APIs: 4, Strings: 2, Instructions: 419memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00D0EB86
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 00D0EB8C

Part of subcall function 00D10530: GetProcessHeap.KERNEL32(?,?,28CB4BA0,00000000,?,00000000), ref: 00D105EA
Part of subcall function 00D10530: HeapFree.KERNEL32(00000000,?,?,28CB4BA0,00000000,?,00000000), ref: 00D105F0

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D0ED97
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D0ED9D

Strings

|3, xrefs: 00D0ECEC
|3, xrefs: 00D0EAE1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3$|3
API String ID: 3859560861-2167544776
Opcode ID: c3b107803761cbb4fd72a20b5d44828047c01e6173d7c8142f881f24e34143ba
Instruction ID: 79678b19b9462fb43499a07c03a6db7d5e095ee1393399c4ea56e9b17b80015a
Opcode Fuzzy Hash: c3b107803761cbb4fd72a20b5d44828047c01e6173d7c8142f881f24e34143ba
Instruction Fuzzy Hash: 78F1AA70900249DFDB04DFA8C949BEEBBB4FF05314F24469DE415AB2D2DB75AA04CBA1

Function 00D06CB0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00D06ED0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00D06ED6
GetProcessHeap.KERNEL32(-000000FF,00000000), ref: 00D06F01
HeapFree.KERNEL32(00000000,-000000FF,00000000), ref: 00D06F07

Strings

|3, xrefs: 00D06E2B
_TEMP, xrefs: 00D06DF7, 00D06E2A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: _TEMP$|3
API String ID: 3859560861-63189381
Opcode ID: ef44893f3c9435c30633d4cf2731e214a5edc8e2edfac593c7744ba6ab30fcfb
Instruction ID: 33000004bf6c4e143fed4ebe277abf483eb370a77ed9656c319ad1c5f7d1e314
Opcode Fuzzy Hash: ef44893f3c9435c30633d4cf2731e214a5edc8e2edfac593c7744ba6ab30fcfb
Instruction Fuzzy Hash: 08919CB1E012499FDB14DFA8C984BEEBBF4EF44324F244269E505B72D1CB749A05CBA1

Function 00D96080 Relevance: 9.1, APIs: 6, Instructions: 149COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D960CA
std::_Lockit::_Lockit.LIBCPMT ref: 00D960EC
std::_Lockit::~_Lockit.LIBCPMT ref: 00D96114
__Getctype.LIBCPMT ref: 00D961E5
std::_Facet_Register.LIBCPMT ref: 00D96247
std::_Lockit::~_Lockit.LIBCPMT ref: 00D96271

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 20cf884cc2c8b72b7984ad0ac9b4024d56122276236a505b57998dad0337a065
Instruction ID: 1f73873963b5f0b55330e6d39db20413826de8aeb0816061caedbede8a04125f
Opcode Fuzzy Hash: 20cf884cc2c8b72b7984ad0ac9b4024d56122276236a505b57998dad0337a065
Instruction Fuzzy Hash: 2B51BBB0900708CFDB10CF68C945BAABBF0EF15314F148299D845BB392EB71EA45DBA1

Function 00CB9980 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 330COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CB99D7
GetWindowRect.USER32(?,?), ref: 00CB9AB3

Strings

PV, xrefs: 00CB9D39
U2, xrefs: 00CB9C6D, 00CB9DB8
$/, xrefs: 00CB9B83

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: RectWindow
String ID: $/$PV$U2
API String ID: 861336768-4111043451
Opcode ID: 6dbf75c5488d3492fadefa9f53280431499bea84cc6dffc455bb2e9cf9e5a336
Instruction ID: 4a9fb476cc5e3f5244dec183e8fd33106308e813dd4669049cea21b0218dceba
Opcode Fuzzy Hash: 6dbf75c5488d3492fadefa9f53280431499bea84cc6dffc455bb2e9cf9e5a336
Instruction Fuzzy Hash: 8DE13775D04718EFEB20CFA8C949B9EBBF8EF1A700F108259E919B7251D7706A80DB50

Function 00E37D52 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E37D49,00E37D15,?,?,00CD21FD,00DA0140,?,00000008), ref: 00E37D60
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E37D6E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E37D87
SetLastError.KERNEL32(00000000,00E37D49,00E37D15,?,?,00CD21FD,00DA0140,?,00000008), ref: 00E37DD9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ea3b28200a98d05d32fc5768a6a10e9e8d92743ebb18e4effcc30bb8d07719ab
Instruction ID: 334ed192d42ae8b21c79044c2457f4e42df7ec9c72882dc7a1c7368d81d6043f
Opcode Fuzzy Hash: ea3b28200a98d05d32fc5768a6a10e9e8d92743ebb18e4effcc30bb8d07719ab
Instruction Fuzzy Hash: 0601DEB220D2155EE63826747D8DB673EC5EF42378F242229F590711E0EF510C08EA41

Function 00CBFFD0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 292windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 00CC0118
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 00CC012D

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Part of subcall function 00D82040: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00CC0168,00000000,80004005), ref: 00D820AB
Part of subcall function 00D82040: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D820DB

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00CC025E
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 00CC035A

Strings

|3, xrefs: 00CC009A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$AllocHeapWindow
String ID: |3
API String ID: 2851540245-1823295303
Opcode ID: 72a1de1e0a35e0a9f04962532de3d075bfbc09ebb6c22f86fad825580e843019
Instruction ID: ad34f3aae3a33e0948c50f206c932133c8cfaa4b25ba318fddc79cf5325ed5e1
Opcode Fuzzy Hash: 72a1de1e0a35e0a9f04962532de3d075bfbc09ebb6c22f86fad825580e843019
Instruction Fuzzy Hash: D9B17E71A00209DFDB14DFA8C985FEEFBB5FF48314F144219E425AB291DB75A944CBA0

Function 00DB3CC0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(28CB4BA0,00000000,00000000), ref: 00DB3D1F
GetShortPathNameW.KERNEL32(?,?,?), ref: 00DB3D8D

Strings

x64, xrefs: 00DB3FAA
x86, xrefs: 00DB3F4A
neutral, xrefs: 00DB3EE6

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: NamePathShort
String ID: neutral$x64$x86
API String ID: 1295925010-1541741584
Opcode ID: e311cbbf2cfdb22e4cc32385b098c01e3082f3e1d468049a53be6b61f03a6f9a
Instruction ID: 92b6fb8dadbb60f8bcc2a973c834b6c1caf211892e65053df16061ce717f9739
Opcode Fuzzy Hash: e311cbbf2cfdb22e4cc32385b098c01e3082f3e1d468049a53be6b61f03a6f9a
Instruction Fuzzy Hash: B8B1B171A00209EFDB04DFA8C859BDEBFB4EF05324F14825DE415AB291DB75AA44CBE0

Function 00DA9710 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 00DA99E8

Strings

Details >>, xrefs: 00DA996E
Close, xrefs: 00DA9904
Send Error Report, xrefs: 00DA994A
Copy, xrefs: 00DA99CF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: a77f0121fe23e48fbdf552ea35fc86651d64c1cf5b60bc539876a8f236904cd1
Instruction ID: 84d806266942d546819efa29f3fd748de4cf90025bd1e40c613ac9cfbcf161a6
Opcode Fuzzy Hash: a77f0121fe23e48fbdf552ea35fc86651d64c1cf5b60bc539876a8f236904cd1
Instruction Fuzzy Hash: AC919F70A40305AFEB18DF64DC56FAAB7B5EF45704F004629F611BB2D0EBB0AA05CB61

Function 00CA8890 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00CA8975
__Init_thread_footer.LIBCMT ref: 00CA89EF

Strings

<a href=", xrefs: 00CA8937
<a>, xrefs: 00CA8BA1
</a>, xrefs: 00CA8AF9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 72d38e239fc7e6467226d17d504f3a12e7b73f1d0a17951964c2d224866baf07
Instruction ID: 43d139f613dab8ac569a8f59f62e51f7f1268a8f7ff50c807200a3a9c6fcae38
Opcode Fuzzy Hash: 72d38e239fc7e6467226d17d504f3a12e7b73f1d0a17951964c2d224866baf07
Instruction Fuzzy Hash: 5DA1B4B0A00705EFCB04DF68DC55BADB7B1FF86718F104219E821AB2D2DB74AA45DB61

Function 00CC5E20 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 220windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Part of subcall function 00D82040: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,00CC0168,00000000,80004005), ref: 00D820AB
Part of subcall function 00D82040: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D820DB

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 00CC5FDC
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 00CC5FF3
SendMessageW.USER32(?,00001061,00000000,?), ref: 00CC604F

Strings

QuickSelectionList, xrefs: 00CC5F15, 00CC5F27, 00CC5F31
|3, xrefs: 00CC6012

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$AllocHeapWindow
String ID: QuickSelectionList$|3
API String ID: 2851540245-1570561888
Opcode ID: 4b3240d18a45764a28f4d9941259e50492cf597d0151a67262cb113e5150b8dd
Instruction ID: 238b964ce1bd161be536ba51982a212704cb0e4cc772ccdca55242e687f0e172
Opcode Fuzzy Hash: 4b3240d18a45764a28f4d9941259e50492cf597d0151a67262cb113e5150b8dd
Instruction Fuzzy Hash: C981BC71A006099FCB14DF68C894FAEF7F4FF88328F14851DE965A7290DB71A944CBA0

Function 00DA2450 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

SHGetSpecialFolderLocation.SHELL32(00000000,00000011,?,?,28CB4BA0,00000000,?), ref: 00DA266C
SHGetMalloc.SHELL32(?), ref: 00DA2695

Strings

C:\FAKE_DIR\, xrefs: 00DA263A, 00DA2657
%s, %.2u %s %.4u %.2u:%.2u:%.2u GMT, xrefs: 00DA2566
C:\, xrefs: 00DA2621

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$FolderHeapLocationMallocProcessSpecial
String ID: %s, %.2u %s %.4u %.2u:%.2u:%.2u GMT$C:\$C:\FAKE_DIR\
API String ID: 3216538967-785558474
Opcode ID: caf45619ed929eabb7cc02ca2c87bc7c4fc76bafc9d703640ef4ebcf23ce8260
Instruction ID: 3f34335dc6427e1b4615944fb26e85bf20ffea3370617218e35e87620711f226
Opcode Fuzzy Hash: caf45619ed929eabb7cc02ca2c87bc7c4fc76bafc9d703640ef4ebcf23ce8260
Instruction Fuzzy Hash: CC716DB1900208ABDB10DF99CC46BAEBBF9FB48B04F00451AF914BB382D7B49904DB94

Function 00CCDC60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 00CCDD5D
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00CCDD72
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00CCDD7A

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Part of subcall function 00CCF780: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00CCF7CD

Strings

TabHost, xrefs: 00CCDCE9, 00CCDCFB, 00CCDD05
SysTabControl32, xrefs: 00CCDD55

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$AllocCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 4294867080-2872506973
Opcode ID: 16085e7e12f50499fe545c54a3e380967bf0942629b085d678d8215c7fa26052
Instruction ID: 345d635ce5cc4fe4cf30e99f33235d04317280245dd142f959af1b22aef5da96
Opcode Fuzzy Hash: 16085e7e12f50499fe545c54a3e380967bf0942629b085d678d8215c7fa26052
Instruction Fuzzy Hash: 03518F35A006059FDB14DF68C885FAAFBF5FF89710F14426DE915A7391DB71A900CBA0

Function 00CB6E60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 159registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,28CB4BA0), ref: 00CB6EF3
GetLastError.KERNEL32 ref: 00CB6F1C
RegCloseKey.ADVAPI32(?,00000000,00000000,?,00EC337C,00000000,00000000,80000001,00000000,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 00CB7065

Strings

Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 00CB6EE8
AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00CB6F5C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CloseCreateErrorEventLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1713683948-2079760225
Opcode ID: 4b114523da24dd72cac3d78baead539f09b374e3656e4c48db6a63253abe5d2f
Instruction ID: efa363d51f56d55c8c4fcceb60b2f5bab4ae468c85b60ae5cf316fc5ee5a0696
Opcode Fuzzy Hash: 4b114523da24dd72cac3d78baead539f09b374e3656e4c48db6a63253abe5d2f
Instruction Fuzzy Hash: 8A618D70D05349EEDB11DF68C945BDEFBF4BF15304F108299E459A7282DBB46A08CBA1

Function 00DC6820 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

AppDataFolder, xrefs: 00DC69C8, 00DC6A05
ProgramFilesFolder, xrefs: 00DC68E7
PROGRAMFILES, xrefs: 00DC6A3D
APPDATA, xrefs: 00DC6A57, 00DC6A5F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID:
String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFilesFolder
API String ID: 0-3551742416
Opcode ID: 765ef9512730eeb784064b704672412cb87fb5cc15ef047d9fb73c77686f2d52
Instruction ID: bde422eba04de9fbb69e3b3da71181f20f11cfd2045d51195766c209fae85781
Opcode Fuzzy Hash: 765ef9512730eeb784064b704672412cb87fb5cc15ef047d9fb73c77686f2d52
Instruction Fuzzy Hash: C921D132A0021AABCB149F68CC45FAAB3F8EB45724F5446AEE915E7390EB31DD45C750

Function 00E3A78C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,00E3A84D,?,?,00000000,?,?,00E3A8FF,00000002,FlsGetValue,00EBA0D0,00EBA0D8), ref: 00E3A81C

Strings

api-ms-, xrefs: 00E3A7DC

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: b47e4b2656b5db4a63a6749f218f14215760af157c7fe421bf2390720c94b337
Instruction ID: 9d74149ce498822e8e041659b468e617574b57c5e5935d18d1687058ef39b791
Opcode Fuzzy Hash: b47e4b2656b5db4a63a6749f218f14215760af157c7fe421bf2390720c94b337
Instruction Fuzzy Hash: F211A732A40625ABDF329B689C8CB5A3BA89F01774F191271E950B7280DB70ED45C6D2

Function 00E4C68F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,28CB4BA0,?,?,00000000,00EB6426,000000FF,?,00E4C662,?,?,00E4C636,?), ref: 00E4C6C4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E4C6D6
FreeLibrary.KERNEL32(00000000,?,00000000,00EB6426,000000FF,?,00E4C662,?,?,00E4C636,?), ref: 00E4C6F8

Strings

mscoree.dll, xrefs: 00E4C6BD
CorExitProcess, xrefs: 00E4C6CE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: b4f202d518fa43caa9cf21eecd9ed3a67828d3275a534281f1dcaa821c6b1631
Instruction ID: 5888d42bc55f3cec6736a80995ca3188a42e3936d91d7fd5414ec6a12ebac50f
Opcode Fuzzy Hash: b4f202d518fa43caa9cf21eecd9ed3a67828d3275a534281f1dcaa821c6b1631
Instruction Fuzzy Hash: 9401AD31904619EFDB119F55DD05BAFBBB8FB04B15F11962AF821B23E0DFB49904CA90

Function 00DA79C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 00DA7A1E
GetProcAddress.KERNEL32(00000000), ref: 00DA7A25
__Init_thread_footer.LIBCMT ref: 00DA7A3C

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

Strings

SymFromAddr, xrefs: 00DA7A14
Dbghelp.dll, xrefs: 00DA7A19

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: 7cc852d09900d020ff288dbd1e81fe8f75a5a0066365f9190337915e51130ee2
Instruction ID: 5c3953d35ffdfc60639390f578a709600cf7b6b3f71d1efdefcb987a2b187efb
Opcode Fuzzy Hash: 7cc852d09900d020ff288dbd1e81fe8f75a5a0066365f9190337915e51130ee2
Instruction Fuzzy Hash: 5401B1B5A49704EFC710CF58ED46B197BA4E70AB30F104266E816E33D0C775A500DA12

Function 00E366EA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00E36687,00000064), ref: 00E3670D
LeaveCriticalSection.KERNEL32(00F44CD8,?,?,00E36687,00000064,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E36717
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00E36687,00000064,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E36728
EnterCriticalSection.KERNEL32(00F44CD8,?,00E36687,00000064,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3672F

Strings

4w, xrefs: 00E36717

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: 4w
API String ID: 3269011525-3778465916
Opcode ID: 6f60810e40783afcb3b340f68df65ab64978eda2c330b0e95c9667ae29d11a3a
Instruction ID: 6c42184ab805155f253979cc769ef5b83fd7b3ac34a7b813de4d79380f8e3c62
Opcode Fuzzy Hash: 6f60810e40783afcb3b340f68df65ab64978eda2c330b0e95c9667ae29d11a3a
Instruction Fuzzy Hash: 47E09235642524BBCA012B92EE89BDE3F2CEB05B51B090012FF0576270CE606824EBE5

Function 00D0DE10 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 316memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 00D0E08B
HeapFree.KERNEL32(00000000,?,?), ref: 00D0E091
GetProcessHeap.KERNEL32(?,?), ref: 00D0E160
HeapFree.KERNEL32(00000000,?,?), ref: 00D0E166

Strings

|3, xrefs: 00D0DFBF

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3
API String ID: 3859560861-1823295303
Opcode ID: dcc8b375ddbd733c2bd793cdb828f5fa481de1a0f3ff4d0773f5cdfc4bb207bd
Instruction ID: ebd7116ad3d488c030f43e5e4ed58111decbd8d43ac056b0003f4f3778ebeceb
Opcode Fuzzy Hash: dcc8b375ddbd733c2bd793cdb828f5fa481de1a0f3ff4d0773f5cdfc4bb207bd
Instruction Fuzzy Hash: 39D18B30900348CFDB14DFA8C994BEEBBB5BF54304F244569E509AB292DB70AA45CBA1

Function 00CE1B70 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 268memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?), ref: 00CE1E5F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00CE1E65
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?), ref: 00CE1F0F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 00CE1F15

Strings

|3, xrefs: 00CE1DF1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3
API String ID: 3859560861-1823295303
Opcode ID: be0e083d68487fbffaf0bfa7b84c428c73d5eb4f16e844692d48fafc309f22c7
Instruction ID: e13769455f9782a4aa2b41efcbbb293f6148e81962a25239306498c91461bc1b
Opcode Fuzzy Hash: be0e083d68487fbffaf0bfa7b84c428c73d5eb4f16e844692d48fafc309f22c7
Instruction Fuzzy Hash: 8DB17970D00298DEDB20DB69CC49BAEBBB5FF01314F1442DAE919A7292DB745B84CF91

Function 00CC03C0 Relevance: 7.7, APIs: 5, Instructions: 234windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CC25D0: __Init_thread_footer.LIBCMT ref: 00CC263F

SendMessageW.USER32(?,0000104D,00000000,00000000), ref: 00CC0502
SendMessageW.USER32(?,0000104D,00000000,?), ref: 00CC05B7
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00CC0656
SendMessageW.USER32(?,0000104C,00000000,?), ref: 00CC0701

Part of subcall function 00CB2970: RaiseException.KERNEL32(?,?,00000000,00000000,00E35A3C,C000008C,00000001,?,00E35A6D,00000000,?,00CA91C7,00000000,28CB4BA0,00000001,?), ref: 00CB297C

SendMessageW.USER32(?,0000104C,00000000,?), ref: 00CC0787

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$ExceptionInit_thread_footerRaise
String ID:
API String ID: 3442259968-0
Opcode ID: b0b5c931b29f9e2023a9b1652618a7d74a1c7aaf1bf25724a472f937b8c06329
Instruction ID: 325b6cebb97207a7ba382394be0191e09b9b13858489aecd51721a2da6e10346
Opcode Fuzzy Hash: b0b5c931b29f9e2023a9b1652618a7d74a1c7aaf1bf25724a472f937b8c06329
Instruction Fuzzy Hash: 72B12AB1D0135DDBEB24CF54CD54BDABBB1BF59308F10829AE9186B280D7B56A84CF90

Function 00CE07E0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?), ref: 00CE0A0F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 00CE0A15
GetProcessHeap.KERNEL32(?,?,?,?,?,?), ref: 00CE0ABF
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 00CE0AC5

Strings

|3, xrefs: 00CE09A1

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3
API String ID: 3859560861-1823295303
Opcode ID: 10941b7ad49ef4bfb15fc3b6d1cb1c79269a169cf06e0651acf6509d7138a606
Instruction ID: a7cee98008a620342e42e47a7634ae964bda1d325d9f8c757760eebb4ddc6aa3
Opcode Fuzzy Hash: 10941b7ad49ef4bfb15fc3b6d1cb1c79269a169cf06e0651acf6509d7138a606
Instruction Fuzzy Hash: 11916A70D013A8CEEB24DB25CC45B9ABBB5AF01314F1442E9D519A7282DBB45BC8DF92

Function 00CAFCE0 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00CAFD30
GetDlgItem.USER32(?,?), ref: 00CAFD55
SendMessageW.USER32(?,?,?,?), ref: 00CAFE1F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: ea1f83cdc081f7291f50e7f592f6c826127e9da0fed99dbc618966bc28545a41
Instruction ID: 773349b65800a3983a5c1ce025ff37c12e48be140c7d18bdd1a97c038b4b22cd
Opcode Fuzzy Hash: ea1f83cdc081f7291f50e7f592f6c826127e9da0fed99dbc618966bc28545a41
Instruction Fuzzy Hash: 0141C3362001069FC725CFA8E898B66B7A9FB47315F04443EE599C7162D732ED12EB20

Function 00D9BCD0 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D9BD04
std::_Lockit::_Lockit.LIBCPMT ref: 00D9BD24
std::_Lockit::~_Lockit.LIBCPMT ref: 00D9BD4C
std::_Facet_Register.LIBCPMT ref: 00D9BE2B
std::_Lockit::~_Lockit.LIBCPMT ref: 00D9BE55

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: ce0dc1d4ac1df2f38416866e1a3e50a1197f9629289d6c8f3b565b13c2d8b8c3
Instruction ID: c1e4e79008c2cac27d558fdbb7ace8ec67459c9b01f41c3a4e9a9b5478a46112
Opcode Fuzzy Hash: ce0dc1d4ac1df2f38416866e1a3e50a1197f9629289d6c8f3b565b13c2d8b8c3
Instruction Fuzzy Hash: DC519EB0900208DFDF11CF58D9457AEBBF4EF11324F25815EE846AB391D771AA05DBA1

Function 00CF7A70 Relevance: 7.6, APIs: 5, Instructions: 100threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CF7A99
CoInitializeEx.COMBASE(00000000,00000002), ref: 00CF7AA9
SendMessageW.USER32(?,000005FA,?,00000000), ref: 00CF7BC1

Part of subcall function 00D06040: EnterCriticalSection.KERNEL32(28CB4BA0,28CB4BA0), ref: 00D06080
Part of subcall function 00D06040: GetCurrentThreadId.KERNEL32 ref: 00D06093
Part of subcall function 00D06040: LeaveCriticalSection.KERNEL32(?), ref: 00D06111

Part of subcall function 00D00100: SetLastError.KERNEL32(0000000E,?,00CF880B,?,?,?,?), ref: 00D00118

GetLastError.KERNEL32(?,?,00ECC530,00000000), ref: 00CF7B33
ShowWindow.USER32(?,0000000A,?,?,00ECC530,00000000), ref: 00CF7B45

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalCurrentErrorLastSectionThread$EnterInitializeLeaveMessageSendShowWindow
String ID:
API String ID: 2782539745-0
Opcode ID: 1d6384269733f3d6e047876e74ea853e52213ed42a2bc082faa779b770eff523
Instruction ID: ecab430b6821681a18360d6c88961a209eb4191443ae2806e1a245b73ad4bf27
Opcode Fuzzy Hash: 1d6384269733f3d6e047876e74ea853e52213ed42a2bc082faa779b770eff523
Instruction Fuzzy Hash: C631EE70D00308EBDB10EFA0CC4ABEEBBB4EF10304F104259E615672D0DBB95A09DBA2

Function 00CD46E0 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00CD472A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00CD4730
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 00CD4753
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00E66756,000000FF), ref: 00CD477B
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00E66756,000000FF), ref: 00CD4781

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: cd39abfccc790d0f515afd2343ea4d4e231fb87b90396deb624834b9bd1ebc13
Instruction ID: 96a0b7673777b7b580f69f11bc358ca6b888fe2237f53509b9ff3510823d3d48
Opcode Fuzzy Hash: cd39abfccc790d0f515afd2343ea4d4e231fb87b90396deb624834b9bd1ebc13
Instruction Fuzzy Hash: 501133B1A44319ABEB10DF94CC46BAFBBF8EB04B04F104519F610BB6C1D7B5A604C791

Function 00CC0DC0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00CC0DCB
SendMessageW.USER32(?,?,?,0000102B), ref: 00CC0E28
SendMessageW.USER32(?,?,?,0000102B), ref: 00CC0E77
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 00CC0E88
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 00CC0E95

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 39030bcef1889634d413ab299951eba41faccfaef1470e1b4471844fac3b57e0
Instruction ID: 38024f5ae70edb0e9cbc8c746009207f730049318721d1a7c853c4d23411868b
Opcode Fuzzy Hash: 39030bcef1889634d413ab299951eba41faccfaef1470e1b4471844fac3b57e0
Instruction Fuzzy Hash: 42215131958746A7D220DF11CD44B1ABBF1BFEE758F202B0EF5D4211A4E7F191848E86

Function 00DBA780 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

Part of subcall function 00DBA570: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000010), ref: 00DBA59D

_wcschr.LIBVCRUNTIME ref: 00DBAAE2
_wcschr.LIBVCRUNTIME ref: 00DBAB6F

Strings

l, xrefs: 00DBABEE
h, xrefs: 00DBABF5

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer_wcschr$FileHeapModuleNameProcess
String ID: h$l
API String ID: 973101865-3303259029
Opcode ID: f14b17234ee775885806033d969855557a24bcd555c8043efe527f309eabd7e7
Instruction ID: 2b343b863ae0ff40f8fb931830373e177f3c757bb2048773baab51266b61782a
Opcode Fuzzy Hash: f14b17234ee775885806033d969855557a24bcd555c8043efe527f309eabd7e7
Instruction Fuzzy Hash: 58F1A171A00609DFDB10DFA8C859BDEFBF5EF44324F14826DE415AB291EB709905CBA1

Function 00DD3F70 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 417COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 00DD3FC9
_wcschr.LIBVCRUNTIME ref: 00DD40A9

Strings

realm, xrefs: 00DD438D, 00DD439F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: _wcschr
String ID: realm
API String ID: 2691759472-4204190682
Opcode ID: cc4a5ea2590e3691bb884e8dc3200042e37a9a979cc2ee0bef5c700d938eb793
Instruction ID: 93ff11030dcf243216eb2806aa811c2209b39b3983fb769070150e32e66b56f8
Opcode Fuzzy Hash: cc4a5ea2590e3691bb884e8dc3200042e37a9a979cc2ee0bef5c700d938eb793
Instruction Fuzzy Hash: 0FF1AF31A00649DFDB00DFACC848B9EBBB9EF55324F18825AE8149B391DB74DD44CBA0

Function 00CAD8D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 00CAD946
SendMessageW.USER32(?,00000000,00000000), ref: 00CADA42

Part of subcall function 00CAF190: SysFreeString.OLEAUT32(00000000), ref: 00CAF233

Strings

AtlAxWin140, xrefs: 00CAD93E
>, xrefs: 00CAD971

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140$>
API String ID: 4045344427-1858757345
Opcode ID: 1c2e8aa3cefece30195d36f6ff4ae12d4aed32e457e20075a6b5fd5ba08ecfbc
Instruction ID: 3afaab0d35df972cb51f1080fa09b425de06d4d5fb9eb120000d9d3bd3d82bcd
Opcode Fuzzy Hash: 1c2e8aa3cefece30195d36f6ff4ae12d4aed32e457e20075a6b5fd5ba08ecfbc
Instruction Fuzzy Hash: CD91F574600205EFDB14CF64C888B5ABBB9FF49714F148599F82A9B291CB71EE05DB50

Function 00CF99D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA0F40: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00DA0F84
Part of subcall function 00DA0F40: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00DA0F8F

GetCurrentThreadId.KERNEL32 ref: 00CF9B3C
SendMessageW.USER32(?,00000127,00030003,00000000), ref: 00CF9BC5

Strings

AI_HIDE_CAPTION_ICON_AND_TEXT_ALL, xrefs: 00CF9A69
AI_HIDE_CAPTION_ICON_AND_TEXT, xrefs: 00CF9AE0

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$CurrentThread
String ID: AI_HIDE_CAPTION_ICON_AND_TEXT$AI_HIDE_CAPTION_ICON_AND_TEXT_ALL
API String ID: 2377075789-1831360935
Opcode ID: 4fc8068d14b6b82b46320ab06417aa204238788c0582a5acdf331164c718c775
Instruction ID: cbad32b65222881af5227d5b878fbab89beedf8c893e0dc13a78ba6c3f346c72
Opcode Fuzzy Hash: 4fc8068d14b6b82b46320ab06417aa204238788c0582a5acdf331164c718c775
Instruction Fuzzy Hash: 7D81A230A00248DFDF15EF64C985BADBBB5FF45304F1441A8E909AB296DB70AE04DBA1

Function 00D007C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000004,?), ref: 00D0083C
MonitorFromWindow.USER32(?,00000002), ref: 00D00860
GetMonitorInfoW.USER32(00000000,?), ref: 00D00882

Strings

U2, xrefs: 00D00998, 00D009A8

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MonitorWindow$FromInfoRect
String ID: U2
API String ID: 1973172141-415264087
Opcode ID: 7273ee3ff1d8bf0865db9015bc79db66cc0772ba9acea30710cb4604553bc17d
Instruction ID: 7ef5bb9175992a74cafdb3440b29ce9edab8439abb078434a6b79de1886cc4a7
Opcode Fuzzy Hash: 7273ee3ff1d8bf0865db9015bc79db66cc0772ba9acea30710cb4604553bc17d
Instruction Fuzzy Hash: EE715A75E00208AFDB10DFA4DD49BAEBBF9EF59700F144219F905B72A0DB71AA00DB60

Function 00CFC4B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CFC4EE
SetWindowPos.USER32(?,00000000,?,?,?,00000008,00000604), ref: 00CFC6C1

Strings

AiDlgHeight, xrefs: 00CFC5E1
AiDlgWeight, xrefs: 00CFC50C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Rect
String ID: AiDlgHeight$AiDlgWeight
API String ID: 3200805268-871102398
Opcode ID: 00d06789eeb5bd241dc5b8a4cdfa344e5166ee91e3d48fe99b4b87913d3fbd9f
Instruction ID: 01ad40420016a7abde9d8666b00e8ce212d016740cc924ca5d7858ee472b5a6b
Opcode Fuzzy Hash: 00d06789eeb5bd241dc5b8a4cdfa344e5166ee91e3d48fe99b4b87913d3fbd9f
Instruction Fuzzy Hash: E6617F71E0020DEFCB04DFA8C985B9EBBB5FF48314F148269E911AB291D734AA05CF91

Function 00DDF940 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,28CB4BA0,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00DDF974

Part of subcall function 00DA5170: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,80004005,80004005,?,?,?,00000000,00E9A8AD,000000FF), ref: 00DA5188
Part of subcall function 00DA5170: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,80004005,80004005,?,?,?,00000000,00E9A8AD,000000FF), ref: 00DA51BB

Part of subcall function 00CB2970: RaiseException.KERNEL32(?,?,00000000,00000000,00E35A3C,C000008C,00000001,?,00E35A6D,00000000,?,00CA91C7,00000000,28CB4BA0,00000001,?), ref: 00CB297C

Part of subcall function 00CA9B10: HeapAlloc.KERNEL32(?,00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,?,00F39A1C,?,00DDBB18,80004005,28CB4BA0), ref: 00CA9B5A

Strings

.jar, xrefs: 00DDFDFC
.pack, xrefs: 00DDFCB1
*.*, xrefs: 00DDF9EA, 00DDF9FC, 00DDFA04

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ByteCharMultiWide$AllocExceptionHeapObjectRaiseSingleWait
String ID: *.*$.jar$.pack
API String ID: 1065105516-3892993289
Opcode ID: 6fed3a31bd5029dbb63573d2e4b9274d0806d821abd9af9a9dee49f29bce3bdc
Instruction ID: 63e9adcee2415cd34779620d453b87796bbdb1427cd7a743f2f473cace4c4daf
Opcode Fuzzy Hash: 6fed3a31bd5029dbb63573d2e4b9274d0806d821abd9af9a9dee49f29bce3bdc
Instruction Fuzzy Hash: B0517270A0060A9FDB10DFA9C854BAEF7B4FF45314F14826AE426EB391DB34D904CBA0

Function 00CED130 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00E36662: EnterCriticalSection.KERNEL32(00F44CD8,?,?,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E3666D
Part of subcall function 00E36662: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9EF6,00F45904,28CB4BA0,?,?,00E5DE0D,000000FF,?,00DDBABC,28CB4BA0), ref: 00E366AA

__Init_thread_footer.LIBCMT ref: 00CED28D

Part of subcall function 00E36618: EnterCriticalSection.KERNEL32(00F44CD8,?,?,00CA9F67,00F45904,00EB6640), ref: 00E36622
Part of subcall function 00E36618: LeaveCriticalSection.KERNEL32(00F44CD8,?,00CA9F67,00F45904,00EB6640), ref: 00E36655
Part of subcall function 00E36618: RtlWakeAllConditionVariable.NTDLL ref: 00E366CC

Strings

Windows.UI.Xaml.Controls.ListViewItem, xrefs: 00CED256
2, xrefs: 00CED29B, 00CED2FD, 00CED331, 00CED300
ItemData, xrefs: 00CED2F2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: 2$ItemData$Windows.UI.Xaml.Controls.ListViewItem
API String ID: 2296764815-168328404
Opcode ID: b33b23aa74b9fd5fe902739d1aa29b460588b6530ff60beb58fde09f2b365838
Instruction ID: 8d683dcaf1ea9a5bcb866e3a04816cb8efe61ef43e414d9f19c30e09a6660b42
Opcode Fuzzy Hash: b33b23aa74b9fd5fe902739d1aa29b460588b6530ff60beb58fde09f2b365838
Instruction Fuzzy Hash: F1718D70901289EFDB05CFA8C905BDEBBF0BB15304F148259E915A73D1D7B99B08DBA2

Function 00D05E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(014DF7E0,28CB4BA0,014DF7E0), ref: 00D05E41
GetCurrentThreadId.KERNEL32 ref: 00D05E51
LeaveCriticalSection.KERNEL32(?), ref: 00D05E77

Strings

4w, xrefs: 00D05E77

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: 4w
API String ID: 2351996187-3778465916
Opcode ID: 6b2c60509bd6a39f3b7bff3b63d2b2eb1de1c63184918e2059fd8d192a6f6e6c
Instruction ID: 16549a0cadfad4a059fe9e6c4cd6366d33e0d899f80caf756a97a87620f83bb0
Opcode Fuzzy Hash: 6b2c60509bd6a39f3b7bff3b63d2b2eb1de1c63184918e2059fd8d192a6f6e6c
Instruction Fuzzy Hash: 6141DF71900916AFDB10DF58D880BABFBA8FB44310F148329EC69D7284D731EE54CBA0

Function 00CB2990 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CB29C6
EnterCriticalSection.KERNEL32(00F46250), ref: 00CB29E6
LeaveCriticalSection.KERNEL32(00F46250), ref: 00CB2A0A

Strings

4w, xrefs: 00CB2A0A

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: 4w
API String ID: 2351996187-3778465916
Opcode ID: 2488c54f8593718f63f9097ba48fb6a2ed675f5b24fdd9c6e93d56c65ae85b43
Instruction ID: 6332eee557c1756aec27a5b650fbab04d409fa432671ba011bbdfd694653bdf1
Opcode Fuzzy Hash: 2488c54f8593718f63f9097ba48fb6a2ed675f5b24fdd9c6e93d56c65ae85b43
Instruction Fuzzy Hash: B521B171904748EFDB20CF58DD45B8ABBE8FB05B20F00461AEC65E7780D7B5A508DB91

Function 00D06040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(28CB4BA0,28CB4BA0), ref: 00D06080
GetCurrentThreadId.KERNEL32 ref: 00D06093
LeaveCriticalSection.KERNEL32(?), ref: 00D06111

Strings

4w, xrefs: 00D06111

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: 4w
API String ID: 2351996187-3778465916
Opcode ID: bbe91a5bb5593d4def19233500134557e66f13297126c742ef2786b9ea954320
Instruction ID: 6b11d0a336c4bef93361b95fbe64c225e00bcde0da0b0c24bc3ee249f8c6a2a5
Opcode Fuzzy Hash: bbe91a5bb5593d4def19233500134557e66f13297126c742ef2786b9ea954320
Instruction Fuzzy Hash: 8231BF71900344DFEB11CF69C94579EBBF4EF09314F148169E899A33A1E7759A04CBA1

Function 00CD4B50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 00CD4B92
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 00CD4B98

Strings

combase.dll, xrefs: 00CD4B8D
RoOriginateLanguageException, xrefs: 00CD4B88

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: 7cc0a389fc398e6b9339088e2829390d438f986e5d7a25cd16fe6de9ba179736
Instruction ID: 85fea3f961ebced986b97ceed5c2fa3a6a475c24469ac2a6c92d36c944ecb197
Opcode Fuzzy Hash: 7cc0a389fc398e6b9339088e2829390d438f986e5d7a25cd16fe6de9ba179736
Instruction Fuzzy Hash: 3C31AE70904249EFDB18DFA8CD46BAEB7F4EB04310F10852AEA29A73D0D7759B44DB91

Function 00DD2140 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,00DD029A,?,28CB4BA0,?,?,?,000000FF,?), ref: 00DD2154
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,00DD029A,?,28CB4BA0,?,?,?,000000FF,?,00DCFC64), ref: 00DD2171
GetLastError.KERNEL32(?,28CB4BA0,?,?,?,000000FF,?,00DCFC64,?,?,00000000,00000000,28CB4BA0,?,?), ref: 00DD21D0

Strings

AdvancedInstaller, xrefs: 00DD21B7

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: b5cdc2fdaebe67090704957e62baba25eeb84e0c4692359188392855b056a7d4
Instruction ID: 84afe9428c87fe70b028e5f1ba15614e500fae2fe707ed6773522dbc1bceeee2
Opcode Fuzzy Hash: b5cdc2fdaebe67090704957e62baba25eeb84e0c4692359188392855b056a7d4
Instruction Fuzzy Hash: 61117931340706BFE7209B22DD89F66BBA4FB54700F11842AF605AB690CB70B855CBA4

Function 00D81F50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D82470: __Init_thread_footer.LIBCMT ref: 00D82500
Part of subcall function 00D82470: GetProcAddress.KERNEL32(SetWindowTheme), ref: 00D8253D
Part of subcall function 00D82470: __Init_thread_footer.LIBCMT ref: 00D82554
Part of subcall function 00D82470: SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 00D8257F

CreateWindowExW.USER32(80000000,SysListView32,?,00000000,00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00D81FA2
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00D81FC0
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00D81FC8

Part of subcall function 00CB0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00CB0DE6

Strings

SysListView32, xrefs: 00D81F99

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend$Init_thread_footerWindow$AddressCreateLongProc
String ID: SysListView32
API String ID: 605634508-78025650
Opcode ID: 1a3acb28ed177041c1a76aba6d5f7194db5fcf735382a274772b810d9feea0fc
Instruction ID: 5e0511bf70a6bc49dc57eb15d7e9b31dc625be5f6fc972c7ed394ff5745d280f
Opcode Fuzzy Hash: 1a3acb28ed177041c1a76aba6d5f7194db5fcf735382a274772b810d9feea0fc
Instruction Fuzzy Hash: 46117975301214AFD624AB158C05F6BFBA9EFDA750F054619FA44AB2A1C6B1BC00DBA1

Function 00CB2700 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00F46250), ref: 00CB273C
GetCurrentThreadId.KERNEL32 ref: 00CB2750
LeaveCriticalSection.KERNEL32(00F46250), ref: 00CB278E

Strings

4w, xrefs: 00CB278E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: 4w
API String ID: 2351996187-3778465916
Opcode ID: 09d628529a9d92333e8bf1c82980548b548e285c9362122f03cfedd6733a33a8
Instruction ID: cc4755bc5ef3a2ae473aad7c5b9cc9bfb89eaaa2b755b7187724ae0c8576229a
Opcode Fuzzy Hash: 09d628529a9d92333e8bf1c82980548b548e285c9362122f03cfedd6733a33a8
Instruction Fuzzy Hash: 09110435904345DFDB20CF59C90479BBBE4EB56721F10465ADC21E7390DBB09A08C791

Function 00D829C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(46030080,RichEdit20W,?,00000000,46030080,80000000,00000000,00000000,00000000,00000000,00000000), ref: 00D82A0B
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00D82A23
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00D82A2B

Part of subcall function 00CB0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 00CB0DE6

Strings

RichEdit20W, xrefs: 00D82A02

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSendWindow$CreateLong
String ID: RichEdit20W
API String ID: 4015368215-4173859555
Opcode ID: 4a88c844975a833eb5e305fd41f83f88c8e0d7c7373911b222733f697fbbf7f9
Instruction ID: 6f0b518e22ef2694792c84f02c546a346aad28dbaa96d2a1cf88228d556850c4
Opcode Fuzzy Hash: 4a88c844975a833eb5e305fd41f83f88c8e0d7c7373911b222733f697fbbf7f9
Instruction Fuzzy Hash: 4A015735301214AFD6149B15CC05F5BFBA9FBCA760F15861AFA48A73A0C6B1AC00DAA1

Function 00D04830 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D04881
GetParent.USER32(?), ref: 00D0488A
SendMessageW.USER32(?,00000411,00000000,?), ref: 00D0489F

Strings

,, xrefs: 00D04879

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Parent$MessageSend
String ID: ,
API String ID: 2251359880-3772416878
Opcode ID: 8dbaf2f7e42f885188437983a502113ab284cedd254d3f358442fa65974ffd45
Instruction ID: 47717db47d04ce1b17edfee83f929520d500837aead6d6d7837eee17e2c593d0
Opcode Fuzzy Hash: 8dbaf2f7e42f885188437983a502113ab284cedd254d3f358442fa65974ffd45
Instruction Fuzzy Hash: 1E1180B1515344AFD710DF24D844B1AFBF4FF89310F04892AF658926A0D7B1E854CFA2

Function 00CAEFA0 Relevance: 6.3, APIs: 4, Instructions: 271memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 00CAF06A
SysFreeString.OLEAUT32(00000000), ref: 00CAF0B6
SysFreeString.OLEAUT32(00000000), ref: 00CAF0D8
SysFreeString.OLEAUT32(00000000), ref: 00CAF233

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: af5844f6dd280b2f4c8ac9817d5d9083cca7812afe0900769281f976a012271b
Instruction ID: cf6df9c8f4e1d8146f856547db4e8b0da540fa9f7cfef3c6792b3dbea9b4b893
Opcode Fuzzy Hash: af5844f6dd280b2f4c8ac9817d5d9083cca7812afe0900769281f976a012271b
Instruction Fuzzy Hash: 18A16075A0024ADFDB15DFA8CC48BAEB7B8FF45718F10422DE525E7280D774AA06CB61

Function 00CC8180 Relevance: 6.3, APIs: 4, Instructions: 266windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 00CC8258
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 00CC8287
SendMessageW.USER32(00000000,0000110A,00000004,0A74C085), ref: 00CC8443
SendMessageW.USER32(0000110A,0000110A,00000001,00000000), ref: 00CC8466

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c6fcbc88a6667b8bb6528c0cc184bd0e3aeb599d57b5ab3e5b3835620b4c9205
Instruction ID: fd1262982f51f3cb027d165456baf499be9ff020f496cc8e17c968c11d2c6b26
Opcode Fuzzy Hash: c6fcbc88a6667b8bb6528c0cc184bd0e3aeb599d57b5ab3e5b3835620b4c9205
Instruction Fuzzy Hash: C5A16C72A00204DFCF15DF68C894FAEBBB5BF49710F0951A9E811AB291DB30E949CB60

Function 00CC3E70 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CC3ECD
VariantClear.OLEAUT32(?), ref: 00CC3EFF
VariantClear.OLEAUT32(?), ref: 00CC4117
VariantClear.OLEAUT32(?), ref: 00CC4146

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 598140f62812961e292ca5e5b82c4fa0d62ff03880edb7096a0f3617e714d9a7
Instruction ID: c53c82e184a34dd7454e9af1815fe2518a857af02f40e0f13ce5bf7c37763e1d
Opcode Fuzzy Hash: 598140f62812961e292ca5e5b82c4fa0d62ff03880edb7096a0f3617e714d9a7
Instruction Fuzzy Hash: 88A16574D00249DFCB10CFA8C894BDEBBB5FF48314F258269E814A7291E778AA45CB91

Function 00CC2F00 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CC2F5A
VariantClear.OLEAUT32(?), ref: 00CC2F8C
VariantClear.OLEAUT32(?), ref: 00CC30F5
VariantClear.OLEAUT32(?), ref: 00CC3124

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 259515047a28636883863523c37e5b34ebe79277c78e7f842cd6f78606e8ebf8
Instruction ID: c74040f8990a85d0cc9c82a486445fdc943cefbfdf334dfe958e105f729b43dc
Opcode Fuzzy Hash: 259515047a28636883863523c37e5b34ebe79277c78e7f842cd6f78606e8ebf8
Instruction Fuzzy Hash: B681BB34A00348DFDB10DFA8C944B9EFBB4EF05704F24826DE815AB392E774AA45DB91

Function 00CB4650 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00CB46F0
SysFreeString.OLEAUT32(00000000), ref: 00CB4731

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 19df153116b99689a2dd08f15b5feb7dd3930e678f9d7d22ea43f49d4843ba51
Instruction ID: 55730be38a197a2f2f1268ccf1a57d0e0dd03dabcfc44bdfa27fc80c910fc79c
Opcode Fuzzy Hash: 19df153116b99689a2dd08f15b5feb7dd3930e678f9d7d22ea43f49d4843ba51
Instruction Fuzzy Hash: 4061AE72A04209EFDB14CF58D844B9ABBB8FB45720F10416AFC14A7391D776AD10DBA0

Function 00CBCCF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(28CB4BA0,28CB4BA0,?), ref: 00CBCD2F
EnterCriticalSection.KERNEL32(?,28CB4BA0,?), ref: 00CBCD3C
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 00CBCE13

Strings

4w, xrefs: 00CBCE13

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: 4w
API String ID: 3991485460-3778465916
Opcode ID: c009364bc0d95a34b8b6cfb1fd5fb9f047d3a4474a24154cb7ac9c7413bac7cf
Instruction ID: 7f01b97ccdcfd0bf4bb71253fe7c0b9d520437def2fcac2fc2ad880e8d4a4d7e
Opcode Fuzzy Hash: c009364bc0d95a34b8b6cfb1fd5fb9f047d3a4474a24154cb7ac9c7413bac7cf
Instruction Fuzzy Hash: CF4116392007458FDB22CF78C881BEABBB5EF55310F100529E8A6E7391CB31A916DB90

Function 00DBC6B0 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,?,00000000,00000000), ref: 00DBC70F
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 00DBC71C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00DBC739
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00DBC75B

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: cebbc74b8061adc2c306037ddded42e786c1b8288d9f49f9d2edd2115f0329b9
Instruction ID: b5cf9e7ff05971527eed979ba3ce2086d89e5f9d0412a2dfa31f195cba8c9a85
Opcode Fuzzy Hash: cebbc74b8061adc2c306037ddded42e786c1b8288d9f49f9d2edd2115f0329b9
Instruction Fuzzy Hash: 4B2133B2740306ABE6105F15EC82FAB775CFB80B04F240129FA02A62D0EBA17D058A74

Function 00CF642D Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000010,?,00000060), ref: 00CF6467
GetWindowRect.USER32(?,?), ref: 00CF64B6
GetWindowLongW.USER32(?,000000EC), ref: 00CF64DF
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,?,00000060), ref: 00CF6571

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$LongRect
String ID:
API String ID: 463821813-0
Opcode ID: 31ee4eaf9d3876676c7c43bb1aea5639cc0b7138cbfd214e91a5eccdcb52d867
Instruction ID: 07f4962d8992ebe9b55550027f0fb30a8ce3982c20b3db2835672d9afd5e753d
Opcode Fuzzy Hash: 31ee4eaf9d3876676c7c43bb1aea5639cc0b7138cbfd214e91a5eccdcb52d867
Instruction Fuzzy Hash: CE416A75108749AFD701DF29DC85A6AFBB4FF89300F044A1AFA91A3260D771A894DF52

Function 00DA5170 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,80004005,80004005,?,?,?,00000000,00E9A8AD,000000FF), ref: 00DA5188
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,80004005,80004005,?,?,?,00000000,00E9A8AD,000000FF), ref: 00DA51BB
GetStdHandle.KERNEL32(000000F5,?,28CB4BA0,00000000,00E5D840,000000FF,?,80070057,?,-00000001,?,?,80004005,80004005,?,?), ref: 00DA5226
SetConsoleTextAttribute.KERNEL32(00000000,?,28CB4BA0,00000000,00E5D840,000000FF,?,80070057,?,-00000001,?,?,80004005,80004005,?,?), ref: 00DA522D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ByteCharMultiWide$AttributeConsoleHandleText
String ID:
API String ID: 3849414675-0
Opcode ID: d9e7833209088981649500d2d4a48acc9bdce001fb06b57fa2b4bfe0e027fe5b
Instruction ID: 476bdb25e272f1efed815f967a48bd21b7afb38775d781ea887fca26c569e363
Opcode Fuzzy Hash: d9e7833209088981649500d2d4a48acc9bdce001fb06b57fa2b4bfe0e027fe5b
Instruction Fuzzy Hash: BD21D476705605AFD6109B59EC89F6AF76DEB85720F204329FA25E73D0CB305C01CBA0

Function 00CF98E0 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00CF996F
GetParent.USER32(00000000), ref: 00CF9977
GetParent.USER32(00000000), ref: 00CF997C
SendMessageW.USER32(00000000,0000037F,00000000,?), ref: 00CF998D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: a30c4360176dc56f0873de1df07ea2f1c0e5948aa5f9ef589b56b065efd38f61
Instruction ID: 9f7f8dc2a4b94708ce6c0898ff1d721891692e36d394ce89e1b11d8d19726571
Opcode Fuzzy Hash: a30c4360176dc56f0873de1df07ea2f1c0e5948aa5f9ef589b56b065efd38f61
Instruction Fuzzy Hash: F621F53220010D6BDF649B28EC84FBEF398EFA1354F054529FA15D21A0EB31EE91C666

Function 00CB89D0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000FC,00000000), ref: 00CB8A19
GetParent.USER32(?), ref: 00CB8A4D

Part of subcall function 00E35D0D: GetProcessHeap.KERNEL32(00000008,00000008,?,00CB0DC7,?,?,00CB0B74,?), ref: 00E35D12
Part of subcall function 00E35D0D: HeapAlloc.KERNEL32(00000000,?,?,00CB0B74,?), ref: 00E35D19

SetWindowLongW.USER32(?,000000EB), ref: 00CB8A80
ShowWindow.USER32(?,00000000), ref: 00CB8A96

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$HeapLong$AllocParentProcessShow
String ID:
API String ID: 78937335-0
Opcode ID: 3bfeb321eaec42ae8a375fdccfc8fea69799450349b6491c1ef37073e6d611dd
Instruction ID: a40b85d5a756b2e8a98feda62f0cb881d72c8ef065c11a42a02853e53302a914
Opcode Fuzzy Hash: 3bfeb321eaec42ae8a375fdccfc8fea69799450349b6491c1ef37073e6d611dd
Instruction Fuzzy Hash: 2421AE346047019FC720EF29D848A6BBBE8FF59710B014A2EF8A6D3661DB30E804DB61

Function 00CBCB20 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,28CB4BA0), ref: 00CBCB8A
EnterCriticalSection.KERNEL32(?,28CB4BA0), ref: 00CBCB97
LeaveCriticalSection.KERNEL32(?), ref: 00CBCBE8

Strings

4w, xrefs: 00CBCBE8

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: 4w
API String ID: 3991485460-3778465916
Opcode ID: e1062fb6eef2e6309d6eb635eefa64f441d87844918cd5dd1b8a8aac7983a34c
Instruction ID: 94e67159496efbcff630e43fef4f0e885fb232231e9fa0bf723b88cb414fb01b
Opcode Fuzzy Hash: e1062fb6eef2e6309d6eb635eefa64f441d87844918cd5dd1b8a8aac7983a34c
Instruction Fuzzy Hash: FA21E2369002459FDF11CF64D985BEABBB4FF16324F1005A9EC59BB382C7315A09CB60

Function 00CBCC10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,28CB4BA0), ref: 00CBCC7A
EnterCriticalSection.KERNEL32(?,28CB4BA0), ref: 00CBCC87
LeaveCriticalSection.KERNEL32(?), ref: 00CBCCCE

Strings

4w, xrefs: 00CBCCCE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: 4w
API String ID: 3991485460-3778465916
Opcode ID: 1d03410e661b68a0c1455ed0bb1fe04a47c4723f91c863f43b990401c114824d
Instruction ID: c3a050653375b183da20fac607f746da2b71d1a3c73de5b6358cc05f76e7b313
Opcode Fuzzy Hash: 1d03410e661b68a0c1455ed0bb1fe04a47c4723f91c863f43b990401c114824d
Instruction Fuzzy Hash: FC21F1769002449FDF11CF24C981BEABBB8FF15324F1006A9EC59AB382D7319909CBA0

Function 00CBCA60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,28CB4BA0,?), ref: 00CBCABD
EnterCriticalSection.KERNEL32(?,28CB4BA0,?), ref: 00CBCACA
LeaveCriticalSection.KERNEL32(?), ref: 00CBCAF2

Strings

4w, xrefs: 00CBCAF2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: 4w
API String ID: 3991485460-3778465916
Opcode ID: a7769f4275ffcf3230a04be1974c057c47970ed2b66a2b8d27d665fec2aec5cf
Instruction ID: 59aad2211a269953223535a13444bc57100d2d4e5e4a1e91db3e0c927cbc722c
Opcode Fuzzy Hash: a7769f4275ffcf3230a04be1974c057c47970ed2b66a2b8d27d665fec2aec5cf
Instruction Fuzzy Hash: 3721D6769042499FDF01DF64D980BEABB78EB56324F1006A9D865A7381C7325A09DBA0

Function 00D3F9D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 255windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 00D3FAD1
SendMessageW.USER32(00000000,00000317,?,00000014), ref: 00D3FB65

Strings

U2, xrefs: 00D3FC62, 00D3FC7F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: MessageRectSendWindow
String ID: U2
API String ID: 2814762282-415264087
Opcode ID: a3384e014fed6ea3d19dbac2af41cc5120c87ba0fbb908456ea55036e35a1ed3
Instruction ID: b4594cb507272866b8125d6657894c7644efc728a92e5b0e1348678c996c2e25
Opcode Fuzzy Hash: a3384e014fed6ea3d19dbac2af41cc5120c87ba0fbb908456ea55036e35a1ed3
Instruction Fuzzy Hash: E8B167B4E00609DFDB14CFA8C984B9DFBB5FF49310F188269E819AB351D770A955CBA0

Function 00DE0320 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

DeleteFileW.KERNEL32(?), ref: 00DE03FA
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 00DE052F

Part of subcall function 00DCF280: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,28CB4BA0,00000001,75B4EB20,00000000), ref: 00DCF2CF
Part of subcall function 00DCF280: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,28CB4BA0,00000001,75B4EB20,00000000), ref: 00DCF305

Part of subcall function 00DCC7E0: LoadStringW.USER32(000000A1,?,00000514,28CB4BA0), ref: 00DCC836

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 00DE03AE

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: File$DeleteInit_thread_footer$CreateHeapLoadProcessReadString
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 3544038457-3685554107
Opcode ID: 99e838f0c68af2d2eb4ffc3913c4501befafe8fba5c323aa1150153ab0c6f580
Instruction ID: ec58ec21b63cad1191cff990f3b67460e1bcc78abdf9cab96a89b1096112f68b
Opcode Fuzzy Hash: 99e838f0c68af2d2eb4ffc3913c4501befafe8fba5c323aa1150153ab0c6f580
Instruction Fuzzy Hash: 5791B271A006459FDB00EF6DC845B9EBBB5EF45314F188269E915DB292DB70D904CFA0

Function 00DD7150 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 00CA9E50: GetProcessHeap.KERNEL32 ref: 00CA9EA5
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9ED7
Part of subcall function 00CA9E50: __Init_thread_footer.LIBCMT ref: 00CA9F62

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00EA13BF,000000FF), ref: 00DD72D3
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00EA13BF,000000FF), ref: 00DD7361

Strings

<< Advanced Installer (x86) Log >>, xrefs: 00DD723F

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>
API String ID: 3699736680-396061572
Opcode ID: fe8686f08f2bd1105a8a70865956d42ed0c16fc4d3d03c731cd25b97b839c28a
Instruction ID: fa81557833b0e56940d2ecd64fc4cbea34dacb89bd30d01565539af1a411f60b
Opcode Fuzzy Hash: fe8686f08f2bd1105a8a70865956d42ed0c16fc4d3d03c731cd25b97b839c28a
Instruction Fuzzy Hash: 5161EC70905689CFDB00CF6CC949B5ABBF0EF46314F14829DE814DB392DB75AA08DBA1

Function 00D93C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,28CB4BA0,00000000,00000000), ref: 00D93D11

Strings

\\?\UNC\, xrefs: 00D93D3C, 00D93D9E
\\?\, xrefs: 00D93E0B, 00D93E37

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: d1bcc8ce2c95172c575a01849c7ff532c87de7cbc2fcd7da3fe7ea941ca1c468
Instruction ID: c1b5c8cc0d0227891af39b88b492b0279c9ecb534ad73680eb4d8eefc3e2d1e2
Opcode Fuzzy Hash: d1bcc8ce2c95172c575a01849c7ff532c87de7cbc2fcd7da3fe7ea941ca1c468
Instruction Fuzzy Hash: F451C170E00604DBDF14DF58D985BAEB7F5FF45704F20821DE8116B281EB75AA48CBA0

Function 00DD8550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,28CB4BA0,?,?,00F46054), ref: 00DD858F
CreateDirectoryW.KERNEL32(?,00000000,?,00F46054), ref: 00DD85F0

Strings

ADVINST_LOGS, xrefs: 00DD85C8

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: 458b2ba1e6fa5e06d8758ebe14022d2e4afe4ced98bd205158fe05eabf87772c
Instruction ID: 433f3c2ee99a0f3790b076f69bbdd0b1f7cf2b54c8ce3c0be361db701132b557
Opcode Fuzzy Hash: 458b2ba1e6fa5e06d8758ebe14022d2e4afe4ced98bd205158fe05eabf87772c
Instruction Fuzzy Hash: A251B275940219DACB319F28C844BB6B3F4FF14724F1846AEE85997390EF748D81DBA0

Function 00CB7110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,?,00000002,00EC337C,00000000,00000000,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033,28CB4BA0), ref: 00CB7280

Part of subcall function 00D8DDA0: GetModuleHandleW.KERNEL32(Advapi32.dll,28CB4BA0,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 00D8DDE3

CloseHandle.KERNEL32(?,28CB4BA0), ref: 00CB72B9

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 00CB7178

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CloseHandle$Module
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current
API String ID: 1412095732-2431777889
Opcode ID: 9fb78b483e6b4ad1020a75118bdc7e89434f9bdc25d6cdac19c807b41f0500b7
Instruction ID: fb41bacf9a6b8e2e7a4d791b7b1019ee63cb2d5c27ddf1575b98137c6d913b97
Opcode Fuzzy Hash: 9fb78b483e6b4ad1020a75118bdc7e89434f9bdc25d6cdac19c807b41f0500b7
Instruction Fuzzy Hash: 21515870D04249DEDF20DFA4C959BDEBBB4BF14308F108299E455B7281DBB46A48CFA1

Function 00CF8A90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 00CF8B02
DestroyWindow.USER32(?), ref: 00CF8B17

Strings

(0, xrefs: 00CF8B0E

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: DestroySleepWindow
String ID: (0
API String ID: 3305115879-3012264354
Opcode ID: 10c24aef9cb9405610e2ff1e49b85b0f46a6cefa948529608186d9b8a07633a6
Instruction ID: 6905e81a5ce0aab6dcb20b221545818275f4897f585be95dbe41e3b0cd79c029
Opcode Fuzzy Hash: 10c24aef9cb9405610e2ff1e49b85b0f46a6cefa948529608186d9b8a07633a6
Instruction Fuzzy Hash: DB416234A00348EFDB11DF68DC45B9DBBB5AF05700F1440A9E9197B2D2CB705E04DBA2

Function 00DA73D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,28CB4BA0,00ED9754), ref: 00DA7428
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 00DA7524

Part of subcall function 00D99AC0: std::locale::_Init.LIBCPMT ref: 00D99B9D

Part of subcall function 00D972B0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00D97385

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 00DA7446

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-3373098694
Opcode ID: df526e1cdd13355665120bbaf9992974fe6de052e443926a40ebab67c32bb87f
Instruction ID: 9e86d1853212ce8b0e29ad3c70e43600ebc20d41649e830e64fd64c925559963
Opcode Fuzzy Hash: df526e1cdd13355665120bbaf9992974fe6de052e443926a40ebab67c32bb87f
Instruction Fuzzy Hash: A541AE70A042099BDB10DF68CD09BAFBBF8EF05304F144569E415EB290D7B49A08CBA1

Function 00DF2050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000001,_pbl_evt,00000008,?,?,00EDA350,00000001,28CB4BA0,00000000), ref: 00DF20FE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 00DF211B

Strings

_pbl_evt, xrefs: 00DF20D2

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 566c75eec77c0471fb23175d7c838798d9b97296d24fa9def65f0d6c63e18044
Instruction ID: 2f2e35e2f3de5eed219189d4badbb7ea4eed9100744f6fd2325dc6690da8d3df
Opcode Fuzzy Hash: 566c75eec77c0471fb23175d7c838798d9b97296d24fa9def65f0d6c63e18044
Instruction Fuzzy Hash: 32313A71D00209EFDB10DFA8CD55BEEB7B8EF05714F108219E915B7280DBB46A09CBA1

Function 00CAD640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000002), ref: 00CAD6CB
IsWindow.USER32(00000002), ref: 00CAD6E2

Strings

H?, xrefs: 00CAD681

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window
String ID: H?
API String ID: 2353593579-1926948537
Opcode ID: b86ef97f5b36015b1678068ac15ac414d3b22e4c83b5f7f35d2c3de70a031963
Instruction ID: e6653ab81703d1b002f1753a10e7ce2b4cd328c2ef33e5ab6503c41b6c7dd8c6
Opcode Fuzzy Hash: b86ef97f5b36015b1678068ac15ac414d3b22e4c83b5f7f35d2c3de70a031963
Instruction Fuzzy Hash: 032157346007059FCB28DF64D855F6AB7B5EF49B14F048A2DE86B97AA0CB31A904DB90

Function 00D96870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00D9689B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00D968FE

Strings

bad locale name, xrefs: 00D96921

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 934347f903eacdb29a4d92590681510ea8a7910a76067592bd952facd56eb78a
Instruction ID: 92e661e28f085ba2ebe8cce3f8631cdf20f9d9705a41175242ab927a42f96053
Opcode Fuzzy Hash: 934347f903eacdb29a4d92590681510ea8a7910a76067592bd952facd56eb78a
Instruction Fuzzy Hash: 1C21F170604784EEDB20CF68C504B4ABFE4AF15310F14869DE08597781D7B6EA04CBA1

Function 00D480F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D4813A
DestroyWindow.USER32(00000000,?,?,?), ref: 00D48147

Strings

{, xrefs: 00D481BB

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Destroy
String ID: {
API String ID: 3707531092-2739055043
Opcode ID: 20b5ed30fb38ef27bba740b45afd72af885ee134d21732f33b62749ffd7c98da
Instruction ID: 6b87442504f89f05e27e9bf746736925d85f30e4effd2658c7ff88c21e1d2364
Opcode Fuzzy Hash: 20b5ed30fb38ef27bba740b45afd72af885ee134d21732f33b62749ffd7c98da
Instruction Fuzzy Hash: DC31BC70804689EFCB01DF68CA0579EFBF4FF11314F14429AE055A7B92CBB4AA08DB91

Function 00CC1200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetParent.USER32(00000005), ref: 00CC1274

Strings

C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00CC1249
d, xrefs: 00CC1240

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3357045315
Opcode ID: 1df3ad61682a431261c44ca8d1946d96f5670b360b12ce751383d5225f42d70a
Instruction ID: c1981024d0aab9d76ebd9411c4e1244c0841ed07f8ae33fa0d0ca1675c1fd834
Opcode Fuzzy Hash: 1df3ad61682a431261c44ca8d1946d96f5670b360b12ce751383d5225f42d70a
Instruction Fuzzy Hash: 3D210274D15298EEDF00DFE4D958B8DBBB0BF55308F148088E405AB296DBB96A09CB91

Function 00CAD329 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CAD39A

Strings

d, xrefs: 00CAD369
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00CAD375

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 45a492ef2659abdcce2369f43cd23f40f1f66eadbad6aa557ccccee78d261e26
Instruction ID: 0e8b70e8272420e96813dace1b6044475de1e024855db38eda7ab4f98901360a
Opcode Fuzzy Hash: 45a492ef2659abdcce2369f43cd23f40f1f66eadbad6aa557ccccee78d261e26
Instruction Fuzzy Hash: 42211374D15298DEDF01DFE4D958B8DBBB0BF55308F148188D001AB396DBB95A09CB91

Function 00CACF5D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CACFCB

Strings

C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00CACFA6
d, xrefs: 00CACF9D

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: e87d705daa2cf9ade21f9c58985183463b7cb5aaf2e23bff8ba185e43fea54be
Instruction ID: 68bb2555f300feaa99cc779def72da0f54a0513103ad3c47ba180f743e651215
Opcode Fuzzy Hash: e87d705daa2cf9ade21f9c58985183463b7cb5aaf2e23bff8ba185e43fea54be
Instruction Fuzzy Hash: 64211E74D15298EEDF01DFE4D958B9DBBB1BF55308F148088E002AB292DBB95A09CB91

Function 00CC12CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000D), ref: 00CC133B

Strings

C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00CC130E
d, xrefs: 00CC1305

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3357045315
Opcode ID: 451f5fe5110a306bef6c3c8d929d8014056256cbc2ef1d210f702ad7c897f45e
Instruction ID: b516f632d38913cbbea912a8f9b1b07d86b2775a4bea5230664cc19e3a898a13
Opcode Fuzzy Hash: 451f5fe5110a306bef6c3c8d929d8014056256cbc2ef1d210f702ad7c897f45e
Instruction Fuzzy Hash: 76211E74D10288EEDF00DFE4D998BDDBBB1BF55308F148098E001AB292DBB95A09DB91

Function 00CAD3F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CAD460

Strings

d, xrefs: 00CAD42D
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00CAD439

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 393b44330eefef5309a16a1bf0396c170b54fb59d675e75f6e6e59cca78df7eb
Instruction ID: 7bd618a8add5079a21316f9573be51e7c9323ddcedf9822ec89a3dd5bc5b0382
Opcode Fuzzy Hash: 393b44330eefef5309a16a1bf0396c170b54fb59d675e75f6e6e59cca78df7eb
Instruction Fuzzy Hash: CB213374D00288EADF05DFE4D958BCDBBB0BF55308F208198E001BB286DBB95A09DF51

Function 00CAD021 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CAD08C

Strings

d, xrefs: 00CAD05C
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00CAD065

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: dc46ab7870c14927805a484403303369d6f2c401fe66365dcd44d52683762070
Instruction ID: 7c6da6a24293ce664d4f8b24eab1e0a8d43ca42baa29285ec949ef9aad1db604
Opcode Fuzzy Hash: dc46ab7870c14927805a484403303369d6f2c401fe66365dcd44d52683762070
Instruction Fuzzy Hash: D5213074D14288EEDF05DFE0D958BCDBBB0BF55308F108088E001BB282DBB90A09DB51

Function 00D012B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D0130F
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,00CFFDEC,00000000,28CB4BA0,?,?), ref: 00D01328

Strings

tooltips_class32, xrefs: 00D01306

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Window$Create
String ID: tooltips_class32
API String ID: 870168347-1918224756
Opcode ID: 1fe31ee24081c7e5fff9789134212a4b1c285042761481750be0d9ff6dcb1a56
Instruction ID: e68011d7aa2a1782ba86622bb7cdbde08739f3f916750ce8f3f264891635a508
Opcode Fuzzy Hash: 1fe31ee24081c7e5fff9789134212a4b1c285042761481750be0d9ff6dcb1a56
Instruction Fuzzy Hash: 5F01F0313802167AF7248664DC4AFA23298D751B40F348329BF04FA0E0D6A2FA11D618

Function 00CC1391 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000013), ref: 00CC13C4

Strings

Unknown exception, xrefs: 00CC1399
C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 00CC13A9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-2259502730
Opcode ID: cce9e107213ecf9926275d4f3c510f9582f201a29055b50a36fefc3083889f78
Instruction ID: 3c983e5cc6d18333dacfeacd75a55a2d08eff5f34fd6efca360a3436ac5f72b0
Opcode Fuzzy Hash: cce9e107213ecf9926275d4f3c510f9582f201a29055b50a36fefc3083889f78
Instruction Fuzzy Hash: 1C016134D05248EFCF01DBE4CA15ADDBBB1AF55304F548098D401AB396DBB55A08EB91

Function 00CAD4B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CAD4E8

Strings

Unknown exception, xrefs: 00CAD4C0
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00CAD4D3

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-452454139
Opcode ID: c8fb33caa272cf3029dd443a218812128726d47f51d653bea4c99e4d84d1abc2
Instruction ID: 1b2720f7e719bda957fe081ffbbd8aad7570f16d9da8ee907676397a1bef199a
Opcode Fuzzy Hash: c8fb33caa272cf3029dd443a218812128726d47f51d653bea4c99e4d84d1abc2
Instruction Fuzzy Hash: B9018034D05288DBCF01EBE4CE15ADDBBB1AF56304F14819CD002AB386DBB55B08EB92

Function 00CAD0E2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00CAD10F

Strings

Unknown exception, xrefs: 00CAD0EA
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 00CAD0FA

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-452454139
Opcode ID: ef70e16fa601c3b87a8fb9311413675a4d87164da77b7d5045516194d227b0fa
Instruction ID: 62a2484ef7984cf45c69dd7734bb86863c92df14dd03dc980be3bde0c27aaa11
Opcode Fuzzy Hash: ef70e16fa601c3b87a8fb9311413675a4d87164da77b7d5045516194d227b0fa
Instruction Fuzzy Hash: A7018034D05288DBCF01DBE4CE156DDBBB1AF56304F148198D0016B386DBB55B08EB92

Function 00E3598C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CB3650: InitializeCriticalSectionAndSpinCount.KERNEL32(00F44C5C,00000000,28CB4BA0,00CA0000,Function_001BD840,000000FF,?,00E359BB,?,?,?,00CA6438), ref: 00CB3675
Part of subcall function 00CB3650: GetLastError.KERNEL32(?,00E359BB,?,?,?,00CA6438), ref: 00CB367F

IsDebuggerPresent.KERNEL32(?,?,?,00CA6438), ref: 00E359BF
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00CA6438), ref: 00E359CE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E359C9

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 22d6e26a7f1a5849b48bb417358e7f282686cfcbd693f476024b115bd30b535b
Instruction ID: d5571d08eca144898ba2f177d3f11fb056129541e1f8ff4b85c0edbe62872f77
Opcode Fuzzy Hash: 22d6e26a7f1a5849b48bb417358e7f282686cfcbd693f476024b115bd30b535b
Instruction Fuzzy Hash: C8E09270201B11CFC361AF36E508383BBE4AF46718F11991EE996E6741DBB0E408CBA1

Function 00E3344C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 10COMMON

Download Yara Rule

APIs

___delayLoadHelper2@8.DELAYIMP ref: 00E3341F

Part of subcall function 00E33814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 00E33887
Part of subcall function 00E33814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00E33898

Strings

~4, xrefs: 00E33419
L4, xrefs: 00E3344C

Memory Dump Source

Source File: 00000000.00000002.2282343229.0000000000CA1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CA0000, based on PE: true

Associated: 00000000.00000002.2282322492.0000000000CA0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282585266.0000000000EB8000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282793858.0000000000F3E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282817757.0000000000F43000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282848153.0000000000F44000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F47000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2282867444.0000000000F66000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ca0000_pYcFueZgOd.jbxd

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID: L4$~4
API String ID: 1269201914-2895323252
Opcode ID: 894a0402c3848d97cdbbeb563f709688fe41e4e8473ea7bb59b5f9fcd1110f4e
Instruction ID: 420f055e2adbbef4a1961a66bab01725f31653fe57703bf7ab16708513705f3f
Opcode Fuzzy Hash: 894a0402c3848d97cdbbeb563f709688fe41e4e8473ea7bb59b5f9fcd1110f4e
Instruction Fuzzy Hash: 3AB012D16689416C310C52691D0BD760D5CC0C0F21F30953AB400E2083E4405D88A433

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report pYcFueZgOd.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSI7F84.tmp

C:\Users\user\AppData\Local\Temp\MSI814A.tmp

C:\Users\user\AppData\Local\Temp\MSIc886c.LOG

C:\Users\user\AppData\Local\Temp\shi7EE7.tmp

C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\52455D3\Installer.msi

C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\decoder.dll

C:\Users\user\AppData\Roaming\ConsolHQ LTD\SkimarUtils 1.12.3\install\holder0.aiph

C:\Windows\Installer\6c83b9.msi

C:\Windows\Installer\MSI8743.tmp

C:\Windows\Installer\MSI87A2.tmp

C:\Windows\Installer\MSI87F1.tmp

C:\Windows\Installer\MSI8811.tmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
pYcFueZgOd.exe

Function 00DDB350 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 551
COMMON

Function 00DCEAB0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Function 00DC4050 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Function 00DA2350 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 85
libraryloaderCOMMON

Function 00DDA240 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
COMMON

Function 00DA2BA0 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Function 00DA2F80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Function 00DC4960 Relevance: 37.0, APIs: 2, Strings: 19, Instructions: 220
COMMON

Function 00DDF7B0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Function 00DB64D0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 495
COMMON

Function 00E35A9F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Function 00DE0BE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Function 00DC2810 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 224
fileCOMMON

Function 00DE1080 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 208
COMMON

Function 00DDF2F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON