Edit tour

Windows Analysis Report
2c6HNWVywp.exe

Overview

General Information

Sample name:	2c6HNWVywp.exe renamed because original name is a hash value
Original sample name:	1cea2e1892ef23d3a26c3c00ba38db8e54e6fa520681f8fa49d0d21350d86ffa.exe
Analysis ID:	1555001
MD5:	e121092ae5eef25b54cc9f8cf9401dbf
SHA1:	4dea659e2b2f67d0bfcba61fb3e41c2595d1a46b
SHA256:	1cea2e1892ef23d3a26c3c00ba38db8e54e6fa520681f8fa49d0d21350d86ffa
Tags:	ConsolHQLTDexeuser-JAMESWT_MHT
Infos:

Detection

Score:	13
Range:	0 - 100
Whitelisted:	false
Confidence:	20%

Signatures

Binary contains a suspicious time stamp

Checks for available system drives (often done to infect USB drives)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

2c6HNWVywp.exe (PID: 7976 cmdline: "C:\Users\user\Desktop\2c6HNWVywp.exe" MD5: E121092AE5EEF25B54CC9F8CF9401DBF)

msiexec.exe (PID: 7404 cmdline: "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\2c6HNWVywp.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488998 " AI_EUIMSI="" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 8180 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7260 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding C17C6E88C2AC26D77232308596BFC404 C MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 1624 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding 48383DF6A2E73543A85DB9345F606A15 MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Suricata Signatures

ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-13T10:12:24.820400+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.10	49773	TCP
2024-11-13T10:13:03.649016+0100	2022930	1	A Network Trojan was detected	4.175.87.197	443	192.168.2.10	49974	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: 2c6HNWVywp.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2c6HNWVywp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: wininet.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1325297826.0000000005777000.00000004.00000020.00020000.00000000.sdmp, shiFAD5.tmp.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: 2c6HNWVywp.exe, decoder.dll.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFF2E.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFF2E.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, Installer.msi.5.dr
Source:	Binary string: wininet.pdbUGP source: 2c6HNWVywp.exe, 00000005.00000003.1325297826.0000000005777000.00000004.00000020.00020000.00000000.sdmp, shiFAD5.tmp.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: 2c6HNWVywp.exe, decoder.dll.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: 2c6HNWVywp.exe

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003A43B0 FindFirstFileW,GetLastError,FindClose,	5_2_003A43B0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003C2380 FindFirstFileW,FindClose,	5_2_003C2380
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002BA950 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,	5_2_002BA950
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003C14D0 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	5_2_003C14D0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003A3DE0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	5_2_003A3DE0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003AC0B0 FindFirstFileW,FindClose,FindClose,	5_2_003AC0B0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003BE3A0 FindFirstFileW,FindClose,	5_2_003BE3A0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003CE610 FindFirstFileW,FindClose,	5_2_003CE610
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003CB3D0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	5_2_003CB3D0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003CB7D0 FindFirstFileW,FindClose,	5_2_003CB7D0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003A3A50 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	5_2_003A3A50
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003DFB20 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	5_2_003DFB20

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003CA620 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

5_2_003CA620

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.10:49773
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.175.87.197:443 -> 192.168.2.10:49974

Source: 2c6HNWVywp.exe, 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmp, 2c6HNWVywp.exe, 00000005.00000000.1275948020.00000000004B8000.00000002.00000001.01000000.00000004.sdmp	String found in binary or memory: <Shlwapi.dllShell32.dllmsiexec.exebinJavaHomeSoftware\JavaSoft\Java Development Kit\Software\JavaSoft\Java Runtime Environment\FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)
Source: 2c6HNWVywp.exe	String found in binary or memory: RShlwapi.dllShell32.dllmsiexec.exebinJavaHomeSoftware\JavaSoft\Java Development Kit\Software\JavaSoft\Java Runtime Environment\FlashWindowExFlashWindowKernel32.dllGetPackagePathhttp://www.example.comTESThttp://www.google.comhttp://www.yahoo.comtin9999.tmp.part= "GETattachmentDLD123filenamecharsetutf-16ISO-8859-1POSTutf-8Local Network ServerFTP ServerUS-ASCIIAdvancedInstallerRange: bytes=%u- equals www.yahoo.com (Yahoo)

Source: shiFAD5.tmp.5.dr	String found in binary or memory: http://.css
Source: shiFAD5.tmp.5.dr	String found in binary or memory: http://.jpg
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: shiFAD5.tmp.5.dr	String found in binary or memory: http://html4/loose.dtd
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr	String found in binary or memory: http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://t1.symcb.com/ThawtePCA.crl0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://t2.symcb.com0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://tl.symcb.com/tl.crl0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://tl.symcb.com/tl.crt0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://tl.symcd.com0&
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: https://www.advancedinstaller.com
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: https://www.thawte.com/cps0/
Source: 2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	String found in binary or memory: https://www.thawte.com/repository0W

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003E15E0 NtdllDefWindowProc_W,	5_2_003E15E0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00361FB0 GetSystemDirectoryW,_wcschr,LoadLibraryExW,NtdllDefWindowProc_W,	5_2_00361FB0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00300010 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	5_2_00300010
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002B2250 NtdllDefWindowProc_W,	5_2_002B2250
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002BC4F0 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DeleteCriticalSection,	5_2_002BC4F0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002B8720 NtdllDefWindowProc_W,	5_2_002B8720
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002B8890 IsWindow,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,	5_2_002B8890
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00300BAA ShowWindow,ShowWindow,GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	5_2_00300BAA
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002AEBE0 GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,NtdllDefWindowProc_W,	5_2_002AEBE0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00300C22 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	5_2_00300C22
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00300CE3 GetWindowLongW,SetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,SetWindowLongW,	5_2_00300CE3
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002F6EE0 NtdllDefWindowProc_W,	5_2_002F6EE0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002AF190 SysFreeString,SysAllocString,GetWindowLongW,GetWindowLongW,GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,GetWindowLongW,SetWindowTextW,GlobalAlloc,GlobalLock,GlobalUnlock,SetWindowLongW,SysFreeString,NtdllDefWindowProc_W,SysFreeString,	5_2_002AF190
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002CD320 NtdllDefWindowProc_W,	5_2_002CD320
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002C15F0 NtdllDefWindowProc_W,	5_2_002C15F0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002B1670 GetWindowLongW,SetWindowLongW,NtdllDefWindowProc_W,DestroyWindow,	5_2_002B1670
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002AF7C0 NtdllDefWindowProc_W,	5_2_002AF7C0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002B1C90 NtdllDefWindowProc_W,	5_2_002B1C90
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00347F20 NtdllDefWindowProc_W,	5_2_00347F20

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\50fd66.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFE6F.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFECE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEFE.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFF2E.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSIFE6F.tmp

Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002BA950	5_2_002BA950
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003DB350	5_2_003DB350
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003B7D70	5_2_003B7D70
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002C6070	5_2_002C6070
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002C41B0	5_2_002C41B0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002BE290	5_2_002BE290
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0043E2BE	5_2_0043E2BE
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0043E64C	5_2_0043E64C
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00382A50	5_2_00382A50
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00458B95	5_2_00458B95
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002B8CD0	5_2_002B8CD0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002A2F40	5_2_002A2F40
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002D52F0	5_2_002D52F0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0041D550	5_2_0041D550
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002C35A0	5_2_002C35A0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002C7630	5_2_002C7630
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0037B7A0	5_2_0037B7A0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002FFA40	5_2_002FFA40
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0044DD6A	5_2_0044DD6A
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00313FC0	5_2_00313FC0

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 002D3810 appears 90 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 002A7070 appears 53 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 002A6FF0 appears 46 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 002A99C0 appears 69 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 0039E6D0 appears 60 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 002A8800 appears 223 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 002A9390 appears 41 times
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: String function: 0039E770 appears 31 times

Source: 2c6HNWVywp.exe	Binary or memory string: OriginalFileName vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe, 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFileNameInstaller.exe4 vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe, 00000005.00000003.1325297826.0000000005777000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamewininet.dllD vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelzmaextractor.dllF vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAICustAct.dllF vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSoftwareDetector.dllF vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePrereq.dllF vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe	Binary or memory string: OriginalFileNameInstaller.exe4 vs 2c6HNWVywp.exe
Source: 2c6HNWVywp.exe	Binary or memory string: OriginalFilenameDecoder.dllF vs 2c6HNWVywp.exe

Source: 2c6HNWVywp.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: shiFAD5.tmp.5.dr

Binary string: \Device\NameResTrk\RecordNrtCloneOpenPacket

Source: classification engine

Classification label: clean13.winEXE@8/13@0/0

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003A2230 FormatMessageW,GetLastError,

5_2_003A2230

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003CC990 GetDiskFreeSpaceExW,

5_2_003CC990

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003E6D50 CoCreateInstance,

5_2_003E6D50

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_0033AB40 FindResourceW,LoadResource,LockResource,SizeofResource,

5_2_0033AB40

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

File created: C:\Users\user\AppData\Roaming\ConsolHQ LTD

Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

File created: C:\Users\user\AppData\Local\Temp\shiFAD5.tmp

Jump to behavior

Source: 2c6HNWVywp.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 2c6HNWVywp.exe, 00000005.00000002.1407101921.0000000001475000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403575355.0000000001453000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403667113.0000000001473000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT `Instance`,`PropertyName`,`PropertyValue` FROM `MultipleInstancesProps`K;q

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

File read: C:\Users\user\Desktop\2c6HNWVywp.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\2c6HNWVywp.exe "C:\Users\user\Desktop\2c6HNWVywp.exe"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C17C6E88C2AC26D77232308596BFC404 C
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\2c6HNWVywp.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488998 " AI_EUIMSI=""
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 48383DF6A2E73543A85DB9345F606A15
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\2c6HNWVywp.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488998 " AI_EUIMSI=""	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding C17C6E88C2AC26D77232308596BFC404 C	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding 48383DF6A2E73543A85DB9345F606A15	Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: lpk.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: 2c6HNWVywp.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: 2c6HNWVywp.exe

Static file information: File size 49189312 > 1048576

Source: 2c6HNWVywp.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x216e00

Source: 2c6HNWVywp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 2c6HNWVywp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 2c6HNWVywp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 2c6HNWVywp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 2c6HNWVywp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 2c6HNWVywp.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 2c6HNWVywp.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: 2c6HNWVywp.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wininet.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1325297826.0000000005777000.00000004.00000020.00020000.00000000.sdmp, shiFAD5.tmp.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdbo source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\Prereq.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb source: 2c6HNWVywp.exe, decoder.dll.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdbb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFF2E.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\SoftwareDetector.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFF2E.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, Installer.msi.5.dr
Source:	Binary string: wininet.pdbUGP source: 2c6HNWVywp.exe, 00000005.00000003.1325297826.0000000005777000.00000004.00000020.00020000.00000000.sdmp, shiFAD5.tmp.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\AICustAct.pdbn source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\Decoder.pdb5 source: 2c6HNWVywp.exe, decoder.dll.5.dr
Source:	Binary string: C:\JobRelease\win\Release\custact\x86\lzmaextractor.pdb source: 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr
Source:	Binary string: C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb source: 2c6HNWVywp.exe

Source: 2c6HNWVywp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 2c6HNWVywp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 2c6HNWVywp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 2c6HNWVywp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 2c6HNWVywp.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: shiFAD5.tmp.5.dr

Static PE information: 0xC7FEC470 [Wed Apr 29 05:06:56 2076 UTC]

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003A2350 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_003A2350

Source: shiFAD5.tmp.5.dr	Static PE information: section name: .wpp_sf
Source: shiFAD5.tmp.5.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140E7FC push es; retf	5_3_0140E8E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140E7FC push es; retf	5_3_0140E8E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140E7FC push es; retf	5_3_0140E8E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_01406C71 push es; ret	5_3_01407092
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_01406C71 push es; ret	5_3_01407092
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_01406C71 push es; ret	5_3_01407092
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140C4E8 push esi; iretd	5_3_0140C4E9
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140C4E8 push esi; iretd	5_3_0140C4E9
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140C4E8 push esi; iretd	5_3_0140C4E9
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140EA8B push es; ret	5_3_0140EA8E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140EA8B push es; ret	5_3_0140EA8E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140EA8B push es; ret	5_3_0140EA8E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A5 push es; retf	5_3_014070A6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A5 push es; retf	5_3_014070A6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A5 push es; retf	5_3_014070A6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A7 push es; iretd	5_3_014070B2
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A7 push es; iretd	5_3_014070B2
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A7 push es; iretd	5_3_014070B2
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140E7FC push es; retf	5_3_0140E8E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140E7FC push es; retf	5_3_0140E8E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140E7FC push es; retf	5_3_0140E8E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_01406C71 push es; ret	5_3_01407092
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_01406C71 push es; ret	5_3_01407092
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_01406C71 push es; ret	5_3_01407092
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140C4E8 push esi; iretd	5_3_0140C4E9
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140C4E8 push esi; iretd	5_3_0140C4E9
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140C4E8 push esi; iretd	5_3_0140C4E9
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140EA8B push es; ret	5_3_0140EA8E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140EA8B push es; ret	5_3_0140EA8E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_0140EA8B push es; ret	5_3_0140EA8E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_3_014070A5 push es; retf	5_3_014070A6

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFECE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEFE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFC10.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File created: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File created: C:\Users\user\AppData\Local\Temp\MSIFB63.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File created: C:\Users\user\AppData\Local\Temp\shiFAD5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFF2E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFE6F.tmp	Jump to dropped file

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFECE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFEFE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFF2E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSIFE6F.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFECE.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFEFE.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFC10.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\decoder.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSIFB63.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\shiFAD5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFF2E.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	Dropped PE file which has not been started: C:\Windows\Installer\MSIFE6F.tmp	Jump to dropped file

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Evaded block: after key decision

graph_5-67425

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-69496

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

API coverage: 10.0 %

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File Volume queried: C:\Users\user\AppData\Roaming FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File Volume queried: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File Volume queried: C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3 FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003A43B0 FindFirstFileW,GetLastError,FindClose,	5_2_003A43B0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003C2380 FindFirstFileW,FindClose,	5_2_003C2380
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002BA950 FindClose,PathIsUNCW,FindFirstFileW,GetFullPathNameW,GetFullPathNameW,FindClose,SetLastError,PathIsUNCW,	5_2_002BA950
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003C14D0 FindFirstFileW,FindClose,CloseHandle,CloseHandle,CloseHandle,CreateEventW,CreateThread,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,	5_2_003C14D0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003A3DE0 FindFirstFileW,GetFileAttributesW,SetFileAttributesW,GetFileAttributesW,FindNextFileW,	5_2_003A3DE0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003AC0B0 FindFirstFileW,FindClose,FindClose,	5_2_003AC0B0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003BE3A0 FindFirstFileW,FindClose,	5_2_003BE3A0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003CE610 FindFirstFileW,FindClose,	5_2_003CE610
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003CB3D0 FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	5_2_003CB3D0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003CB7D0 FindFirstFileW,FindClose,	5_2_003CB7D0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003A3A50 FindFirstFileW,FindFirstFileW,FindFirstFileW,FindClose,FindClose,	5_2_003A3A50
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_003DFB20 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,FindNextFileW,FindClose,	5_2_003DFB20

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003CA620 _wcschr,GetLogicalDriveStringsW,GetDriveTypeW,Wow64DisableWow64FsRedirection,Wow64RevertWow64FsRedirection,

5_2_003CA620

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_0043365A VirtualQuery,GetSystemInfo,

5_2_0043365A

Source: Installer.msi.5.dr	Binary or memory string: RegOpenKeyTransactedW::NetUserGetInfo() failed with error: \@invalid string_view positionVMware, Inc.VMware Virtual PlatformVMware7,1innotek GmbHVirtualBoxMicrosoft CorporationVirtual MachineVRTUALACRSYSA M IGetting system informationManufacturer [Model [BIOS [\\?\UNC\\\?\shim_clone%d.%d.%d.%dDllGetVersion[%!]%!ProgramFilesFolderCommonFilesFolderDesktopFolderAllUsersDesktopFolderAppDataFolderFavoritesFolderStartMenuFolderProgramMenuFolderStartupFolderFontsFolderLocalAppDataFolderCommonAppDataFolderProgramFiles64FolderProgramFilesProgramW6432SystemFolderSystem32FolderWindowsFolderWindowsVolumeTempFolderSETUPEXEDIRshfolder.dllSHGetFolderPathWProgramFilesAPPDATAPROGRAMFILES&+
Source: 2c6HNWVywp.exe	Binary or memory string: VMci4
Source: 2c6HNWVywp.exe	Binary or memory string: hgfS`

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_0043AD13 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_0043AD13

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003D77C0 CreateFileW,GetLastError,OutputDebugStringW,OutputDebugStringW,SetFilePointer,FlushFileBuffers,WriteFile,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,OutputDebugStringW,WriteFile,WriteFile,FlushFileBuffers,FlushFileBuffers,WriteFile,FlushFileBuffers,WriteFile,FlushFileBuffers,

5_2_003D77C0

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003A2350 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_003A2350

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0044C66D mov ecx, dword ptr fs:[00000030h]	5_2_0044C66D
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0045783E mov eax, dword ptr fs:[00000030h]	5_2_0045783E
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00435CA1 mov esi, dword ptr fs:[00000030h]	5_2_00435CA1

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_00435D0D GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,

5_2_00435D0D

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_002D21E0 __set_se_translator,SetUnhandledExceptionFilter,	5_2_002D21E0
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_00436738 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00436738
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: 5_2_0043AD13 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_0043AD13

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\consolhq ltd\consolehq 1.12.3\install\52455d3\installer.msi" ai_setupexepath=c:\users\user\desktop\2c6hnwvywp.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488998 " ai_euimsi=""
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "c:\windows\system32\msiexec.exe" /i "c:\users\user\appdata\roaming\consolhq ltd\consolehq 1.12.3\install\52455d3\installer.msi" ai_setupexepath=c:\users\user\desktop\2c6hnwvywp.exe setupexedir=c:\users\user\desktop\ exe_cmd_line="/exenoupdates /forcecleanup /wintime 1731488998 " ai_euimsi=""			Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003CEAB0 GetCurrentProcess,OpenProcessToken,GetLastError,GetTokenInformation,GetTokenInformation,GetLastError,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,GetLastError,CloseHandle,

5_2_003CEAB0

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,MsgWaitForMultipleObjectsEx,MsgWaitForMultipleObjectsEx,PeekMessageW,TranslateMessage,DispatchMessageW,PeekMessageW,TranslateMessage,DispatchMessageW,MsgWaitForMultipleObjectsEx,	5_2_003C4050
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,	5_2_004541E6
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,	5_2_00450186
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_0045430F
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,	5_2_00454415
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_004544E4
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_00453B80
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: EnumSystemLocalesW,	5_2_0044FC09
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,	5_2_00453D7B
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: EnumSystemLocalesW,	5_2_00453E6D
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: EnumSystemLocalesW,	5_2_00453E22
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: EnumSystemLocalesW,	5_2_00453F08
Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_00453F93

Source: C:\Users\user\Desktop\2c6HNWVywp.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003DBB20 CreateNamedPipeW,CreateFileW,

5_2_003DBB20

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_004372F4 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_004372F4

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_003DA240 GetUserNameW,GetUserNameW,GetLastError,GetUserNameW,GetEnvironmentVariableW,GetEnvironmentVariableW,

5_2_003DA240

Source: C:\Users\user\Desktop\2c6HNWVywp.exe

Code function: 5_2_00396BF0 RevokeBindStatusCallback,

5_2_00396BF0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	1 Command and Scripting Interpreter	1 DLL Side-Loading	2 Process Injection	21 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Timestomp	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	25 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
2c6HNWVywp.exe	0%	ReversingLabs
2c6HNWVywp.exe	3%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Temp\MSIFB63.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIFB63.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\MSIFC10.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\MSIFC10.tmp	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\shiFAD5.tmp	0%	ReversingLabs
C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\decoder.dll	0%	ReversingLabs
C:\Windows\Installer\MSIFE6F.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFECE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFEFE.tmp	0%	ReversingLabs
C:\Windows\Installer\MSIFF2E.tmp	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://iptc.org/std/Iptc4xmpCore/1.0/xmlns/	2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 50fd66.msi.7.dr, Installer.msi.5.dr	false	high
http://html4/loose.dtd	shiFAD5.tmp.5.dr	false	high
https://www.advancedinstaller.com	2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	false	high
https://www.thawte.com/cps0/	2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	false	high
http://.css	shiFAD5.tmp.5.dr	false	high
http://.jpg	shiFAD5.tmp.5.dr	false	high
https://www.thawte.com/repository0W	2c6HNWVywp.exe, 00000005.00000003.1404516434.00000000064DD000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403180179.00000000064BC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1403503096.00000000064DC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.000000000418F000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405701557.00000000064EC000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1321698606.00000000042E5000.00000004.00000020.00020000.00000000.sdmp, 2c6HNWVywp.exe, 00000005.00000003.1405103223.00000000064DF000.00000004.00000020.00020000.00000000.sdmp, MSIFE6F.tmp.7.dr, MSIFF2E.tmp.7.dr, MSIFEFE.tmp.7.dr, 50fd66.msi.7.dr, MSIFC10.tmp.5.dr, MSIFB63.tmp.5.dr, Installer.msi.5.dr, MSIFECE.tmp.7.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1555001
Start date and time:	2024-11-13 10:11:15 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2c6HNWVywp.exe renamed because original name is a hash value
Original Sample Name:	1cea2e1892ef23d3a26c3c00ba38db8e54e6fa520681f8fa49d0d21350d86ffa.exe
Detection:	CLEAN
Classification:	clean13.winEXE@8/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 56% Number of executed functions: 67 Number of non-executed functions: 222
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\MSIFB63.tmp	IM-vL5WWvBl.msi	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\shiFAD5.tmp	setup.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse
	VirtualDesktop.Streamer.Setup.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	Step 3 - Setup_Install.exe	Get hash	malicious	Xmrig	Browse
	http://downloads.ciscocems.com/downloads/CeDAR/Setup_Cedar%208.05.08.zip	Get hash	malicious	Unknown	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	Bill Details.exe	Get hash	malicious	UltraVNC	Browse
	teracopy.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSIFB63.tmp

Download File

Process:	C:\Users\user\Desktop\2c6HNWVywp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:	6144:PBtBN+l8CKvSHJSTHLntEToqi/9rpiAO+7lMhZeBajAt7fgcY:PB/0l1K7HLnt5DgMlgZ7AtDgcY
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: IM-vL5WWvBl.msi, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIFC10.tmp

Download File

Process:	C:\Users\user\Desktop\2c6HNWVywp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	919520
Entropy (8bit):	6.451407326378623
Encrypted:	false
SSDEEP:	24576:1x90VXSK4fSa6HXr1iWn8Zlb2h4ntHurpllQ6a:Pq4Fb6HXr1iWnU84ntHurpllQ6a
MD5:	064278F42704CDCE52C8C527CF9AFBC7
SHA1:	007C2A1C946EB62886AC26ADFC7C6B41EECD4D41
SHA-256:	070155314AE1035E0A74729231EA97053744EC3B0D5E8D8AF0D000448924D5A9
SHA-512:	9D7AE27229317F07CFD051AB8A7E4E7AC4071593FB0329BFF21CFB812086CA00CFFEBBC950A4849C233D8B2EE3D306E9A3338415DEB48CEE09C5B94704A01A70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#S..#S..#S]. R..#S].&R;.#S.'R..#S. R..#S.&R..#S].'R..#S]."R..#S.."S..#S2.*R..#S2.#R..#S2..S..#S..S..#S2.!R..#SRich..#S........PE..L...P..b.........."!.....X...................p...............................@......{9....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MSIff69.LOG

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	276
Entropy (8bit):	3.4248859055529355
Encrypted:	false
SSDEEP:	6:QmQlfuV3ecOYrsfc/okjxaaOEqQbr62avKpnKBlv2K84UlUlwll:QmQ1u9Zsc/7aFEVbr62aInKT8Jll
MD5:	DD384DCD1C622E68FC0BDA0970DF5553
SHA1:	43191FDF7BA232B4610702BCB428F969AC01975E
SHA-256:	B707A86A2582CAF4D45516D94BA916B9E5E99EB268DACA41F9E1AEB591F30FCD
SHA-512:	8A0932788D2217AF9FF5F59C633D52C161DC5D68992997568A979BF941CB6E7A43FA55F217249268C17A1944FC4583C17EAB46A16BB5A9A33671ED317AC02D82
Malicious:	false
Reputation:	low
Preview:	..C.o.n.s.o.l.e.H.Q. .c.a.n.n.o.t. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .s.y.s.t.e.m.s. .w.i.t.h. .s.c.r.e.e.n. .r.e.s.o.l.u.t.i.o.n. .s.m.a.l.l.e.r. .t.h.a.n. .1.3.6.0. .x. .7.6.8.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.3./.1.1./.2.0.2.4. . .0.4.:.1.2.:.1.8. .=.=.=.....

C:\Users\user\AppData\Local\Temp\shiFAD5.tmp

Download File

Process:	C:\Users\user\Desktop\2c6HNWVywp.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5038592
Entropy (8bit):	6.043058205786219
Encrypted:	false
SSDEEP:	49152:vVkDvLSkqdbEsuV+ebMh8w+/H8pF/bmlEyGjWvcP1xQ+X7TqVAMPLfQyim8kznsY:2Ll+Mn0WHl9VA2ic/
MD5:	11F7419009AF2874C4B0E4505D185D79
SHA1:	451D8D0470CEDB268619BA1E7AE78ADAE0EBA692
SHA-256:	AC24CCE72F82C3EBBE9E7E9B80004163B9EED54D30467ECE6157EE4061BEAC95
SHA-512:	1EABBBFDF579A93BBB055B973AA3321FC8DC8DA1A36FDE2BA9A4D58E5751DC106A4A1BBC4AD1F425C082702D6FBB821AA1078BC5ADC6B2AD1B5CE12A68058805
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: setup.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: VirtualDesktop.Streamer.Setup.exe, Detection: malicious, Browse Filename: VirtualDesktop.Streamer.Setup.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Step 3 - Setup_Install.exe, Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: Bill Details.exe, Detection: malicious, Browse Filename: teracopy.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......e.D!...!...!...(.V.C...5..."...5...&...5...)...!......5...:...5... ...5...R...5.:. ...5... ...Rich!...................PE..d...p............." .........D...............................................`M.....'.M...`A........................................@.H.L&....I......@K.H.....I..............@M.....`J:.p.......................(....%..............@.......$.H......................text...4B.......D.................. ..`.wpp_sf.....`.......H.............. ..`.rdata...L......N.................@..@.data...hD...PI......*I.............@....pdata........I......2I.............@..@.didat.......0K.......J.............@....rsrc...H....@K.......J.............@..@.reloc.......@M.. ....L.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3\Installer.msi

Download File

Process:	C:\Users\user\Desktop\2c6HNWVywp.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {3D2F3062-A70B-445E-8CE0-4683179903E0}, Number of Words: 0, Subject: ConsoleHQ, Author: ConsolHQ LTD, Name of Creating Application: ConsoleHQ, Template: ;1033, Comments: This installer database contains the logic and data required to install ConsoleHQ., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2200576
Entropy (8bit):	6.507735592861096
Encrypted:	false
SSDEEP:	49152:kSVYVKjlgZcDgcYrAvq4Fb6HXr1iWnU84ntHurpllQ6aSHCP1N0ZqgJtmpxl:5Y4jluAjFnWnq1
MD5:	6705CCE3BC489F21E89914817299191E
SHA1:	0D406B2AA2FC69460088C244C944748491EA707E
SHA-256:	BA061426E33C6432E7FD96973A92A7D6754723CC28E5F4077362FA609F686A9F
SHA-512:	4093713E87458E2353F83CF8B3F8E8D5BA339D1CD2AA921ECFD636FCE591FBA8EE0164FF5B7AC18C11F7D09D3BC0EAF52AA64A47686A695FECD43965313F01B7
Malicious:	false
Preview:	......................>..................."...................................f...............................1...2...3...4...5...6...7...8...9...:...;...<...=...>...C...D...E...F...G...H...I...J...K...................................................................................................................................................................................................................................................................................................................................N...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C.......E...K...G...H...I...J.......L...M...O..._...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^...`......a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\decoder.dll

Download File

Process:	C:\Users\user\Desktop\2c6HNWVywp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	209920
Entropy (8bit):	6.447659228395253
Encrypted:	false
SSDEEP:	3072:tScXkSa4E7uzTK+NbkuO2DcUC1myXxskH9Xq4fa2KbDI0lSmb9D:Q7sO+EZ9LH2j7Mmb9
MD5:	A5FFDCF45D3D123139C49017B22F444E
SHA1:	7B3D3D293F9A34570FC91500A6580496147C7658
SHA-256:	8F49245444B02BF0E103C5A5850A0B2FB1F2880C917261D146E3B8BC3C166E40
SHA-512:	5FF195A70825EFCED761ACEEEC5A6F0D0E18C1A4074482F584EFABEF7166C957C728D71D6185E3487A1405C608D820EFA4E07C584D60A8D51625E5D8A9A89397
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......n..a..2..2..2..3 ..2..3...2x.3...2x.3:..2x.3?..2..3?..2..3-..2..2...2..3v..2..3+..2..^2+..2.62+..2..3+..2Rich..2................PE..L...?..b.........."!.....`...................p............................................@......................... ...........<....p.. .......................0 ......p...........................`...@............p..t............................text....^.......`.................. ..`.rdata.......p.......d..............@..@.data...dV..........................@....rsrc... ....p......................@..@.reloc..0 ......."..................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\holder0.aiph

Download File

Process:	C:\Users\user\Desktop\2c6HNWVywp.exe
File Type:	data
Category:	dropped
Size (bytes):	162168468
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	2DBC0818CDB52345791955E058A40132
SHA1:	3CEC7455FB8C8F57FABA2B065BA7BEEBCECBA565
SHA-256:	896FBF58598F1376DC47013E0CCDF5422A54C28460F858ABD25B871DC02D5509
SHA-512:	8173DAE9455BD4D200E0C5D3A25014AA879FF3FC9A9001C02F91BB0F1EA10D226BFFD6C8E19BA2F7A37A646749E82C5A70CF62A7C461660A188343C8A19E77CB
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\50fd66.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Sep 18 15:06:51 2020, Security: 0, Code page: 1252, Revision Number: {3D2F3062-A70B-445E-8CE0-4683179903E0}, Number of Words: 0, Subject: ConsoleHQ, Author: ConsolHQ LTD, Name of Creating Application: ConsoleHQ, Template: ;1033, Comments: This installer database contains the logic and data required to install ConsoleHQ., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
Category:	dropped
Size (bytes):	2200576
Entropy (8bit):	6.507735592861096
Encrypted:	false
SSDEEP:
MD5:	6705CCE3BC489F21E89914817299191E
SHA1:	0D406B2AA2FC69460088C244C944748491EA707E
SHA-256:	BA061426E33C6432E7FD96973A92A7D6754723CC28E5F4077362FA609F686A9F
SHA-512:	4093713E87458E2353F83CF8B3F8E8D5BA339D1CD2AA921ECFD636FCE591FBA8EE0164FF5B7AC18C11F7D09D3BC0EAF52AA64A47686A695FECD43965313F01B7
Malicious:	false
Preview:	......................>..................."...................................f...............................1...2...3...4...5...6...7...8...9...:...;...<...=...>...C...D...E...F...G...H...I...J...K...................................................................................................................................................................................................................................................................................................................................N...............................:...<........................................................................... ...!..."...#...$...%...&...'...(...)......4...,...-......./...0...1...2...3.......5...6...7...8...9...=...;...D...F...>...?...@...A...B...C.......E...K...G...H...I...J.......L...M...O..._...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^...`......a...b...c...d...e...........h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Windows\Installer\MSIFE6F.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFECE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFEFE.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	453088
Entropy (8bit):	6.413087895399404
Encrypted:	false
SSDEEP:
MD5:	FBC6CCCA9154D017D647938190E4AD8D
SHA1:	E753F1511F27427616E98762BA2F45D67C3D90D4
SHA-256:	D0C9F193D5FB108035C24CD16495D8471295C8AE4A507CC939DCD3C31ED70836
SHA-512:	D72A7B6BE718E09B0B6B2A6C32888FB29BBE34D34D1965CCE017162224DB20D4BADAAE507244E16E7A72B84A15139FC9CB6EA703925666906F73420684E0D49D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......G.b7...d...d...d..e...d..e...dQ..e...dQ..e...dQ..eK..d..e...d..e...d..e...d...dP..d...eV..d...e...d...d...d..d...d...e...dRich...d................PE..L......b.........."!.........R.......................................................-....@.........................._.......f..........0........................L..H...p...............................@...............4............................text............................... ..`.rdata..............................@..@.data....!...........j..............@....rsrc...0............\|..............@..@.reloc...L.......N..................@..B................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSIFF2E.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	919520
Entropy (8bit):	6.451407326378623
Encrypted:	false
SSDEEP:
MD5:	064278F42704CDCE52C8C527CF9AFBC7
SHA1:	007C2A1C946EB62886AC26ADFC7C6B41EECD4D41
SHA-256:	070155314AE1035E0A74729231EA97053744EC3B0D5E8D8AF0D000448924D5A9
SHA-512:	9D7AE27229317F07CFD051AB8A7E4E7AC4071593FB0329BFF21CFB812086CA00CFFEBBC950A4849C233D8B2EE3D306E9A3338415DEB48CEE09C5B94704A01A70
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...#S..#S..#S]. R..#S].&R;.#S.'R..#S. R..#S.&R..#S].'R..#S]."R..#S.."S..#S2.*R..#S2.#R..#S2..S..#S..S..#S2.!R..#SRich..#S........PE..L...P..b.........."!.....X...................p...............................@......{9....@.........................`A..t....A.......0.......................@..L...(...p...............................@............p...............................text...nV.......X.................. ..`.rdata.......p.......\..............@..@.data...<....`.......@..............@....rsrc........0......................@..@.reloc..L....@......................@..B................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	363829
Entropy (8bit):	5.365413746310935
Encrypted:	false
SSDEEP:
MD5:	7596C4598FA936608BEA83F976BFA088
SHA1:	10E9CD7F330A1DE98DF41FE0E95B15F456E45977
SHA-256:	448C266E6C691E9B9869F577B003EF04C68E2215EC5E4E3872AD743CCE7F5F81
SHA-512:	74F1E4C2DC0BED62089E2219A8BF08FB9A26B4CCE894C94C36DA266D57CD3B7020E6124A672CA122E26071A41F70ADAB9EA96A4227E0E36340556061F43CC35D
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9766416416233135
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2c6HNWVywp.exe
File size:	49'189'312 bytes
MD5:	e121092ae5eef25b54cc9f8cf9401dbf
SHA1:	4dea659e2b2f67d0bfcba61fb3e41c2595d1a46b
SHA256:	1cea2e1892ef23d3a26c3c00ba38db8e54e6fa520681f8fa49d0d21350d86ffa
SHA512:	7bc231d4a4de2966491991fc108b380da31fa6836b42660cbac1a0c2355f8555f76aae50c52cd004c5fbfae84d0c93bfaf00f1538418dc8a20fba5395d0a3e5c
SSDEEP:	786432:aVGXG8/1TmEbPznMmlZa0aBrmoL1QKRGjFWCjXWjW0+hkE5KWVS:u8/1Zbra5Brn1XRGBW+GjohkQW
TLSH:	BBB72331364EC52BDA6615B02A3C9AAF10197FB50F6158C7B3CC2D6E1BB49C35632E27
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............{...{...{.3.x...{.3.~.X.{.3.}...{.......{...x...{...~...{.3.....{.3.z...{.3.\|...{...z.8.{.\.r...{.\.....{.......{.\.y...{

File Icon


Icon Hash:	9713331b4d3b2f0c

Static PE Info

General

Entrypoint:	0x596c64
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x6213B2EE [Mon Feb 21 15:42:38 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	836688c7d21e39394af41ce9a8c2d728

Entrypoint Preview

Instruction
call 00007F6F98E9BEDDh
jmp 00007F6F98E9B67Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F6F98E9ACD3h
jmp 00007F6F98E9B7E2h
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0069E01Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29cb94	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a7000	0x3d55c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2e5000	0x256bc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x246778	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x246800	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x219f38	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x218000	0x2c0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x299f88	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x216c3f	0x216e00	b670db57563315716440578ee99e5466	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x218000	0x85b8c	0x85c00	59a6fbcfc1f150b26bf16fdd47452e43	False	0.3120947721962617	data	4.605894063170113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29e000	0x89f0	0x6a00	1cea180402edcf39ea7c6193312cce32	False	0.14180424528301888	DOS executable (block device driver 0aY)	2.8670521481443174	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2a7000	0x3d55c	0x3d600	9c215b5617dafedde9588bb2401248ca	False	0.2635724287169043	data	5.856059532970926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2e5000	0x256bc	0x25800	08f0f06260e93e98732bfb4145f07cca	False	0.446171875	data	6.512576488264422	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE_FILE	0x2a7bf0	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
IMAGE_FILE	0x2a7bf8	0x6	ISO-8859 text, with no line terminators	English	United States	2.1666666666666665
RTF_FILE	0x2a7c00	0x2e9	Rich Text Format data, version 1, ANSI, code page 1252	English	United States	0.5503355704697986
RTF_FILE	0x2a7eec	0xa1	Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033	English	United States	0.906832298136646
RT_BITMAP	0x2a7f90	0x13e	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 5 important colors	English	United States	0.25471698113207547
RT_BITMAP	0x2a80d0	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.03017241379310345
RT_BITMAP	0x2a88f8	0x48a8	Device independent bitmap graphic, 290 x 16 x 32, image size 0	English	United States	0.11881720430107527
RT_BITMAP	0x2ad1a0	0xa6a	Device independent bitmap graphic, 320 x 16 x 4, image size 2562, resolution 2834 x 2834 px/m	English	United States	0.21680420105026257
RT_BITMAP	0x2adc0c	0x152	Device independent bitmap graphic, 32 x 16 x 4, image size 258, resolution 2834 x 2834 px/m, 10 important colors	English	United States	0.5295857988165681
RT_BITMAP	0x2add60	0x828	Device independent bitmap graphic, 32 x 16 x 32, image size 0	English	United States	0.4875478927203065
RT_ICON	0x2ae588	0x7c5a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9958534899792675
RT_ICON	0x2b61e4	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 0	English	United States	0.142848692771797
RT_ICON	0x2c6a0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.29470954356846474
RT_ICON	0x2c8fb4	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.3621013133208255
RT_ICON	0x2ca05c	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.45819672131147543
RT_MENU	0x2ca9e4	0x5c	data	English	United States	0.8478260869565217
RT_MENU	0x2caa40	0x2a	data	English	United States	1.0714285714285714
RT_DIALOG	0x2caa6c	0xac	data	English	United States	0.7151162790697675
RT_DIALOG	0x2cab18	0x2a6	data	English	United States	0.5132743362831859
RT_DIALOG	0x2cadc0	0x3b4	data	English	United States	0.43248945147679324
RT_DIALOG	0x2cb174	0xbc	data	English	United States	0.7180851063829787
RT_DIALOG	0x2cb230	0x204	data	English	United States	0.560077519379845
RT_DIALOG	0x2cb434	0x282	data	English	United States	0.48598130841121495
RT_DIALOG	0x2cb6b8	0xcc	data	English	United States	0.6911764705882353
RT_DIALOG	0x2cb784	0x146	data	English	United States	0.5736196319018405
RT_DIALOG	0x2cb8cc	0x226	data	English	United States	0.4690909090909091
RT_DIALOG	0x2cbaf4	0x388	data	English	United States	0.45464601769911506
RT_DIALOG	0x2cbe7c	0x1b4	data	English	United States	0.5458715596330275
RT_DIALOG	0x2cc030	0x136	data	English	United States	0.6064516129032258
RT_DIALOG	0x2cc168	0x4c	data	English	United States	0.8289473684210527
RT_STRING	0x2cc1b4	0x45c	data	English	United States	0.3844086021505376
RT_STRING	0x2cc610	0x344	data	English	United States	0.37320574162679426
RT_STRING	0x2cc954	0x2f8	data	English	United States	0.4039473684210526
RT_STRING	0x2ccc4c	0x598	data	English	United States	0.2807262569832402
RT_STRING	0x2cd1e4	0x3aa	StarOffice Gallery theme i, 1627418368 objects, 1st n	English	United States	0.4211087420042644
RT_STRING	0x2cd590	0x5c0	data	English	United States	0.3498641304347826
RT_STRING	0x2cdb50	0x568	data	English	United States	0.32875722543352603
RT_STRING	0x2ce0b8	0x164	data	English	United States	0.5421348314606742
RT_STRING	0x2ce21c	0x520	data	English	United States	0.39176829268292684
RT_STRING	0x2ce73c	0x1a0	data	English	United States	0.45913461538461536
RT_STRING	0x2ce8dc	0x18a	data	English	United States	0.5228426395939086
RT_STRING	0x2cea68	0x216	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	United States	0.46254681647940077
RT_STRING	0x2cec80	0x624	data	English	United States	0.3575063613231552
RT_STRING	0x2cf2a4	0x660	data	English	United States	0.3474264705882353
RT_STRING	0x2cf904	0x2e2	data	English	United States	0.4037940379403794
RT_GROUP_ICON	0x2cfbe8	0x4c	data	English	United States	0.7763157894736842
RT_VERSION	0x2cfc34	0x2dc	data	English	United States	0.453551912568306
RT_HTML	0x2cff10	0x37c8	ASCII text, with very long lines (443), with CRLF line terminators	English	United States	0.08291316526610644
RT_HTML	0x2d36d8	0x1316	ASCII text, with CRLF line terminators	English	United States	0.18399508800654932
RT_HTML	0x2d49f0	0x4fa	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3626373626373626
RT_HTML	0x2d4eec	0x6acd	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10679931238798873
RT_HTML	0x2db9bc	0x6a2	HTML document, ASCII text, with CRLF line terminators	English	United States	0.3486454652532391
RT_HTML	0x2dc060	0x104a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.2170263788968825
RT_HTML	0x2dd0ac	0x15b1	HTML document, ASCII text, with CRLF line terminators	English	United States	0.17612101566720692
RT_HTML	0x2de660	0x205c	exported SGML document, ASCII text, with very long lines (659), with CRLF line terminators	English	United States	0.13604538870111058
RT_HTML	0x2e06bc	0x368d	HTML document, ASCII text, with CRLF line terminators	English	United States	0.10834228428213391
RT_MANIFEST	0x2e3d4c	0x80f	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.40814348036839554

Imports

DLL

Import

KERNEL32.dll

CreateFileW, CloseHandle, WriteFile, DeleteFileW, HeapDestroy, HeapSize, HeapReAlloc, HeapFree, HeapAlloc, GetProcessHeap, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, RemoveDirectoryW, GetTempPathW, GetTempFileNameW, CreateDirectoryW, MoveFileW, GetLastError, EnterCriticalSection, LeaveCriticalSection, GetModuleFileNameW, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, GetCurrentThreadId, RaiseException, SetLastError, GlobalUnlock, GlobalLock, GlobalAlloc, MulDiv, lstrcmpW, CreateEventW, FindClose, FindFirstFileW, GetFullPathNameW, SetEvent, InitializeCriticalSection, lstrcpynW, CreateThread, WaitForSingleObject, GetProcAddress, LoadLibraryExW, Sleep, GetDiskFreeSpaceExW, DecodePointer, GetExitCodeThread, GetCurrentProcessId, FreeLibrary, GetSystemDirectoryW, lstrlenW, VerifyVersionInfoW, VerSetConditionMask, lstrcmpiW, GetModuleHandleW, LoadLibraryW, GetDriveTypeW, CompareStringW, FindNextFileW, GetLogicalDriveStringsW, GetFileSize, GetFileAttributesW, GetShortPathNameW, SetFileAttributesW, GetFileTime, CopyFileW, ReadFile, SetFilePointer, SystemTimeToFileTime, MultiByteToWideChar, WideCharToMultiByte, GetCurrentProcess, GetSystemInfo, WaitForMultipleObjects, VirtualProtect, VirtualQuery, LoadLibraryExA, GetStringTypeW, SetUnhandledExceptionFilter, FormatMessageW, FileTimeToSystemTime, GetEnvironmentVariableW, GetEnvironmentStringsW, LocalFree, InitializeCriticalSectionEx, LoadLibraryA, GetModuleFileNameA, GetCurrentThread, GetConsoleOutputCP, FlushFileBuffers, SetConsoleTextAttribute, GetStdHandle, GetConsoleScreenBufferInfo, OutputDebugStringW, CreateProcessW, GetExitCodeProcess, GetTickCount, GetCommandLineW, SetCurrentDirectoryW, SetEndOfFile, EnumResourceLanguagesW, GetLocaleInfoW, GetSystemDefaultLangID, GetUserDefaultLangID, GetWindowsDirectoryW, GetSystemTime, GetDateFormatW, GetTimeFormatW, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, ResetEvent, GlobalFree, GetPrivateProfileStringW, GetPrivateProfileSectionNamesW, WritePrivateProfileStringW, GetLocalTime, CreateNamedPipeW, ConnectNamedPipe, Wow64DisableWow64FsRedirection, Wow64RevertWow64FsRedirection, IsWow64Process, TerminateThread, LocalAlloc, CompareFileTime, CopyFileExW, OpenEventW, PeekNamedPipe, QueryPerformanceCounter, QueryPerformanceFrequency, EncodePointer, LCMapStringEx, GetSystemTimeAsFileTime, CompareStringEx, GetCPInfo, IsDebuggerPresent, InitializeSListHead, InterlockedPopEntrySList, InterlockedPushEntrySList, FlushInstructionCache, IsProcessorFeaturePresent, VirtualAlloc, VirtualFree, WaitForSingleObjectEx, UnhandledExceptionFilter, TerminateProcess, GetStartupInfoW, RtlUnwind, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, ExitProcess, GetModuleHandleExW, GetFileType, GetTimeZoneInformation, LCMapStringW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, GetConsoleMode, IsValidCodePage, GetACP, GetOEMCP, GetFileSizeEx, SetFilePointerEx, FindFirstFileExW, GetCommandLineA, FreeEnvironmentStringsW, SetEnvironmentVariableW, SetStdHandle, ReadConsoleW, WriteConsoleW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	5
Start time:	04:12:05
Start date:	13/11/2024
Path:	C:\Users\user\Desktop\2c6HNWVywp.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2c6HNWVywp.exe"
Imagebase:	0x2a0000
File size:	49'189'312 bytes
MD5 hash:	E121092AE5EEF25B54CC9F8CF9401DBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:12:10
Start date:	13/11/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff66c080000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:12:11
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding C17C6E88C2AC26D77232308596BFC404 C
Imagebase:	0xd00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:12:11
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\msiexec.exe" /i "C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3\Installer.msi" AI_SETUPEXEPATH=C:\Users\user\Desktop\2c6HNWVywp.exe SETUPEXEDIR=C:\Users\user\Desktop\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1731488998 " AI_EUIMSI=""
Imagebase:	0xd00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:12:11
Start date:	13/11/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\syswow64\MsiExec.exe -Embedding 48383DF6A2E73543A85DB9345F606A15
Imagebase:	0xd00000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	25%
Total number of Nodes:	2000
Total number of Limit Nodes:	87

Executed Functions

Function 003B7D70 Relevance: 43.7, APIs: 2, Strings: 22, Instructions: 1745COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

SetEvent.KERNEL32(?,?,00000000,?,00000001), ref: 003B7F67
SetEvent.KERNEL32(?), ref: 003B7FC5

Part of subcall function 003C2AB0: DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,E48E37CD), ref: 003C2ADB

Strings

T`T, xrefs: 003B8615
lMhM, xrefs: 003B7FAC
%hu, xrefs: 003B82DD
Language of a related product is:, xrefs: 003B849C
Languages of setup:, xrefs: 003B907D
Advinst_Extract_, xrefs: 003B7DC5, 003B7DD7, 003B7DE1
Software\Caphyon\Advanced Installer\, xrefs: 003B8420
T`T, xrefs: 003B8566
Code returned to Windows by setup:, xrefs: 003B8121
T`T, xrefs: 003B8137
h[L, xrefs: 003B8EB8
AI_BOOTSTRAPPERLANGS, xrefs: 003B8E29, 003B8E3B, 003B8E45
Language selected programatically for UI:, xrefs: 003B8552
T`T, xrefs: 003B84B0
A valid language was received from commnad line. This is:, xrefs: 003B82AF
>L, xrefs: 003B880C
T`T, xrefs: 003B90AC
T`T, xrefs: 003B832E
Language used for UI:, xrefs: 003B85CE
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 003B8434
WL, xrefs: 003B8761
hM, xrefs: 003B7F8D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EventInit_thread_footer$DeleteFileFindHeapProcessResource
String ID: WL$%hu$A valid language was received from commnad line. This is:$AI_BOOTSTRAPPERLANGS$Advinst_Extract_$Code returned to Windows by setup:$Language of a related product is:$Language selected programatically for UI:$Language used for UI:$Languages of setup:$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$Software\Caphyon\Advanced Installer\$T`T$T`T$T`T$T`T$T`T$T`T$h[L$hM$lMhM$>L
API String ID: 4144826820-3802258558
Opcode ID: 941135b35a92a514000031e7fe3bf4266b349bb1db16d2900626dd1ecc16fb2e
Instruction ID: 1b8a245208c6ca47c9e394b0ad25407c50174c2f11dc0a1682c7b2a5950fdd4b
Opcode Fuzzy Hash: 941135b35a92a514000031e7fe3bf4266b349bb1db16d2900626dd1ecc16fb2e
Instruction Fuzzy Hash: 4EE2C17090060ADFDB01DFA8C849BEEF7B9EF45318F158269E515EB292EB349D04CB91

Function 003DB350 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 551
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PackageCode, xrefs: 003DB69B
SELECT `Value` FROM `Property` WHERE `Property` = '%s', xrefs: 003DB3BE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: PackageCode$SELECT `Value` FROM `Property` WHERE `Property` = '%s'
API String ID: 0-2409377028
Opcode ID: e59404d4c22754609c40f48547e7ce7e7ad954f2f54edfb489d802dc5b370069
Instruction ID: 20145a162bd9bacdb0f17aa3f085fb9f65212a1a6c6886f1c80ce1bd623756c0
Opcode Fuzzy Hash: e59404d4c22754609c40f48547e7ce7e7ad954f2f54edfb489d802dc5b370069
Instruction Fuzzy Hash: 3B121072A00205DFDB11DF68EC49BAEBBB8EF45314F12412AF915AB391DB759904CFA0

Function 002BA950 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 877fileCOMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000), ref: 002BAA5F
PathIsUNCW.SHLWAPI(00000001,*.*), ref: 002BAAC3
FindFirstFileW.KERNEL32(00000001,?,*.*), ref: 002BAD0C
GetFullPathNameW.KERNEL32(00000001,00000000,00000000,00000000), ref: 002BAD26
GetFullPathNameW.KERNEL32(00000001,00000000,00000000,00000000), ref: 002BAD5A
FindClose.KERNEL32(00000000), ref: 002BADCB
SetLastError.KERNEL32(0000007B), ref: 002BADD5
PathIsUNCW.SHLWAPI(?,?,E48E37CD,?,00000000), ref: 002BB00E

Strings

\\?\, xrefs: 002BAC1A, 002BACD0, 002BB155, 002BB209
*.*, xrefs: 002BAA8A, 002BAA94
\\?\UNC\, xrefs: 002BAAE3, 002BABFF, 002BB02E, 002BB13A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Path$Find$CloseFullName$ErrorFileFirstLast
String ID: *.*$\\?\$\\?\UNC\
API String ID: 2310598285-1700010636
Opcode ID: 5be5e4ed95cf890dbbc5723a5b11dc34d26d07c8dc91de2961cb5f82d4f2b336
Instruction ID: ade5b97af82254a523537e3a12c7a5f27fc78e014e31c2ffe4ff9cd4e0f5b1f5
Opcode Fuzzy Hash: 5be5e4ed95cf890dbbc5723a5b11dc34d26d07c8dc91de2961cb5f82d4f2b336
Instruction Fuzzy Hash: AD622231A106069FDB14DF68C888BAEB7B5FF44350F148669E815DB3A1EB70ED60CB90

Function 003CEAB0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 003CEAF8
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 003CEB05
GetLastError.KERNEL32 ref: 003CEB0F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?), ref: 003CEB39
GetLastError.KERNEL32 ref: 003CEB3F
GetTokenInformation.KERNELBASE(00000000,00000001(TokenIntegrityLevel),?,?,?,?), ref: 003CEB65
AllocateAndInitializeSid.ADVAPI32(00000000,00000001,00000012,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 003CEB98
EqualSid.ADVAPI32(00000000,?), ref: 003CEBA7
FreeSid.ADVAPI32(?), ref: 003CEBB6
CloseHandle.KERNEL32(00000000), ref: 003CEBF0

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Token$ErrorInformationLastProcess$AllocateCloseCurrentEqualFreeHandleInitializeOpen
String ID:
API String ID: 695978879-0
Opcode ID: 26f04890822572305ee85e5250293df1297363cbd507c21563af3b98b000abb8
Instruction ID: 6643928f9331394e09c0f039f39398317f882beea63365999d6fa03262cc769e
Opcode Fuzzy Hash: 26f04890822572305ee85e5250293df1297363cbd507c21563af3b98b000abb8
Instruction Fuzzy Hash: FC414A75900219ABDF119FA0CC49FEEBBB8FF19318F104129E411B2290DB799E08DF64

Function 003C14D0 Relevance: 15.7, APIs: 10, Instructions: 749COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: dcc224252ca2f52ddf76385dd0a46c3ffd0bfd486760358e0547573639ee9f06
Instruction ID: c7de9d142a1710dadbd09553054987f2a26fc2ffcadcb5c4b4493507f98eef93
Opcode Fuzzy Hash: dcc224252ca2f52ddf76385dd0a46c3ffd0bfd486760358e0547573639ee9f06
Instruction Fuzzy Hash: 6162AE30900649CFDB12DFA8C884B9EBBF5BF46314F1582ADE415EB292DB70AE45DB50

Function 003C4050 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

GetLocaleInfoW.KERNEL32(?,00000002,004C337C,00000000), ref: 003C40C1
GetLocaleInfoW.KERNEL32(?,00000002,003C3B85,-00000001,00000078,-00000001), ref: 003C40FD
MsgWaitForMultipleObjectsEx.USER32(00000001,?,000000FF,000005FF,00000004), ref: 003C4181
PeekMessageW.USER32(?,00000000), ref: 003C41C7
TranslateMessage.USER32(00000000), ref: 003C41D2
DispatchMessageW.USER32(00000000), ref: 003C41D9
MsgWaitForMultipleObjectsEx.USER32(00000001,00000000,000000FF,000005FF,00000004), ref: 003C41EB

Strings

%d-%s, xrefs: 003C4107

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Message$InfoInit_thread_footerLocaleMultipleObjectsWait$DispatchHeapPeekProcessTranslate
String ID: %d-%s
API String ID: 445213441-1781338863
Opcode ID: 6fe3be321cf6e7a69f23c55d9cd58ee2c9baefd77d547ec98f4d90f2362ae4eb
Instruction ID: 9239e2c6252ae8cdccf1514f1d2f1e32b50807c4f0f3d599bd8b7f1fe6602dd8
Opcode Fuzzy Hash: 6fe3be321cf6e7a69f23c55d9cd58ee2c9baefd77d547ec98f4d90f2362ae4eb
Instruction Fuzzy Hash: 99510171A40305ABEB10DF98CC45FAEBBB8EF49724F10462AF614E72C1DB719945CBA0

Function 003A2350 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 85
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(ComCtl32.dll,E48E37CD,00000000,?,00000000), ref: 003A238E
GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 003A23B1
FreeLibrary.KERNEL32(00000000), ref: 003A242F

Strings

,(M, xrefs: 003A2423
ComCtl32.dll, xrefs: 003A2382
LoadIconMetric, xrefs: 003A23AB
=-C, xrefs: 003A23DD

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: ,(M$=-C$ComCtl32.dll$LoadIconMetric
API String ID: 145871493-272048232
Opcode ID: 17edd0bee53898bbc283a295756d47707ca7c01134e9ffe729bf0111f1531e74
Instruction ID: e771bd8318fe5a29a173bd1d5f0eee7a00a26f52f0c4d24f1bee9e32736d4c44
Opcode Fuzzy Hash: 17edd0bee53898bbc283a295756d47707ca7c01134e9ffe729bf0111f1531e74
Instruction Fuzzy Hash: 1831C571900218ABDF158F99CC44BAFBFF8EB09750F11422AF915A7280C7B88D04CB90

Function 003DA240 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 003DA2CE
GetLastError.KERNEL32 ref: 003DA2D4
GetUserNameW.ADVAPI32(00000000,?), ref: 003DA31C
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 003DA352
GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 003DA39C

Strings

UserDomain, xrefs: 003DA34D, 003DA397

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EnvironmentNameUserVariable$ErrorLast
String ID: UserDomain
API String ID: 3567734997-2275544873
Opcode ID: 824a3313255c28266955b90e74593c420c8c1b93e82eda1f16bc595d4808d05b
Instruction ID: 4d0dc208c9b0377cb076cef4d0648485325fa018d038c8c1f40e8cd220bf427c
Opcode Fuzzy Hash: 824a3313255c28266955b90e74593c420c8c1b93e82eda1f16bc595d4808d05b
Instruction Fuzzy Hash: 74611571A10209DFDF14DFA8C955BEEBBB5FF08304F24412EE401A7280DB75AA49CBA5

Function 00361FB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 228libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00361FF1

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

_wcschr.LIBVCRUNTIME ref: 003620AF

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

LoadLibraryExW.KERNEL32(?,00000000,00000000,-00000010), ref: 003620C4

Strings

Kernel32.dll, xrefs: 00361FCC, 0036209F, 003620A0, 00362134

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$DirectoryFindHeapLibraryLoadProcessResourceSystem_wcschr
String ID: Kernel32.dll
API String ID: 1122257418-1926710522
Opcode ID: ec548d10ec0ca4040655dae79e8ddc99b9715e2a2d365e3404716bda9a6179ea
Instruction ID: ff97e46a133d5d903c56074839b587db7680f89ef3a391339edf4ac7cc5fd2d6
Opcode Fuzzy Hash: ec548d10ec0ca4040655dae79e8ddc99b9715e2a2d365e3404716bda9a6179ea
Instruction Fuzzy Hash: E4A17AB0500A45EFE714CF64C818B9ABBF4FF04318F21865DE8199B781D7BAA618CF90

Function 003CC990 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 125COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 003CCA6A

Strings

\, xrefs: 003CCA0E
\, xrefs: 003CC9E4
\, xrefs: 003CC9EC

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DiskFreeSpace
String ID: \$\$\
API String ID: 1705453755-3791832595
Opcode ID: 862b03ffaac8b93e423beee9eaefd385bd1e512b08707cd6064914fde282921f
Instruction ID: e4ba898e5e627aca03687ae40b76e29acc269dbbe17fea1a993961dfb762c93c
Opcode Fuzzy Hash: 862b03ffaac8b93e423beee9eaefd385bd1e512b08707cd6064914fde282921f
Instruction Fuzzy Hash: 0E41E2369242598ACB31DF248449FABB3E4FF98354F166A2EE8CDD3140E7709C858786

Function 00435D0D Relevance: 5.0, APIs: 4, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000008,?,002B0DC7,?,?,002B0B74,?), ref: 00435D12
HeapAlloc.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435D19
GetProcessHeap.KERNEL32(00000000,00000000,?,?,002B0B74,?), ref: 00435D5F
HeapFree.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435D66

Part of subcall function 00435BAB: GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00435D55,00000000,?,?,002B0B74,?), ref: 00435BCF
Part of subcall function 00435BAB: HeapAlloc.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435BD6

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$Process$Alloc$Free
String ID:
API String ID: 1864747095-0
Opcode ID: d70353475e97cbee9786dc8f7126c3896f671305edd0f1b4edd8b5105cd3d2f5
Instruction ID: b9167b618dbebd781c97ae4aa0be5ccffa62cb3715c13f970078580f241382e1
Opcode Fuzzy Hash: d70353475e97cbee9786dc8f7126c3896f671305edd0f1b4edd8b5105cd3d2f5
Instruction Fuzzy Hash: 00F0B432644F1257DB253FB8BC0CA5B2A6DAF887A1B02952EF106C6254DE24C8018B69

Function 003A43B0 Relevance: 4.6, APIs: 3, Instructions: 92fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 003A444F
FindClose.KERNEL32(00000000), ref: 003A44AE

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID:
API String ID: 1673784098-0
Opcode ID: 6afbdae409ba650d583df28331725000677220f1949f7c97e39001944862f509
Instruction ID: 61c80d62f4d925e64d6b93bea0237efa01f8d15cc0494d5306dd2cb23528215c
Opcode Fuzzy Hash: 6afbdae409ba650d583df28331725000677220f1949f7c97e39001944862f509
Instruction Fuzzy Hash: FA310134904218DBCB29DF56CC49BAAB7F8FB89314F20866EE91997780D7B15D44CF90

Function 003C2380 Relevance: 3.4, APIs: 2, Instructions: 374COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$HeapProcess
String ID:
API String ID: 275895251-0
Opcode ID: df3c1975f4f9396fd96e3fa240acf8a43fdc75c644b6f6eea26a08b182f7ccee
Instruction ID: ead4f4914fdbad1864a70825c5062c511dac662f053da2fc645617b1fa2d96f5
Opcode Fuzzy Hash: df3c1975f4f9396fd96e3fa240acf8a43fdc75c644b6f6eea26a08b182f7ccee
Instruction Fuzzy Hash: 2FE16B30A006499FDB15DFA8CC84BAEB7B4FF45324F15826DE815EB292EB74AD05CB50

Function 003A3DE0 Relevance: 3.1, APIs: 2, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab0a0a03774e3f339443e652e74dd578a51b63ecf758d90c12524eb5377d2ef
Instruction ID: b03019cbbc9fc111db566e77c5b53fc4fcaa6774413e1ea3873e65e49370e0a8
Opcode Fuzzy Hash: fab0a0a03774e3f339443e652e74dd578a51b63ecf758d90c12524eb5377d2ef
Instruction Fuzzy Hash: 25416A319116499FDB25DF68C955BEAB3B4FF11320F158229F8259B2D1EB709A04CB50

Function 003DBB20 Relevance: 3.1, APIs: 2, Instructions: 85filepipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNEL32(?,00000003,00000006,000000FF,00007F90,00007F90,00001388,00000000,?,E48E37CD,E48E37CD,?,?,?,00000000,004A6015), ref: 003DBBA8
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,00000000,00000000,?,E48E37CD,E48E37CD,?,?,?,00000000,004A6015,000000FF), ref: 003DBBCA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Create$FileNamedPipe
String ID:
API String ID: 1328467360-0
Opcode ID: cd99dbc46657440778918d31a3dd02d0cc28bd3cfdd292c9853a7996aa537c2d
Instruction ID: 2347618cd2958c3bee1a3582f1938623d9adc4c537c198fc3d4801e8f16736de
Opcode Fuzzy Hash: cd99dbc46657440778918d31a3dd02d0cc28bd3cfdd292c9853a7996aa537c2d
Instruction Fuzzy Hash: 1331D232684745AFD721CF14DC01B96FBA4EB05720F10866FF9A5AB7D0DB71A900CB54

Function 002D21E0 Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__set_se_translator.LIBVCRUNTIME ref: 002D21F8
SetUnhandledExceptionFilter.KERNEL32(003A0760), ref: 002D220E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ExceptionFilterUnhandled__set_se_translator
String ID:
API String ID: 2480343447-0
Opcode ID: 79645cdaea69249484209b51883589b9bb785e2cda25f8a8b64a949d6e9b2db7
Instruction ID: ff3de18d4411090d646aa115f89d8353ddddaad96d37660085ef024d308c2fef
Opcode Fuzzy Hash: 79645cdaea69249484209b51883589b9bb785e2cda25f8a8b64a949d6e9b2db7
Instruction Fuzzy Hash: 9BE0267A9002006AC7125755AC0AF8A3F64EBA7715F05501EF60813152C774680CC762

Function 003E6D50 Relevance: 1.5, APIs: 1, Instructions: 49comCOMMON

Download Yara Rule

APIs

Part of subcall function 003A2890: __Init_thread_footer.LIBCMT ref: 003A2970

CoCreateInstance.COMBASE(004C31D8,00000000,00000001,004DF490,000000B0), ref: 003E6DCE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateInit_thread_footerInstance
String ID:
API String ID: 3436645735-0
Opcode ID: c67f2992a774d842a08631dbc19f24f6b7d0da08d9f805ab0f63db6503fdb322
Instruction ID: 3b8e63ea2f48a8274186c21c8dd03544fc348a8cc3036b47c0d574a20114c740
Opcode Fuzzy Hash: c67f2992a774d842a08631dbc19f24f6b7d0da08d9f805ab0f63db6503fdb322
Instruction Fuzzy Hash: 37118B75604745EBD720CF59DC05B8BBBF8EB46B14F10465EE8159B7C0C7BAA508CB90

Function 003E15E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$CreateHeapInstanceProcess
String ID:
API String ID: 3807588171-0
Opcode ID: 5e684dd511809c0392f507b20edb85bc5ec7ff24135a18fd48c09132cd920003
Instruction ID: 56bfe3b77115ffa9492b4a8e955ea16508900fdcbfe9b129e81128291bcb851e
Opcode Fuzzy Hash: 5e684dd511809c0392f507b20edb85bc5ec7ff24135a18fd48c09132cd920003
Instruction Fuzzy Hash: E76167B1500744CFE760CF65C55838ABBE0FF05308F148A5ED48A9B782DBB9AA49CF90

Function 003A2BA0 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 003A2C0E
RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 003A2C55
RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 003A2C74
RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 003A2CA3
RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 003A2D18
RegQueryValueExW.ADVAPI32(00000000,BuildBranch,00000000,00000000,?,?), ref: 003A2D81
RegQueryValueExW.KERNEL32(00000000,ReleaseId,00000000,00000000,?,?), ref: 003A2DE4
RegQueryValueExW.KERNEL32(00000000,CSDVersion,00000000,00000000,?,?), ref: 003A2E36
GetModuleHandleW.KERNEL32(kernel32,IsWow64Process), ref: 003A2ED3
GetProcAddress.KERNEL32(00000000), ref: 003A2EDA
__Init_thread_footer.LIBCMT ref: 003A2EEE
GetCurrentProcess.KERNEL32(?), ref: 003A2F11
IsWow64Process.KERNEL32(00000000), ref: 003A2F18
RegCloseKey.ADVAPI32(00000000), ref: 003A2F52

Strings

co_release, xrefs: 003A2D89
CurrentVersion, xrefs: 003A2C98
ReleaseId, xrefs: 003A2DD9
Software\Microsoft\Windows NT\CurrentVersion, xrefs: 003A2C04
rs_prerelease, xrefs: 003A2DA1
CurrentMajorVersionNumber, xrefs: 003A2C4A
IsWow64Process, xrefs: 003A2EC9
BuildBranch, xrefs: 003A2D76
CurrentBuildNumber, xrefs: 003A2D0D
kernel32, xrefs: 003A2ECE
CSDVersion, xrefs: 003A2E2B
CurrentMinorVersionNumber, xrefs: 003A2C69

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: QueryValue$Process$AddressCloseCurrentHandleInit_thread_footerModuleOpenProcWow64
String ID: BuildBranch$CSDVersion$CurrentBuildNumber$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$IsWow64Process$ReleaseId$Software\Microsoft\Windows NT\CurrentVersion$co_release$kernel32$rs_prerelease
API String ID: 1906320730-525127412
Opcode ID: be09604c9ff602dcd39cba4a5ffaf1b6571c757462e7ebb9349b6f55f3ac46e3
Instruction ID: dcd5da143786ef7d668e07f37a75fe8cfc54fc3e4c0c95f275e2b50d87edb4c3
Opcode Fuzzy Hash: be09604c9ff602dcd39cba4a5ffaf1b6571c757462e7ebb9349b6f55f3ac46e3
Instruction Fuzzy Hash: A8A19175900328DEDB21DF24CC45BDAB7F8FB16705F1181AAE448E6290EB749E88CF95

Function 003C4960 Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Init_thread_footer.LIBCMT ref: 003C49DC

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Part of subcall function 002B2970: RaiseException.KERNEL32(?,?,00000000,00000000,00435A3C,C000008C,00000001,?,00435A6D,00000000,?,002A91C7,00000000,E48E37CD,00000001,?), ref: 002B297C

__Init_thread_footer.LIBCMT ref: 003C4A2C

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

Strings

Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86, xrefs: 003C4B03
SHGetFolderPathW, xrefs: 003C6707
ProgramFilesFolder, xrefs: 003C68E7
ProgramW6432, xrefs: 003C6064
Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64, xrefs: 003C4A64
hiT, xrefs: 003C66F3
AppDataFolder, xrefs: 003C69C8, 003C6A05
TempFolder, xrefs: 003C64BF
WindowsFolder, xrefs: 003C6344, 003C6359, 003C6363
System32Folder, xrefs: 003C625D, 003C6272, 003C627C
WindowsVolume, xrefs: 003C6424, 003C6439, 003C6443
APPDATA, xrefs: 003C6A57, 003C6A5F
ProgramFiles, xrefs: 003C6960, 003C6975, 003C697D
ProgramFiles64Folder, xrefs: 003C6008
PROGRAMFILES, xrefs: 003C6A3D
XiT, xrefs: 003C4BCB
SETUPEXEDIR, xrefs: 003C654C
Shell32.dll, xrefs: 003C68A3
YT, xrefs: 003C6584, 003C65FC, 003C6606
Shlwapi.dll, xrefs: 003C6877
shfolder.dll, xrefs: 003C66D6
`iT, xrefs: 003C4BE4
SystemFolder, xrefs: 003C613F, 003C6154, 003C615E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AllocateConditionExceptionHeapRaiseVariableWake
String ID: YT$APPDATA$AppDataFolder$PROGRAMFILES$ProgramFiles$ProgramFiles64Folder$ProgramFilesFolder$ProgramW6432$SETUPEXEDIR$SHGetFolderPathW$Shell32.dll$Shlwapi.dll$System32Folder$SystemFolder$TempFolder$Windows 9x/ME/NT/2000/XP/Vista/Windows 7/Windows 8 x86/Windows 8.1 x86/Windows 10 x86$Windows XP/Vista/Windows 7/Windows 8 x64/Windows 8.1 x64/Windows 10 x64/Windows 11 x64$WindowsFolder$WindowsVolume$XiT$`iT$hiT$shfolder.dll
API String ID: 2519272855-361132733
Opcode ID: 6a07aed4a837f82e3ec1d5485d8756a675893be16ff50d8ff0cf70152254165e
Instruction ID: ec960e1fd6eb505799ccf5f4b7fd5dbead8a612e3f7a1996584ac5541805ba23
Opcode Fuzzy Hash: 6a07aed4a837f82e3ec1d5485d8756a675893be16ff50d8ff0cf70152254165e
Instruction Fuzzy Hash: 247144719002069BDB11EBA8C866FBEB3B0AF21314F12856DE466DB291EB75DD04CB52

Function 003A2F80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,SYSTEM\CurrentControlSet\Control\ProductOptions,00000000,00020119,00000000), ref: 003A2FF0
RegQueryValueExW.KERNEL32(00000000,ProductType,00000000,00000000,?), ref: 003A302B
RegQueryValueExW.KERNEL32(00000000,ProductSuite,00000000,00000000,?,?), ref: 003A30A6
RegCloseKey.KERNEL32(00000000), ref: 003A327E

Strings

ProductSuite, xrefs: 003A309B
ProductType, xrefs: 003A3020
Small Business(Restricted), xrefs: 003A315D
DataCenter, xrefs: 003A318F
Compute Server, xrefs: 003A321C
WinNT, xrefs: 003A3031
Enterprise, xrefs: 003A30F9
SYSTEM\CurrentControlSet\Control\ProductOptions, xrefs: 003A2FE6
Security Appliance, xrefs: 003A31EE
EmbeddedNT, xrefs: 003A3176
ServerNT, xrefs: 003A3054
CommunicationServer, xrefs: 003A312B
Personal, xrefs: 003A31A9
BackOffice, xrefs: 003A3112
Blade, xrefs: 003A31C0
Small Business, xrefs: 003A30E0
Terminal Server, xrefs: 003A3144
Storage Server, xrefs: 003A3205
Embedded(Restricted), xrefs: 003A31D7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: BackOffice$Blade$CommunicationServer$Compute Server$DataCenter$Embedded(Restricted)$EmbeddedNT$Enterprise$Personal$ProductSuite$ProductType$SYSTEM\CurrentControlSet\Control\ProductOptions$Security Appliance$ServerNT$Small Business$Small Business(Restricted)$Storage Server$Terminal Server$WinNT
API String ID: 1586453840-3149529848
Opcode ID: 0cde222daf51590a500e7b992e6c7668d7203057d835759ffb13f715c9d9fa95
Instruction ID: 47b6b87bf06f6db0f60f89adab00596113b5e1c82f0be77e2a97ce80ec9b1d8f
Opcode Fuzzy Hash: 0cde222daf51590a500e7b992e6c7668d7203057d835759ffb13f715c9d9fa95
Instruction Fuzzy Hash: 4D71D6347003499BDB229B24CC557EA7269EB53344F1184BBF906AB781EB3CCE49DB46

Function 003B64D0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 495
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

GetTickCount.KERNEL32 ref: 003B6554
__Xtime_get_ticks.LIBCPMT ref: 003B655C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003B65A6
__Init_thread_footer.LIBCMT ref: 003B67A1
GetCurrentProcess.KERNEL32 ref: 003B6B06
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 003B6B16
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,?), ref: 003B6B42
CloseHandle.KERNEL32(00000000), ref: 003B6B83

Strings

\/:*?"<>|, xrefs: 003B6763
tiT, xrefs: 003B67F7
tiT, xrefs: 003B675C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footerProcess$Token$CloseCountCurrentHandleHeapInformationOpenTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|$tiT$tiT
API String ID: 3363527671-2398237601
Opcode ID: 2a7de1454afc864e34751d710422b55bc1f2f7d133c427a0bb3d2e527e560d9f
Instruction ID: 6e8f355544f75073c08e51df0487c2e6a5499cda9ac6923cd74ced640108ef99
Opcode Fuzzy Hash: 2a7de1454afc864e34751d710422b55bc1f2f7d133c427a0bb3d2e527e560d9f
Instruction Fuzzy Hash: 1022BF70900218DFDB10DF68CC56BEEBBB4BF55308F148199E509AB692DBB85E48CF91

Function 003DF7B0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,?,003C181B,?,?,?,?,?), ref: 003DF7C5

Strings

ExtractAllFiles, xrefs: 003DF817
,(M, xrefs: 003DF7D7, 003DF7DD
GetTotalFilesSize, xrefs: 003DF805
InitExtraction, xrefs: 003DF7FD
EndExtraction, xrefs: 003DF829

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: LibraryLoad
String ID: ,(M$EndExtraction$ExtractAllFiles$GetTotalFilesSize$InitExtraction
API String ID: 1029625771-1726033602
Opcode ID: 4ebb35e1abc825f1048a5fd2f268c0e181e81ba94b0ef0e4bfd0da827b9030d8
Instruction ID: 96e21594481e8cec4e4d42fb43e9db477e96aef383d553d2f330605d53b40edb
Opcode Fuzzy Hash: 4ebb35e1abc825f1048a5fd2f268c0e181e81ba94b0ef0e4bfd0da827b9030d8
Instruction Fuzzy Hash: 8C015A7AD04611AFCF259F28AC189867FA0BB2535A701853BF91387336D7358819EF90

Function 0038DDA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,E48E37CD,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 0038DDE3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 0038DE0C
RegCreateKeyExW.KERNEL32(?,)r+,00000000,00000000,00000000,?,00000000,00000000,?,E48E37CD,?,?,?,00000000,?,Function_001BDD00), ref: 0038DE59
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 0038DE6C

Strings

)r+, xrefs: 0038DDBD, 0038DDF2
RegCreateKeyTransactedW, xrefs: 0038DE06
)r+, xrefs: 0038DE53, 0038DE2B
Advapi32.dll, xrefs: 0038DDDE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: )r+$)r+$Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1765684683-1687898342
Opcode ID: afad19b04936717f4a90a49a8fcf28e3bc5fd20cc22c863f35b50df93532720b
Instruction ID: 8f9a2d35019ffe5bbeafc4be7fcfa1441ba317303277ffaa9f9d447a2471fe4e
Opcode Fuzzy Hash: afad19b04936717f4a90a49a8fcf28e3bc5fd20cc22c863f35b50df93532720b
Instruction Fuzzy Hash: 3331B172640309AFEB259F44DC45FABBBA8FB54B50F10416AF905DB2C0E771A804CB94

Function 00435A9F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DecodePointer.KERNEL32(?,?,?,00435DE5,00544C90,?,?,?,003000E6,?,E48E37CD,?,?,?,003481B7), ref: 00435AB1
LoadLibraryExA.KERNEL32(atlthunk.dll,00000000,00000800,?,?,?,00435DE5,00544C90,?,?,?,003000E6,?,E48E37CD,?,?), ref: 00435AC6
DecodePointer.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,003481B7), ref: 00435B42

Strings

AtlThunk_InitData, xrefs: 00435AEE
AtlThunk_DataToCode, xrefs: 00435B05
AtlThunk_FreeData, xrefs: 00435B1C
AtlThunk_AllocateData, xrefs: 00435AD7
atlthunk.dll, xrefs: 00435AC1

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DecodePointer$LibraryLoad
String ID: AtlThunk_AllocateData$AtlThunk_DataToCode$AtlThunk_FreeData$AtlThunk_InitData$atlthunk.dll
API String ID: 1423960858-1745123996
Opcode ID: 64c0b32251a3ebf60d4e63b6da2560a1c5c011453450cbec620fce50504fcdd8
Instruction ID: 2725421b7ac5a6be10570caead4b3e6b0a580b7039691893a46c7e785b691ad3
Opcode Fuzzy Hash: 64c0b32251a3ebf60d4e63b6da2560a1c5c011453450cbec620fce50504fcdd8
Instruction Fuzzy Hash: E401DB70642700BBCB21A7109C43FDABB595B1574EF280056FE06773D1DA59ED09C5AD

Function 003C2810 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 224
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000), ref: 003C29D1
SetFilePointer.KERNEL32(?,7FFFFFFF,00000000,00000000,?), ref: 003C2A30
SetEndOfFile.KERNEL32(?), ref: 003C2A39
CloseHandle.KERNEL32(?), ref: 003C2A52

Strings

%sholder%d.aiph, xrefs: 003C29AD
T`T, xrefs: 003C290C
Not enough disk space to extract file:, xrefs: 003C28DB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$CloseCreateHandlePointer
String ID: %sholder%d.aiph$Not enough disk space to extract file:$T`T
API String ID: 22866420-1111458124
Opcode ID: 98c047293673383d47a25abd1594ff0177e5f1616db58325940a5ea84049b76f
Instruction ID: 40df49cbfbc5c0b5327d7f3b04561f0372e2cda521e6246943fb0440af2ba05c
Opcode Fuzzy Hash: 98c047293673383d47a25abd1594ff0177e5f1616db58325940a5ea84049b76f
Instruction Fuzzy Hash: 6081BC75A002099FDB11DF68CC45FAFBBA4EF49320F15862DE925EB291EB319D11CB90

Function 003E0BE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 003A29D0: __Init_thread_footer.LIBCMT ref: 003A2AA2

SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,E48E37CD,00000000,00000000), ref: 003E0C34
GetTempPathW.KERNEL32(00000104,?), ref: 003E0CC9
GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 003E0CFA
Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 003E0D2D
CopyFileW.KERNEL32(?,?,00000000), ref: 003E0D4F
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 003E0D7E

Strings

shim_clone, xrefs: 003E0CEE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Wow64$FilePathRedirectionTemp$CopyDisableFolderInit_thread_footerNameRevert
String ID: shim_clone
API String ID: 4264308349-3944563459
Opcode ID: 15c4637dbb3a0a62cb04309144c6f3231b9e165b7110f98c5495831135990e26
Instruction ID: 1ddf0c6c89a8eb913c12f92f551aa206737ecebe037d3ed944fde4752fbe65fa
Opcode Fuzzy Hash: 15c4637dbb3a0a62cb04309144c6f3231b9e165b7110f98c5495831135990e26
Instruction Fuzzy Hash: 4D514930A402689BDB29DF65CC05BAEB7F9EF94700F1442A9E405A72C1DBB49F84CB90

Function 003DF2F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,-00000400,?,00000002,00000400,E48E37CD,?,?,?,?,?), ref: 003DF396
GetLastError.KERNEL32(?,?,?,?), ref: 003DF3A4
ReadFile.KERNEL32(?,00000000,00000400,000000FF,00000000,?,?,?,?), ref: 003DF3BF

Strings

ADVINSTSFX, xrefs: 003DF3F3, 003DF4AE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID: ADVINSTSFX
API String ID: 64821003-4038163286
Opcode ID: 921ceabcb563a6e1d12e3c81247cc9075bf4e47db09f574a558579c3698c3884
Instruction ID: e98687b64469fd75a8bf29665770f30c5ca8845ee194506239a492ba585ae0d8
Opcode Fuzzy Hash: 921ceabcb563a6e1d12e3c81247cc9075bf4e47db09f574a558579c3698c3884
Instruction Fuzzy Hash: 3561E272A001089FDB12CF69D881BBFBBB9FF45324F658226E506A7381D7349D01CB64

Function 002B27B1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,00000024), ref: 002B2850
GetWindowLongW.USER32(?,000000FC), ref: 002B2865
CallWindowProcW.USER32(?,?,00000082,?,00000024), ref: 002B287B
GetWindowLongW.USER32(?,000000FC), ref: 002B2895
SetWindowLongW.USER32(?,000000FC,?), ref: 002B28A5

Strings

$, xrefs: 002B27F9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$CallProc
String ID: $
API String ID: 513923721-3993045852
Opcode ID: 868143e6db9212836e062296bdd953d8b83238980b91c58759cfd6f4e2be609a
Instruction ID: 3a888ccd5dca665fb265d5f3d1c8aa38a3f8cb6b2072f65523e7c2dcbb5f7dbd
Opcode Fuzzy Hash: 868143e6db9212836e062296bdd953d8b83238980b91c58759cfd6f4e2be609a
Instruction Fuzzy Hash: 9B412271508700AFC720DF19D884A5BBBF5FF99764F104A1DF5A6836A0D772E8488F61

Function 0036D900 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,E48E37CD,?,?,?,?,?,Function_001BDD00,000000FF,?,0039EE1C,?,?,000000FF), ref: 0036D943
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 0036D96C
RegOpenKeyExW.KERNEL32(?,E48E37CD,00000000,?,00000000,E48E37CD,?,?,?,?,?,Function_001BDD00,000000FF,?,0039EE1C,?), ref: 0036D9A5
RegCloseKey.ADVAPI32(00000000,?,?,?,Function_001BDD00,000000FF,?,0039EE1C,?,?,000000FF), ref: 0036D9B8

Strings

RegOpenKeyTransactedW, xrefs: 0036D966
Advapi32.dll, xrefs: 0036D93E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 823179699-3913318428
Opcode ID: 007ff142a88f23254849e7d892674f02f230c1a7a4d486f3af4609c4d8b50b12
Instruction ID: 7b1c2d6cd495dafde09a109d692e6e372f5249360a4c596316d48fbc389f8ee0
Opcode Fuzzy Hash: 007ff142a88f23254849e7d892674f02f230c1a7a4d486f3af4609c4d8b50b12
Instruction Fuzzy Hash: 6A21B272B04205EFDB158F45DC45BAABBF8FB45750F14852AF819D7284E775A800CB54

Function 003BD210 Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000002), ref: 003BD230
GetWindowRect.USER32(00000000,?), ref: 003BD246
ShowWindow.USER32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,003BCFF7,?,00000000), ref: 003BD25F
InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,003BCFF7,?), ref: 003BD26A
GetDlgItem.USER32(?,000003E9), ref: 003BD27C
GetWindowRect.USER32(00000000,?), ref: 003BD292
SetWindowPos.USER32(00000000,00000000,?,?,?,?,00000206), ref: 003BD2D8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Rect$Item$InvalidateShow
String ID:
API String ID: 2147159307-0
Opcode ID: ea10acb397e177c2ffe15a561b44d2e0e3482c8ec20c3d5d086a80de2bea5209
Instruction ID: 00afb482a80b491883dde4f6342b5aa82f7362b3e5aec5c592ca5b281353c107
Opcode Fuzzy Hash: ea10acb397e177c2ffe15a561b44d2e0e3482c8ec20c3d5d086a80de2bea5209
Instruction Fuzzy Hash: 2B215A74654300AFD700DF24DC49BAABBE9EF89308F10861DF9599A291E770E949CF52

Function 003C0FF0 Relevance: 9.4, APIs: 6, Instructions: 354fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,E48E37CD,?,?,00000002,?,?,?,?,?,?,00000000,004A0932), ref: 003C1047
GetLastError.KERNEL32(?,00000002), ref: 003C12D9
GetLastError.KERNEL32(?,00000002), ref: 003C1383
GetLastError.KERNEL32(?,00000002,?,?,?,?,?,?,00000000,004A0932,000000FF,?,003BFF4A,00000010), ref: 003C1056

Part of subcall function 003A2230: FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,E48E37CD,00000008,00000000), ref: 003A227B
Part of subcall function 003A2230: GetLastError.KERNEL32 ref: 003A2285

ReadFile.KERNEL32(?,00000000,00000008,80070057,00000000,?,00000002), ref: 003C1118
ReadFile.KERNEL32(?,E48E37CD,00000000,00000000,00000000,00000001,?,00000002), ref: 003C1195

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$File$Read$FormatMessagePointer
String ID:
API String ID: 3903527278-0
Opcode ID: 1388b7e873be1192317984826a9538a94cd6a8929306dbdb2c1daaaa758aca25
Instruction ID: 0946ba0401dee19221e2be40097ac3e7f07b2f156466f3568f1eb2ab695c1d5f
Opcode Fuzzy Hash: 1388b7e873be1192317984826a9538a94cd6a8929306dbdb2c1daaaa758aca25
Instruction Fuzzy Hash: 52D19F71D00209DFDB01DFA8C885BAEB7B5FF46314F148669E815EB292EB74AD05CB90

Function 003BDCC0 Relevance: 9.1, APIs: 1, Strings: 4, Instructions: 326COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,E48E37CD,?,00000010,?), ref: 003BDF8A

Part of subcall function 003CEAB0: GetCurrentProcess.KERNEL32 ref: 003CEAF8
Part of subcall function 003CEAB0: OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 003CEB05
Part of subcall function 003CEAB0: GetLastError.KERNEL32 ref: 003CEB0F
Part of subcall function 003CEAB0: CloseHandle.KERNEL32(00000000), ref: 003CEBF0

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

Strings

[WindowsVolume], xrefs: 003BDD50, 003BDD62, 003BDD6C
Extraction path set to:, xrefs: 003BDFDD
T`T, xrefs: 003BE00E
\\?\, xrefs: 003BDF97

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Process$Init_thread_footer$CloseCurrentErrorFindHandleHeapLastOpenPathResourceToken
String ID: Extraction path set to:$T`T$[WindowsVolume]$\\?\
API String ID: 699919280-3704992650
Opcode ID: 5017eafe2f5d29c522ddd5705894fe14b6f0d83f3d76f0af9d49dcb1384aa3e9
Instruction ID: e6c76e869f8aa0db04fbdda0c9d98d593a5c85cb2f2f04e45587c37f193577a3
Opcode Fuzzy Hash: 5017eafe2f5d29c522ddd5705894fe14b6f0d83f3d76f0af9d49dcb1384aa3e9
Instruction Fuzzy Hash: 52C1EF30A006069FDB01DFADC884BEEF7B4AF01318F158268E515AB292EB70DD45CBA1

Function 003E1080 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 208COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,E48E37CD,E48E37CD,?,00544C50,?,?,003C3989,?,E48E37CD,?,?,?,00000000,004A10D5), ref: 003E10E5
GetFileVersionInfoW.KERNELBASE(?,?,00000000,?,00000000,?,00544C50,?,?,003C3989,?,E48E37CD,?,?,?,00000000), ref: 003E1133

Strings

\StringFileInfo\%04x%04x\%s, xrefs: 003E119D
ProductName, xrefs: 003E1193
\VarFileInfo\Translation, xrefs: 003E1167

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: FileInfoVersion$Size
String ID: ProductName$\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 2104008232-2149928195
Opcode ID: df5a6be01fb7f08e778182bb0028d07fad1a2020e43b8c2aa7e9fdfaba48188e
Instruction ID: ebd0fb1a9f428adfc16c2540966a25c13e022eb859a9a6dd70178969b7cc3958
Opcode Fuzzy Hash: df5a6be01fb7f08e778182bb0028d07fad1a2020e43b8c2aa7e9fdfaba48188e
Instruction Fuzzy Hash: 8D71DD719001599BDB11DFAACC49BEEB7B8EF06314F15862AE911E72D1EB349D04CBA0

Function 003E0F70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003E0BE0: SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?,E48E37CD,00000000,00000000), ref: 003E0C34
Part of subcall function 003E0BE0: GetTempPathW.KERNEL32(00000104,?), ref: 003E0CC9
Part of subcall function 003E0BE0: GetTempFileNameW.KERNEL32(?,shim_clone,00000000,?), ref: 003E0CFA
Part of subcall function 003E0BE0: Wow64DisableWow64FsRedirection.KERNEL32(00000000,?), ref: 003E0D2D

GetFileVersionInfoSizeW.KERNELBASE(?,000000FF,Shlwapi.dll,E48E37CD,00000000,?,?,00000000,004A70A5,000000FF,Shlwapi.dll,003E0F26,?,?,00000010), ref: 003E0FBD
GetFileVersionInfoW.KERNELBASE(?,?,?,00000000,00000000,?,00000010), ref: 003E0FE9
GetLastError.KERNEL32(?,00000010), ref: 003E102E
DeleteFileW.KERNEL32(?), ref: 003E1041

Strings

Shlwapi.dll, xrefs: 003E0F70, 003E0FA8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$InfoPathTempVersionWow64$DeleteDisableErrorFolderLastNameRedirectionSize
String ID: Shlwapi.dll
API String ID: 1841109139-1687636465
Opcode ID: 990feb2b58708de9fec24703c1e36704c662c0ce7f88ef284c8949edb2843428
Instruction ID: 1ddd0c85f4033bed09bf207bdf073180eb2115344b76688bfefc6a1df1066415
Opcode Fuzzy Hash: 990feb2b58708de9fec24703c1e36704c662c0ce7f88ef284c8949edb2843428
Instruction Fuzzy Hash: FA31A471900259ABDB15DFA6DC44BEFFBB8FF09350F15422AE811A3280D7359E44CBA1

Function 003E0810 Relevance: 7.7, APIs: 5, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,E48E37CD,?,?,00000000,?,?,?,?,004A6FED,000000FF,?,003C1C3D), ref: 003E0850
CreateThread.KERNEL32(00000000,00000000,003E0BD0,?,00000000,?), ref: 003E0886
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003E098F
GetExitCodeThread.KERNEL32(00000000,?), ref: 003E099A
CloseHandle.KERNEL32(00000000), ref: 003E09BA

Part of subcall function 002B2970: RaiseException.KERNEL32(?,?,00000000,00000000,00435A3C,C000008C,00000001,?,00435A6D,00000000,?,002A91C7,00000000,E48E37CD,00000001,?), ref: 002B297C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateThread$CloseCodeEventExceptionExitHandleObjectRaiseSingleWait
String ID:
API String ID: 3595790897-0
Opcode ID: 19e00e52441ccb1afbc0062274d8ef06a91b402fb5f78718f4feffeb7ba303b4
Instruction ID: 831bac5697c4a4005ee9bb1e570014d0e362b08427b8cdf4ccb29f7dedec789d
Opcode Fuzzy Hash: 19e00e52441ccb1afbc0062274d8ef06a91b402fb5f78718f4feffeb7ba303b4
Instruction Fuzzy Hash: B4516974A00719DFDB14CF69C884BAEB7F4FF48710F254669E956A73A2D770A840CB50

Function 003A45A0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

PathIsUNCW.SHLWAPI(?,?), ref: 003A4736
_wcschr.LIBVCRUNTIME ref: 003A4752

Strings

\\?\, xrefs: 003A4718, 003A471E
\\?\UNC\, xrefs: 003A4631, 003A46A9, 003A46AF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$HeapPathProcess_wcschr
String ID: \\?\$\\?\UNC\
API String ID: 660126660-3019864461
Opcode ID: dde5496c5c28b9ad7d4806a3e7449b52c67e347c286bc284bfa398fad5590678
Instruction ID: 1a98255ae9b35ff7ba1ed6b89a23895cc68cb7861b47aa447892dfdb512aca13
Opcode Fuzzy Hash: dde5496c5c28b9ad7d4806a3e7449b52c67e347c286bc284bfa398fad5590678
Instruction Fuzzy Hash: C7C1C371A006499FDB01DBA8CC45BAEF7F8FF86310F148269E415EB2D1DB799904CBA0

Function 003B6660 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

Part of subcall function 003B64D0: GetTickCount.KERNEL32 ref: 003B6554
Part of subcall function 003B64D0: __Xtime_get_ticks.LIBCPMT ref: 003B655C
Part of subcall function 003B64D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 003B65A6

Part of subcall function 003DA240: GetUserNameW.ADVAPI32(00000000,?), ref: 003DA2CE
Part of subcall function 003DA240: GetLastError.KERNEL32 ref: 003DA2D4
Part of subcall function 003DA240: GetUserNameW.ADVAPI32(00000000,?), ref: 003DA31C
Part of subcall function 003DA240: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000), ref: 003DA352
Part of subcall function 003DA240: GetEnvironmentVariableW.KERNEL32(UserDomain,00000000,00000000,00000000,00000000), ref: 003DA39C

__Init_thread_footer.LIBCMT ref: 003B67A1

Strings

\/:*?"<>|, xrefs: 003B6763
tiT, xrefs: 003B67F7
tiT, xrefs: 003B675C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EnvironmentNameUserVariable$CountErrorInit_thread_footerLastTickUnothrow_t@std@@@Xtime_get_ticks__ehfuncinfo$??2@
String ID: \/:*?"<>|$tiT$tiT
API String ID: 2099558200-2398237601
Opcode ID: dce86b806caaaa7a58fc5798dd0d3dfbaba9b479f96113bfb6fa1c7626fed900
Instruction ID: 7fd2bc5b49a719eb1f74e84dec2aea9a804e88710cb1db3b7c9898a1599ad7f6
Opcode Fuzzy Hash: dce86b806caaaa7a58fc5798dd0d3dfbaba9b479f96113bfb6fa1c7626fed900
Instruction Fuzzy Hash: 5DD1AD70900258CBDB14DF64CC95BEDBBB0BF16308F14419DD409AB682DBB95E48CFA1

Function 003DC240 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 229filepipeCOMMON

Download Yara Rule

APIs

ConnectNamedPipe.KERNEL32(?,00000000,E48E37CD,?,000000FF,?,00000000,004A62A6,000000FF,?,003DC45A,000000FF,?,00000001), ref: 003DC27A
GetLastError.KERNEL32(?,003DC45A,000000FF,?,00000001), ref: 003DC284

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

ReadFile.KERNEL32(?,?,00007F90,00000000,00000000,E48E37CD,?,000000FF,?,00000000,004A62A6,000000FF,?,003DC45A,000000FF,?), ref: 003DC2C7

Strings

\\.\pipe\ToServer, xrefs: 003DC4E4, 003DC4F5, 003DC4FF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$ConnectErrorFileHeapLastNamedPipeProcessRead
String ID: \\.\pipe\ToServer
API String ID: 2973225359-63420281
Opcode ID: 1fe293a1f7201c2c1592449bb6a45a4a6160fb988f619c9e7bda679331c01ea6
Instruction ID: acc1b135fd3e244cc184f4dd8871fe4af5972a046cfffc78f96a57f5dd9e57d7
Opcode Fuzzy Hash: 1fe293a1f7201c2c1592449bb6a45a4a6160fb988f619c9e7bda679331c01ea6
Instruction Fuzzy Hash: 4071EF72610209EFDB15CF58D805BAEB7B9FF45324F10862EF8259B381DBB5A900CB90

Function 0044EF42 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 202COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 0044F0F1

Part of subcall function 0044DC17: RtlAllocateHeap.NTDLL(00000000,00000000,0044D0E1,?,0044EE85,?,00000000,?,0043F625,00000000,0044D0E1,?,?,?,?,0044CEDB), ref: 0044DC49

__freea.LIBCMT ref: 0044F106
__freea.LIBCMT ref: 0044F116

Strings

`&+, xrefs: 0044EF44, 0044F0BD

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: __freea$AllocateHeap
String ID: `&+
API String ID: 2243444508-3639896150
Opcode ID: c43614e6309a7a59aa89c8edbd93f90f50033d08f222a362255938c5ecd8dc4c
Instruction ID: f23007dbf5c0c8a3be0d0288540dd88e717abe30eaa77efdfc0d75be72341d41
Opcode Fuzzy Hash: c43614e6309a7a59aa89c8edbd93f90f50033d08f222a362255938c5ecd8dc4c
Instruction Fuzzy Hash: 7651C572600216AFFB205F65DC82DBB36A9EF48354F15013AFD08D7242EB79DC188768

Function 003B6200 Relevance: 6.1, APIs: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,E48E37CD,?,00000010,?,003B9550,?), ref: 003B6266
SetFilePointer.KERNEL32(00000000,?,00000010,00000000), ref: 003B62AF
ReadFile.KERNEL32(00000000,E48E37CD,?,?,00000000,00000078,?), ref: 003B62ED
CloseHandle.KERNEL32(00000000), ref: 003B6339

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$CloseCreateHandlePointerRead
String ID:
API String ID: 4133201480-0
Opcode ID: 4df25b585072f63d570b0103d1af464fbe2ae1ab578d024021c09599bb863a24
Instruction ID: 7455ca0a39f6d06db13ecc8166191170acbd340c07e898400c653a5a6cacce62
Opcode Fuzzy Hash: 4df25b585072f63d570b0103d1af464fbe2ae1ab578d024021c09599bb863a24
Instruction Fuzzy Hash: A2419F70900608EBDB11DF98CC89BEEFBB8EF45328F148269E511AB2D1D7789D04CB64

Function 003E12C0 Relevance: 6.0, APIs: 4, Instructions: 44threadsynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,?,E48E37CD,?,?,00000000,0045D670,000000FF,?,003E12A8,00000000,80004005,?,00544C50,?,?), ref: 003E12F7
GetExitCodeThread.KERNEL32(00000001,80004005,?,?,00000000,0045D670,000000FF,?,003E12A8,00000000), ref: 003E1311
TerminateThread.KERNEL32(00000001,00000000,?,?,00000000,0045D670,000000FF,?,003E12A8,00000000), ref: 003E1329
CloseHandle.KERNEL32(00000001,?,?,00000000,0045D670,000000FF,?,003E12A8,00000000,80004005,?,00544C50,?,?,003C3989), ref: 003E1332

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Thread$CloseCodeExitHandleObjectSingleTerminateWait
String ID:
API String ID: 3774109050-0
Opcode ID: 3b1dfc9afd6e47e22b05d81d2abe0a1ecf1c62be6921a348a02117dd19214c04
Instruction ID: c1fe4a88553e75efcaa9b1abae909884d13e208f3da2cf8cd54e1182ecc53f23
Opcode Fuzzy Hash: 3b1dfc9afd6e47e22b05d81d2abe0a1ecf1c62be6921a348a02117dd19214c04
Instruction Fuzzy Hash: 8C01B179900755EFCB219F55CC05BAAB7FCFB04710F00472EE82692AE0DB74A804CB58

Function 0045327C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00452DAC: GetOEMCP.KERNEL32(00000000,?,?,?,00000104), ref: 00452DD7

IsValidCodePage.KERNEL32(-00000030,00000000,?,`&+,?,?,?,?,?,`&+,004530C3,?,00000000,?,?,00000104), ref: 004532DD
GetCPInfo.KERNEL32(00000000,?,?,?,?,?,?,`&+,004530C3,?,00000000,?,?,00000104), ref: 0045331F

Strings

`&+, xrefs: 0045327E, 0045328E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CodeInfoPageValid
String ID: `&+
API String ID: 546120528-3639896150
Opcode ID: 25ac73e293dd28494ff4433ffa9822542404cf73d6c492a69808bdb3c703ae3a
Instruction ID: 9e48896bbcb518a594f5888a240e3182dcce8bd63116b8ec8d004098afcf6dde
Opcode Fuzzy Hash: 25ac73e293dd28494ff4433ffa9822542404cf73d6c492a69808bdb3c703ae3a
Instruction Fuzzy Hash: 14512570A002449FDB21CF75C8816ABFBF5EF46346F14846FD88687253DA789A0ACB54

Function 003BCFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(003BC783,00000000), ref: 003BCFA0
DestroyWindow.USER32(?), ref: 003BD057

Strings

(0C, xrefs: 003BD031

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DestroyErrorLastWindow
String ID: (0C
API String ID: 1182162058-4186761363
Opcode ID: 7fa83dfb409128cf1a4cbcf4f7d5888b88a868b1789ee521f0147e721cca662f
Instruction ID: b86f3755800ddb43e873a1c9fcadf38d43a53d908b80cb44bfaff945dd6ff500
Opcode Fuzzy Hash: 7fa83dfb409128cf1a4cbcf4f7d5888b88a868b1789ee521f0147e721cca662f
Instruction Fuzzy Hash: 1E2127716101098BDB21AF18EC417EA77A4EB51324F000266FD04CB690DB76EC65DBF1

Function 00450308 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringEx.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,E8458D00,00000100,?,E8458D00,00000000), ref: 0045033C
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,`&+,0044F030,?,?,00000000,?,00000000), ref: 0045035A

Strings

`&+, xrefs: 0045030A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: String
String ID: `&+
API String ID: 2568140703-3639896150
Opcode ID: 2dc35328b821997e226b838507f1483c05d024cca2a28faa3b98518d516a4f39
Instruction ID: 65557216188b6b84b6fd1637006cbeea40920510b9c1e87f62205c77835edff2
Opcode Fuzzy Hash: 2dc35328b821997e226b838507f1483c05d024cca2a28faa3b98518d516a4f39
Instruction Fuzzy Hash: 4CF0683A50051ABBCF125F91DC05EDE3F26BB48361F054165BE1825121CA36D871EB98

Function 003C0B10 Relevance: 4.7, APIs: 3, Instructions: 196fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000,E48E37CD,?,?), ref: 003C0B77
ReadFile.KERNEL32(?,00000000,00000018,?,00000000), ref: 003C0C84

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 1989f485b303df1d8ad37099f51be389405dee32770b3ef2c6a5a013942ad767
Instruction ID: 83fb288ddd9aae267d426e3b7100a690027c0d1bd9a5de32afdbfd4b298758d2
Opcode Fuzzy Hash: 1989f485b303df1d8ad37099f51be389405dee32770b3ef2c6a5a013942ad767
Instruction Fuzzy Hash: 62617E71D00649DFDB15DFA8C845B9DFBB4FB09720F10826EE825A7390DB75A914CB90

Function 003BE0A0 Relevance: 4.7, APIs: 3, Instructions: 183fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,E48E37CD,?,?,?,80004005,?,00000000), ref: 003BE13E
GetLastError.KERNEL32(?,?,?,80004005,?,00000000), ref: 003BE176
GetLastError.KERNEL32(?,?,?,?,80004005,?,00000000), ref: 003BE20F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$CreateFile
String ID:
API String ID: 1722934493-0
Opcode ID: 75d2db8fbb07ae9e3014f968de9aedfb071386acf193b08f4370561c1928bc8a
Instruction ID: 6ce26c2f80a371cbc182e156c00ad21e509e7825fd187ca22f424706654eef75
Opcode Fuzzy Hash: 75d2db8fbb07ae9e3014f968de9aedfb071386acf193b08f4370561c1928bc8a
Instruction Fuzzy Hash: B2510431A00A059FDB11DF6CCC41BEAF7B5FF45324F108629EA159B790EB70A905CB90

Function 003A4920 Relevance: 4.7, APIs: 3, Instructions: 177COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,E48E37CD,?,?,774CE010,00000000,0049AAC5,000000FF,?,003E32A7,00000000,.part,00000005), ref: 003A496B
CreateDirectoryW.KERNEL32(000000FF,00000000,?,?,004D2A4C,00000001,?), ref: 003A4A2A
GetLastError.KERNEL32 ref: 003A4A38

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateDirectoryErrorLastPath
String ID:
API String ID: 953296794-0
Opcode ID: d82a7d604e5d3f5d822a201cd747b5c1ebfd4ceb30d9f54aecd49c9d0a8806d4
Instruction ID: 1f3b0c25b38a1847226cf455a22e4e392043d1b74f97c2578709813a1a99e0a5
Opcode Fuzzy Hash: d82a7d604e5d3f5d822a201cd747b5c1ebfd4ceb30d9f54aecd49c9d0a8806d4
Instruction Fuzzy Hash: A461AF31A006099FDB11DFA8C885BDDFBF4EF56320F258269E415A72D1EBB4A904CF60

Function 0044C63C Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,0044C636,?,0043AD12,?,?,E48E37CD,0043AD12,?), ref: 0044C64D
TerminateProcess.KERNEL32(00000000,?,0044C636,?,0043AD12,?,?,E48E37CD,0043AD12,?), ref: 0044C654
ExitProcess.KERNEL32 ref: 0044C666

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 2abe08817c0aeed049f76fa1aac215c8c3a745fd2bb824c4da461a4bafda6919
Instruction ID: 7964044a7fa7f9fa1b6d3df34c9ecafb845cb2b086e29be4cfc8cd1df099c360
Opcode Fuzzy Hash: 2abe08817c0aeed049f76fa1aac215c8c3a745fd2bb824c4da461a4bafda6919
Instruction Fuzzy Hash: 86D05E31002504AFDF402F65DC0D85D3F29EF043457099129B90645131CF359842CA9C

Function 003A4C60 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000025,00000000,E48E37CD), ref: 003A4E00

Part of subcall function 003A4EC0: GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000000,?,?,?,80004005), ref: 003A4ECD

Strings

USERPROFILE, xrefs: 003A4CAE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$EnvironmentFolderHeapPathProcessSpecialVariable
String ID: USERPROFILE
API String ID: 1777821646-2419442777
Opcode ID: ced8f114fbd3b81f8b85131de7b497a636e057aa44fb9b70735fcdff230f6cfa
Instruction ID: 30e3f1c25435a264a7a4bd77cdd65c08cf9bc63bf235cecae914d6dd23e6f416
Opcode Fuzzy Hash: ced8f114fbd3b81f8b85131de7b497a636e057aa44fb9b70735fcdff230f6cfa
Instruction Fuzzy Hash: 1761DF71A00209DFDB14DF69C859BAEB7A8FF85710F10866DE819DB392DB709904CB91

Function 00452E80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 147COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCPInfo.KERNEL32(E8458D00,?,004530CF,004530C3,00000000), ref: 00452EB2

Strings

`&+, xrefs: 00452E82

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Info
String ID: `&+
API String ID: 1807457897-3639896150
Opcode ID: 23f786d7e498881a02161a314921b745f3988c56aaf301ab95e9ff03f3c23522
Instruction ID: 0c7fe8b7ba57c904c9d238919dfe89b123750d8426c32cebbea9714f02927d38
Opcode Fuzzy Hash: 23f786d7e498881a02161a314921b745f3988c56aaf301ab95e9ff03f3c23522
Instruction Fuzzy Hash: 4A5170715041489BDB218F24DE80AF67BB8EB16705F2405EFD89AC7183C3789D4ADF20

Function 00304BF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,00000000,00000000), ref: 00304CC1

Strings

$, xrefs: 00304C2D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: LongWindow
String ID: $
API String ID: 1378638983-3993045852
Opcode ID: e27d16bb6eaae38a00e55e910e30c9ffe33ffea401214ac4b678478068dd79c8
Instruction ID: 4e8d65cd7d9b78879d57cb20fca237098dd4dc4a6ad746aebb0c41e608ce4cad
Opcode Fuzzy Hash: e27d16bb6eaae38a00e55e910e30c9ffe33ffea401214ac4b678478068dd79c8
Instruction Fuzzy Hash: 4B31E9B1006380EBEB15DF08C8A471ABBF0BF88320F04815DFA458B2A5D376DA54CB92

Function 00387FE0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

__Init_thread_footer.LIBCMT ref: 00388052

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

Strings

XaT, xrefs: 0038805C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: XaT
API String ID: 2296764815-2366531857
Opcode ID: 38062b841edc495c456d98527492caec878fbdd49331be3d0a45ed596f187248
Instruction ID: 89762ab05ae78867201e872aeb722d8505b9463d90f63066f6c86e2d286a7fce
Opcode Fuzzy Hash: 38062b841edc495c456d98527492caec878fbdd49331be3d0a45ed596f187248
Instruction Fuzzy Hash: 7301D4B1944745EFCB14DB58E946B84B3A0E70A728F10567EE426833C1DB39A908DA16

Function 003E18E0 Relevance: 3.1, APIs: 2, Instructions: 129COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003E1931
EndDialog.USER32(00000000,00000001), ref: 003E1940

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DialogWindow
String ID:
API String ID: 2634769047-0
Opcode ID: 0d9a68ea038642d3c1af7aaf0fba169f3d25995afbdf8f36ddbfc3f433e94fda
Instruction ID: 35778a65bb53caf047d28ae547f8b333f7db3ab55d7bd544877a749304338b28
Opcode Fuzzy Hash: 0d9a68ea038642d3c1af7aaf0fba169f3d25995afbdf8f36ddbfc3f433e94fda
Instruction Fuzzy Hash: C0517C30A01B85DFD711CF69C948B8AFBF4FF49310F1482AEE4559B2A1D774AA04CB91

Function 003DF6D0 Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000), ref: 003DF735
CloseHandle.KERNEL32(?), ref: 003DF789

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CloseFreeHandleLibrary
String ID:
API String ID: 10933145-0
Opcode ID: 62b86b28db716c6f6571205903f565391137baf245f00f3e26365db56545e70f
Instruction ID: 98d0fb9a39d8064c13987b2b94ca937c513e9dc1897ed8522493545d9c9b05df
Opcode Fuzzy Hash: 62b86b28db716c6f6571205903f565391137baf245f00f3e26365db56545e70f
Instruction Fuzzy Hash: 1A217276A04A019FD704CF29EC8CB96B7F8FB15754F00422AE425C73A1EB799A08DB94

Function 003A0F40 Relevance: 3.0, APIs: 2, Instructions: 41windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A2350: LoadLibraryW.KERNEL32(ComCtl32.dll,E48E37CD,00000000,?,00000000), ref: 003A238E
Part of subcall function 003A2350: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 003A23B1
Part of subcall function 003A2350: FreeLibrary.KERNEL32(00000000), ref: 003A242F

SendMessageW.USER32(?,00000080,00000001,00000000), ref: 003A0F84
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003A0F8F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: LibraryMessageSend$AddressFreeLoadProc
String ID:
API String ID: 3032493519-0
Opcode ID: 973230fbe5af6fc8c910f135fcd5931b4e58b61f2e06ab549a57d269e6ebe0f5
Instruction ID: 07158ce3e97791a7c2240712dafe8761c2ce2177c353dc8a210d1dd581fa7faf
Opcode Fuzzy Hash: 973230fbe5af6fc8c910f135fcd5931b4e58b61f2e06ab549a57d269e6ebe0f5
Instruction Fuzzy Hash: 3AF030327812183BFA6021595C47F67B64DD786B64F144266FB98AF6C2ECC77C0502D8

Function 0044DBDD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,0045221D,?,00000000,?,?,004524BE,?,00000007,?,?,00452B18,?,?), ref: 0044DBF3
GetLastError.KERNEL32(?,?,0045221D,?,00000000,?,?,004524BE,?,00000007,?,?,00452B18,?,?), ref: 0044DBFE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: d2b7a51ed4f137b2ad38533f1884c475dd18619467e9b4e9d2cc8d648578a495
Instruction ID: f7c4d43df4ee4dd921ef206e0509c169b22af38d2ee4198c704e1de5d0a24879
Opcode Fuzzy Hash: d2b7a51ed4f137b2ad38533f1884c475dd18619467e9b4e9d2cc8d648578a495
Instruction Fuzzy Hash: 84E08631500214ABDB113FA5AC0D79A3B68AB0439AF154029F6088A161EA788894CB98

Function 0044D987 Relevance: 2.6, APIs: 2, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,0043B034,0044EEA3,?,0043F625,00000000,0044D0E1,?,?,?,?,0044CEDB,?,?,00000004), ref: 0044D98B
SetLastError.KERNEL32(00000000), ref: 0044DA2D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8b1fd8c5fa68000c82663309525cf6d313f426483a559de04fbf360b396b2615
Instruction ID: f3d4bee189b362ed9b03575b31dd1d5697d6f40a99bbb3c9bde8084152cec2a5
Opcode Fuzzy Hash: 8b1fd8c5fa68000c82663309525cf6d313f426483a559de04fbf360b396b2615
Instruction Fuzzy Hash: 7A11E971A046006BF7103B76ACC6F6B2A88EB1176DB10053BF515E13E2DA6C4C0AD16C

Function 003C3E40 Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

APIs

EnumResourceLanguagesW.KERNEL32(?,00000010,00000001,003C4020,?), ref: 003C3E8B

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EnumLanguagesResource
String ID:
API String ID: 4141015960-0
Opcode ID: 47addae66f78ded345cb44a4257f9a700aa9ec95dbb4785b87a567a399a5f99c
Instruction ID: c5fe9b0cfb056b39176d3d569f8ece43b0d7789b708ceb32a2b6cdb8a7f9d5fd
Opcode Fuzzy Hash: 47addae66f78ded345cb44a4257f9a700aa9ec95dbb4785b87a567a399a5f99c
Instruction Fuzzy Hash: C7618C71A0161A9BDB15CF68C885F9AFBF4FF08304F11466DE914EB681E771EE448BA0

Function 003C2AB0 Relevance: 1.6, APIs: 1, Instructions: 138fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,00000000,00000000,?,00000000,80004005,?,?,?,E48E37CD), ref: 003C2ADB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 69ef183e06ecdbdd7ce36ae872339d4df10164f0721a5fd1f85fba03d5f71ca0
Instruction ID: ee77b911db008c74b2ac1ff3dee87c7c57db3b0cda726c6559187a91c376e7b8
Opcode Fuzzy Hash: 69ef183e06ecdbdd7ce36ae872339d4df10164f0721a5fd1f85fba03d5f71ca0
Instruction Fuzzy Hash: B941DF31900614EFDB12DF58C885F9AB7B4FB04710F1586AAE914EF291DB71AD04CBA0

Function 003A2890 Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 003A2B00: __Init_thread_footer.LIBCMT ref: 003A2B76

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

__Init_thread_footer.LIBCMT ref: 003A2970

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionVariableWake
String ID:
API String ID: 984842325-0
Opcode ID: caea0108a22ad301f287ba94cd78aea5dfe53930e56d6107dd6a3e039871e55e
Instruction ID: 49ce6d0d0f1be182a402c93126feecc58fdc471d2eaa371366d803e6cec72025
Opcode Fuzzy Hash: caea0108a22ad301f287ba94cd78aea5dfe53930e56d6107dd6a3e039871e55e
Instruction Fuzzy Hash: 5831D0B5940A509BD715DF08EC86B86B3A1F723B1CF21421DE8114B7D0D3B6A9189B86

Function 003DF850 Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,003C1B50,?,00000000,00000000,?,?), ref: 003DF86D

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Part of subcall function 003DF940: WaitForSingleObject.KERNEL32(?,000000FF,E48E37CD,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003DF974

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AllocateCreateFileHeapObjectSingleWait
String ID:
API String ID: 1261966429-0
Opcode ID: 76168c8f0b9950deb82dee9c5ec6ec9c5e56b63d868e8ba24c3f32dc17d3234e
Instruction ID: bb499fdacf768f19d101acb783b34876b51ed9d554d35919568e3e9432040290
Opcode Fuzzy Hash: 76168c8f0b9950deb82dee9c5ec6ec9c5e56b63d868e8ba24c3f32dc17d3234e
Instruction Fuzzy Hash: CD31E675604B009FD325DF28E898B56B7E0FF88304F20896EE59BDB360D731AA91CB55

Function 003A2B00 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

Part of subcall function 003A2BA0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows NT\CurrentVersion,00000000,00020119,00000000), ref: 003A2C0E
Part of subcall function 003A2BA0: RegQueryValueExW.KERNEL32(00000000,CurrentMajorVersionNumber,00000000,00000000,?,?), ref: 003A2C55
Part of subcall function 003A2BA0: RegQueryValueExW.KERNEL32(00000000,CurrentMinorVersionNumber,00000000,00000000,?,00000004), ref: 003A2C74
Part of subcall function 003A2BA0: RegQueryValueExW.ADVAPI32(00000000,CurrentVersion,00000000,00000000,?,?), ref: 003A2CA3
Part of subcall function 003A2BA0: RegQueryValueExW.KERNEL32(00000000,CurrentBuildNumber,00000000,00000000,?,?), ref: 003A2D18

__Init_thread_footer.LIBCMT ref: 003A2B76

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalQuerySectionValue$EnterLeave$ConditionInit_thread_footerOpenVariableWake
String ID:
API String ID: 3563064969-0
Opcode ID: caa668b2093179d39d4981c4d9a27a3c46911177ad3eb1a8646d2541f6b9d3c3
Instruction ID: 566f0f9b24a9bb7d1f542310f3b1c361fa3a2f24d8ed6a65f19be2a14c072661
Opcode Fuzzy Hash: caa668b2093179d39d4981c4d9a27a3c46911177ad3eb1a8646d2541f6b9d3c3
Instruction Fuzzy Hash: 9B0126B5A00604EFCB10DF5CDC46B8A7BE4F707B24F500329F8259B7C0D738A9008A92

Function 002A9B10 Relevance: 1.5, APIs: 1, Instructions: 34memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00437F9E: RaiseException.KERNEL32(E06D7363,00000001,00000003,E48E37CD,?,?,80004005,E48E37CD), ref: 00437FFE

RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AllocateExceptionHeapRaise
String ID:
API String ID: 3789339297-0
Opcode ID: 1d14c6528d8a79f2c39ff6c6f4bcee3677f8682340af93a28e054217c2e6f98e
Instruction ID: c8b0fbc0e8e604cca6bc59f804b2cb11868c4c2cc526992e6c90a44324406cc8
Opcode Fuzzy Hash: 1d14c6528d8a79f2c39ff6c6f4bcee3677f8682340af93a28e054217c2e6f98e
Instruction Fuzzy Hash: A2F0A072A48248FFCB15DF54DC02F5AFBA8FB09B14F10862EF81587690DB76A810DA58

Function 0044DC17 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,0044D0E1,?,0044EE85,?,00000000,?,0043F625,00000000,0044D0E1,?,?,?,?,0044CEDB), ref: 0044DC49

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3be7f81991ccec533d74f3935f9d62bfd9773f3ad466f02540a4140e61204ec8
Instruction ID: c53a415541ef843a5ff6fce6d633f10bcb7051420bc989a318acf98180365cfc
Opcode Fuzzy Hash: 3be7f81991ccec533d74f3935f9d62bfd9773f3ad466f02540a4140e61204ec8
Instruction Fuzzy Hash: 48E0ED21E006205BFB212E669C8AB5B768C9B413A0F190127BC019A291EBE8CC00C1ED

Function 0044D049 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0044D050

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 4161ad9d682441e30fc97106611a2688bc4dff69c661c4faf868099898b31a50
Instruction ID: 4576011e7d68946e01b2f0452f9d160f171cfd0b3a78347b33877d3db88aa460
Opcode Fuzzy Hash: 4161ad9d682441e30fc97106611a2688bc4dff69c661c4faf868099898b31a50
Instruction Fuzzy Hash: 5EE09AB6C0020EAADB40DFD5C496BEFBBB8EB08314F50942BA245E6141EB7857448BA5

Function 002A8750 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 002A875B

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ed0c924c06db86c55b901bbc01193e2a010f9077c1d11b72436e1970a93d0a7b
Instruction ID: a76e66e30332d74b5a5cdbff97ff7c59b1c6a97a4509ae8eb332b964afa4254c
Opcode Fuzzy Hash: ed0c924c06db86c55b901bbc01193e2a010f9077c1d11b72436e1970a93d0a7b
Instruction Fuzzy Hash: 2EC08C302007104BC7306F28BA0874272DC5B04704F01442DA409C3200CF70DC00C658

Non-executed Functions

Function 002A2F40 Relevance: 210.0, Strings: 166, Instructions: 2486COMMON

Download Yara Rule

Strings

Extension, xrefs: 002A44BF, 002A4E96
FileCost, xrefs: 002A3514
InstallValidate, xrefs: 002A38BE
UnregisterClassInfo, xrefs: 002A4413
5000, xrefs: 002A4D03
Component_, xrefs: 002A3E04, 002A3F10, 002A3FA5, 002A401C, 002A4128, 002A41AE, 002A4248, 002A4340, 002A43C6, 002A4664, 002A46EA, 002A4770, 002A47F6, 002A487C, 002A4902, 002A4A05, 002A4A8B, 002A4B11, 002A4B97, 002A4CA3, 002A4DA6, 002A5026, 002A50AC, 002A5132, 002A5235, 002A52BB, 002A5346, 002A53C7, 002A54CA, 002A5550, 002A55E5, 002A565C, 002A56E2
WriteEnvironmentStrings, xrefs: 002A50F9
FileSize, xrefs: 002A4BBE
WriteIniValues, xrefs: 002A5073
1500000, xrefs: 002A552A
RemoveRegistryValues, xrefs: 002A4307, 002A438D
InstallInitialize, xrefs: 002A5829
RegisterComPlus, xrefs: 002A548C
1800, xrefs: 002A5B4E, 002A60AD
PatchFiles, xrefs: 002A4BE4
AI_UninstallTasks, xrefs: 002A5DAC
T, xrefs: 002A4D11
ServiceControl, xrefs: 002A3EFD, 002A3F83, 002A5649
InstallFinalize, xrefs: 002A58A6
Shortcut, xrefs: 002A475D, 002A4D93
CostFinalize, xrefs: 002A36DC
$T, xrefs: 002A628D
( T, xrefs: 002A5F31
1500, xrefs: 002A4639, 002A46C4, 002A5BCB, 002A6133
RemoveIniValues, xrefs: 002A462B, 002A46B1
ServiceInstall, xrefs: 002A553D
AI_XmlUninstall, xrefs: 002A609A, 002A6120
Feature, xrefs: 002A3E77, 002A57D2
SelfRegModules, xrefs: 002A5414
12000, xrefs: 002A4102, 002A4188, 002A420E, 002A4856, 002A48DC, 002A4962, 002A49DF, 002A4A65, 002A4D80, 002A520F, 002A5295, 002A531B
WriteRegistryValues, xrefs: 002A4FED
ODBCTranslator, xrefs: 002A419B, 002A52A8
10000, xrefs: 002A56BC, 002A62B3
hT, xrefs: 002A4BCC
UnregisterComPlus, xrefs: 002A3FE3
AI_GxUninstall, xrefs: 002A5E29
500, xrefs: 002A5EB9
MsiPublishAssemblies, xrefs: 002A572F
AppSearch, xrefs: 002A314B, 002A31D4
Feature_, xrefs: 002A3D20, 002A44D2, 002A4EA7, 002A5766, 002A595C, 002A59E2, 002A5A68, 002A5AEE
ProgId, xrefs: 002A4545, 002A4F13
100, xrefs: 002A4BF7, 002A4F00, 002A5E3C
AI_UserGroups, xrefs: 002A5D55, 002A5F49
x T, xrefs: 002A5F75
AI_ExtractPrereq, xrefs: 002A59A9
DuplicateFiles, xrefs: 002A4C6A
30000, xrefs: 002A3CD1, 002A5086, 002A5742
Font, xrefs: 002A42A7, 002A51A5
AI_Game, xrefs: 002A5C5B, 002A5E4F
MoveFile, xrefs: 002A4AFE
MsiAssembly, xrefs: 002A5755
AI_DownloadPrereq, xrefs: 002A5923
PublishComponent, xrefs: 002A3DF1, 002A56CF
Options, xrefs: 002A5A8F, 002A5B10
0T, xrefs: 002A4C78
AI_ProcessTasks, xrefs: 002A601D
8$T, xrefs: 002A629B
8000, xrefs: 002A407C, 002A4294, 002A5192, 002A5427
8#T, xrefs: 002A61C7
AI_XmlElement, xrefs: 002A5B61, 002A60C0
` T, xrefs: 002A5F5F
ODBCDataSource, xrefs: 002A4115, 002A5222
120000, xrefs: 002A474A
AI_XmlInstall, xrefs: 002A5B3B, 002A5BB8
800, xrefs: 002A390D
CostInitialize, xrefs: 002A332D
AI_UserAccounts, xrefs: 002A5CD8, 002A5FC6
p!T, xrefs: 002A603E
UnregisterProgIdInfo, xrefs: 002A451F
RemoveIniFile, xrefs: 002A4651
AI_CountRowAction, xrefs: 002A6223
PublishComponents, xrefs: 002A56A9
6000, xrefs: 002A5000
AI_DefaultActionCost, xrefs: 002A62A0
X"T, xrefs: 002A6108
100000, xrefs: 002A58B9
AI_ChainProductsPseudo, xrefs: 002A61A6
ProcessComponents, xrefs: 002A3AA0
AI_XmlAttribute, xrefs: 002A5BDE, 002A6141
UnregisterFonts, xrefs: 002A4281
MsiUnpublishAssemblies, xrefs: 002A3C82
BindImage, xrefs: 002A4CF0, 002A4D16
UnpublishFeatures, xrefs: 002A3E4C
CreateFolders, xrefs: 002A4A52
#T, xrefs: 002A61B4
RemoveExistingProducts, xrefs: 002A2F64
RegisterProgIdInfo, xrefs: 002A4EED
3000, xrefs: 002A3AEF, 002A3DDE, 002A3E64, 002A3FF6, 002A431A, 002A43A0, 002A4426, 002A44AC, 002A4532, 002A45B8, 002A47D0, 002A4E06, 002A4F7D, 002A53A1, 002A54A4
AI_UninstallAccounts, xrefs: 002A5CB2
@!T, xrefs: 002A6018
PublishFeatures, xrefs: 002A57AC
("T, xrefs: 002A60CE
AI_InstallPrerequisite, xrefs: 002A5A2F
IniFile, xrefs: 002A46D7, 002A5099
AI_InstallPostPrerequisite, xrefs: 002A5AB5
RegisterClassInfo, xrefs: 002A4DF3
TypeLib, xrefs: 002A53B4
UnregisterExtensionInfo, xrefs: 002A4499
@"T, xrefs: 002A60F5
X#T, xrefs: 002A61E2
RegisterExtensionInfo, xrefs: 002A4E70
UnpublishComponents, xrefs: 002A3DCB
h$T, xrefs: 002A62C1
UnregisterMIMEInfo, xrefs: 002A45A5
RegisterTypeLibraries, xrefs: 002A538E
StartServices, xrefs: 002A5623
AI_ProcessGroups, xrefs: 002A5F23
(T, xrefs: 002A4EFB
2000, xrefs: 002A3185, 002A5C48, 002A5CC5, 002A5D42, 002A5DBF, 002A5F36, 002A5FB3, 002A6030
MoveFiles, xrefs: 002A4AD8
AI_ProcessAccounts, xrefs: 002A5FA0
p#T, xrefs: 002A61F8
RemoveDuplicateFiles, xrefs: 002A4843
CreateShortcuts, xrefs: 002A4D6D
RemoveFile, xrefs: 002A4975
AI_AppSearchEx, xrefs: 002A5EA6, 002A5ECC
MsiConfigureServices, xrefs: 002A559D, 002A55C3
RemoveFiles, xrefs: 002A48C9, 002A494F
DuplicateFile, xrefs: 002A4869, 002A4C90
~, xrefs: 002A5A99
200000, xrefs: 002A583C
(!T, xrefs: 002A6005
InstallServices, xrefs: 002A5517
RemoveEnvironmentStrings, xrefs: 002A47BD
ODBCDriver, xrefs: 002A4221, 002A532E
StopServices, xrefs: 002A3ED7, 002A3F5D
PT, xrefs: 002A4BB9
X!T, xrefs: 002A602B
HT, xrefs: 002A4C8B
RemoveFolders, xrefs: 002A49CC
@T, xrefs: 002A4F0E
15000, xrefs: 002A3EEA, 002A3F70, 002A4AEB, 002A4C7D, 002A4E83, 002A55B0, 002A57BF
AI_PreRequisite, xrefs: 002A5949, 002A59CF, 002A5A55, 002A5ADB
RegisterFonts, xrefs: 002A517F
InstallFiles, xrefs: 002A4B5E
hT, xrefs: 002A4C9E
AI_UninstallGroups, xrefs: 002A5D2F
File, xrefs: 002A3598, 002A48EF, 002A4B7F
Location, xrefs: 002A5983, 002A5A09
AI_GxInstall, xrefs: 002A5C35
`T, xrefs: 002A4F29
InstallODBC, xrefs: 002A51FC, 002A5282, 002A5308
RemoveShortcuts, xrefs: 002A4737
MIME, xrefs: 002A45CB, 002A4F90
AppId, xrefs: 002A4439, 002A4E19
8T, xrefs: 002A4B92
p"T, xrefs: 002A611B
SelfReg, xrefs: 002A408F, 002A543A
Complus, xrefs: 002A4009, 002A54B7
AI_ScheduledTasks, xrefs: 002A6043
Component, xrefs: 002A33B6, 002A377A, 002A395C, 002A3B3E
RemoveRegistry, xrefs: 002A43B3
CreateFolder, xrefs: 002A49F2, 002A4A78
RemoveODBC, xrefs: 002A40EF, 002A4175, 002A41FB
20000, xrefs: 002A5636
xT, xrefs: 002A4F3F
PatchSize, xrefs: 002A4C44
T, xrefs: 002A4C3F
P$T, xrefs: 002A62AE
SelfUnregModules, xrefs: 002A4069
RegisterMIMEInfo, xrefs: 002A4F6A
Registry, xrefs: 002A432D, 002A5013
Patch, xrefs: 002A4C0A
3000000, xrefs: 002A510C
Environment, xrefs: 002A47E3, 002A511F
@ T, xrefs: 002A5F44

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: #T$ $T$(T$( T$(!T$("T$0T$100$10000$100000$12000$120000$1500$15000$1500000$1800$2000$20000$200000$3000$30000$3000000$500$5000$6000$8T$8#T$8$T$800$8000$@T$@ T$@!T$@"T$AI_AppSearchEx$AI_ChainProductsPseudo$AI_CountRowAction$AI_DefaultActionCost$AI_DownloadPrereq$AI_ExtractPrereq$AI_Game$AI_GxInstall$AI_GxUninstall$AI_InstallPostPrerequisite$AI_InstallPrerequisite$AI_PreRequisite$AI_ProcessAccounts$AI_ProcessGroups$AI_ProcessTasks$AI_ScheduledTasks$AI_UninstallAccounts$AI_UninstallGroups$AI_UninstallTasks$AI_UserAccounts$AI_UserGroups$AI_XmlAttribute$AI_XmlElement$AI_XmlInstall$AI_XmlUninstall$AppId$AppSearch$BindImage$Complus$Component$Component_$CostFinalize$CostInitialize$CreateFolder$CreateFolders$CreateShortcuts$DuplicateFile$DuplicateFiles$Environment$Extension$Feature$Feature_$File$FileCost$FileSize$Font$HT$IniFile$InstallFiles$InstallFinalize$InstallInitialize$InstallODBC$InstallServices$InstallValidate$Location$MIME$MoveFile$MoveFiles$MsiAssembly$MsiConfigureServices$MsiPublishAssemblies$MsiUnpublishAssemblies$ODBCDataSource$ODBCDriver$ODBCTranslator$Options$PT$P$T$Patch$PatchFiles$PatchSize$ProcessComponents$ProgId$PublishComponent$PublishComponents$PublishFeatures$RegisterClassInfo$RegisterComPlus$RegisterExtensionInfo$RegisterFonts$RegisterMIMEInfo$RegisterProgIdInfo$RegisterTypeLibraries$Registry$RemoveDuplicateFiles$RemoveEnvironmentStrings$RemoveExistingProducts$RemoveFile$RemoveFiles$RemoveFolders$RemoveIniFile$RemoveIniValues$RemoveODBC$RemoveRegistry$RemoveRegistryValues$RemoveShortcuts$SelfReg$SelfRegModules$SelfUnregModules$ServiceControl$ServiceInstall$Shortcut$StartServices$StopServices$TypeLib$UnpublishComponents$UnpublishFeatures$UnregisterClassInfo$UnregisterComPlus$UnregisterExtensionInfo$UnregisterFonts$UnregisterMIMEInfo$UnregisterProgIdInfo$WriteEnvironmentStrings$WriteIniValues$WriteRegistryValues$X!T$X"T$X#T$`T$` T$hT$hT$h$T$p!T$p"T$p#T$xT$x T$~$T$T
API String ID: 0-2557893121
Opcode ID: c01385832e7632ace9f2d10dcbb56eff488049d3ebc34ab2b4cee02164dd1b3c
Instruction ID: ff5d8f2a1a069cea9ae1820b9a44c0c66e3ebc18a88f33f55390b3ab19b2ab43
Opcode Fuzzy Hash: c01385832e7632ace9f2d10dcbb56eff488049d3ebc34ab2b4cee02164dd1b3c
Instruction Fuzzy Hash: D333BA30D957C8EFD701EBB4991A75D6EA0AB63709F60439DE1412B3E2CFBC0A049B59

Function 002C41B0 Relevance: 48.2, APIs: 16, Strings: 11, Instructions: 961memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002C420A
VariantClear.OLEAUT32(?), ref: 002C423C
VariantClear.OLEAUT32(?), ref: 002C435F
VariantClear.OLEAUT32(?), ref: 002C438E
SysFreeString.OLEAUT32(00000000), ref: 002C4395
SysAllocString.OLEAUT32(00000000), ref: 002C43E8
VariantClear.OLEAUT32(?), ref: 002C4476
VariantClear.OLEAUT32(?), ref: 002C44A8
VariantClear.OLEAUT32(?), ref: 002C4609
VariantClear.OLEAUT32(?), ref: 002C463C
SysFreeString.OLEAUT32(00000000), ref: 002C4647
SysAllocString.OLEAUT32(00000000), ref: 002C468A
SysFreeString.OLEAUT32(00000000), ref: 002C4845

Part of subcall function 002C5120: VariantClear.OLEAUT32(?), ref: 002C5129

VariantClear.OLEAUT32(?), ref: 002C47FB
VariantClear.OLEAUT32(?), ref: 002C4837
SysAllocString.OLEAUT32(00000000), ref: 002C4869

Strings

MsiSetProperty, xrefs: 002C48F0
MsiGetBytesCountText, xrefs: 002C4EC4
MsiPublishEvents, xrefs: 002C4D34
MsiEvaluateCondition, xrefs: 002C4A5C
MsiGetBinaryPathIndirect, xrefs: 002C4C6C
MsiResolveFormatted, xrefs: 002C4AF7
GetFontHeight, xrefs: 002C5054
MsiGetProperty, xrefs: 002C499D
MessageBox, xrefs: 002C4DFC
MsiGetFormattedError, xrefs: 002C4FA1
MsiGetBinaryPath, xrefs: 002C4BAA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID: GetFontHeight$MessageBox$MsiEvaluateCondition$MsiGetBinaryPath$MsiGetBinaryPathIndirect$MsiGetBytesCountText$MsiGetFormattedError$MsiGetProperty$MsiPublishEvents$MsiResolveFormatted$MsiSetProperty
API String ID: 1305860026-3153392536
Opcode ID: a9c197db3b9a6e07beb9b625e679e0970d2023d9c09302e27e519e2bd97d55d7
Instruction ID: 49bcff757c4841ad52f45f9ae4c5beb70ecd1070205b204f75d6c9a73cb3f8c9
Opcode Fuzzy Hash: a9c197db3b9a6e07beb9b625e679e0970d2023d9c09302e27e519e2bd97d55d7
Instruction Fuzzy Hash: 22925A70910358DFDB20DFA4CC54BDEBBB4BF49314F204299E449A7281EB74AA99CF94

Function 003D77C0 Relevance: 44.3, APIs: 16, Strings: 9, Instructions: 514fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00546078,C0000000,00000003,00000000,00000004,00000080,00000000,E48E37CD,00546054,0054606C,?), ref: 003D7837
GetLastError.KERNEL32 ref: 003D7854
OutputDebugStringW.KERNEL32(00000000,00000020), ref: 003D78CF
OutputDebugStringW.KERNEL32(00000000,?,0000001C), ref: 003D79CB
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,0000001C), ref: 003D7A3C
WriteFile.KERNEL32(00000000,00545920,00000000,00000000,00000000,?,0000001C), ref: 003D7A6C
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,004C58A8,00000002), ref: 003D7B17
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 003D7B20
FlushFileBuffers.KERNEL32(00000000,?,0000001C), ref: 003D7A71

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

OutputDebugStringW.KERNEL32(00000000,?,0000001D), ref: 003D7C12
WriteFile.KERNEL32(00000000,00000000,00000002,?,00000000,?,0000001D), ref: 003D7C98
FlushFileBuffers.KERNEL32(00000000,?,0000001D), ref: 003D7CA3
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,004C58A8,00000002,?,?,CPU: ,00000005), ref: 003D7D17
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 003D7D20
WriteFile.KERNEL32(00000000,000000FF,?,00000000,00000000,004C58A8,00000002), ref: 003D7DA5
FlushFileBuffers.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,0000001C), ref: 003D7DAE

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Strings

LOGGER->Creating LOG file at:, xrefs: 003D7BBA, 003D7BCC, 003D7BD6
x64, xrefs: 003D7AB1, 003D7ABD
server, xrefs: 003D7AC3, 003D7ACB
OS Version: %u.%u.%u SP%u (%s) [%s], xrefs: 003D7AE7
workstation, xrefs: 003D7ABE
CPU: , xrefs: 003D7B68, 003D7B7E, 003D7CAC
LOGGER->failed to create LOG at:, xrefs: 003D788A, 003D789C, 003D78A6
x86, xrefs: 003D7AA8
LOGGER->Reusing LOG file at:, xrefs: 003D7973, 003D7985, 003D798F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$BuffersFlushWrite$DebugOutputString$Init_thread_footer$CreateErrorFindHeapLastPointerProcessResource
String ID: CPU: $LOGGER->Creating LOG file at:$LOGGER->Reusing LOG file at:$LOGGER->failed to create LOG at:$OS Version: %u.%u.%u SP%u (%s) [%s]$server$workstation$x64$x86
API String ID: 4051163352-1312762833
Opcode ID: 8783124af1ab442c3baba6ab6ad1e533db6650dfe2d495fae223cf747ee64de2
Instruction ID: 19d0af3972df91103680e2b7587ce4d93e59bda1c2cd579d8adebd2b119b780e
Opcode Fuzzy Hash: 8783124af1ab442c3baba6ab6ad1e533db6650dfe2d495fae223cf747ee64de2
Instruction Fuzzy Hash: 2212AD71A012059FDB01DF68CC49BAEBBB9FF45310F1482AAE8159B3A2EB34DD45CB50

Function 002C35A0 Relevance: 33.7, APIs: 22, Instructions: 727memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002C35FA
VariantClear.OLEAUT32(?), ref: 002C362C
VariantClear.OLEAUT32(?), ref: 002C3726
VariantClear.OLEAUT32(?), ref: 002C3755
SysFreeString.OLEAUT32(00000000), ref: 002C375C
SysAllocString.OLEAUT32(00000000), ref: 002C37A3
VariantClear.OLEAUT32(?), ref: 002C3827
VariantClear.OLEAUT32(?), ref: 002C3859
VariantClear.OLEAUT32(?), ref: 002C3959
VariantClear.OLEAUT32(?), ref: 002C398C
SysFreeString.OLEAUT32(00000000), ref: 002C3997
SysAllocString.OLEAUT32(00000000), ref: 002C39DD
VariantClear.OLEAUT32(?), ref: 002C3A5A
VariantClear.OLEAUT32(?), ref: 002C3A8C
VariantClear.OLEAUT32(?), ref: 002C3BAC
VariantClear.OLEAUT32(?), ref: 002C3BDB
SysFreeString.OLEAUT32(00000000), ref: 002C3BE2
SysAllocString.OLEAUT32(00000000), ref: 002C3C35
VariantClear.OLEAUT32(?), ref: 002C3CBA
VariantClear.OLEAUT32(?), ref: 002C3CEC
VariantClear.OLEAUT32(?), ref: 002C3DDD
VariantClear.OLEAUT32(?), ref: 002C3E0A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: bfb8be357617805e87c08c237734d1c8f4562f320d04a35b4444fa493da98745
Instruction ID: b88e7f5d5092d516cdc3d72ad6c238556c1fe449fc0c7978995f93eb4a7ba5c6
Opcode Fuzzy Hash: bfb8be357617805e87c08c237734d1c8f4562f320d04a35b4444fa493da98745
Instruction Fuzzy Hash: 88429E71910249DFCB00DFA8CC48BDEBBB4FF09314F148669E405E7291EB789A59CBA5

Function 002AF190 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 374memorynativeCOMMON

Download Yara Rule

APIs

Part of subcall function 002AF5F0: EnterCriticalSection.KERNEL32(00546250,E48E37CD,00000000,?,?,?,?,?,?,P*,0045F68D,000000FF), ref: 002AF62D
Part of subcall function 002AF5F0: LoadCursorW.USER32(00000000,00007F00), ref: 002AF6A8
Part of subcall function 002AF5F0: LoadCursorW.USER32(00000000,00007F00), ref: 002AF74E

SysFreeString.OLEAUT32(00000000), ref: 002AF233
SysAllocString.OLEAUT32(00000000), ref: 002AF264
GetWindowLongW.USER32(?,000000EC), ref: 002AF33B
GetWindowLongW.USER32(?,000000EC), ref: 002AF34B
SetWindowLongW.USER32(?,000000EC,00000000), ref: 002AF356
NtdllDefWindowProc_W.NTDLL(?,?,00000001,?), ref: 002AF364
GetWindowLongW.USER32(?,000000EB), ref: 002AF372
SetWindowTextW.USER32(?,004C337C), ref: 002AF411
GlobalAlloc.KERNEL32(00000042,00000000), ref: 002AF448
GlobalLock.KERNEL32(00000000), ref: 002AF456
GlobalUnlock.KERNEL32(?), ref: 002AF47A
SetWindowLongW.USER32(?,000000EB,00000000), ref: 002AF501
SysFreeString.OLEAUT32(00000000), ref: 002AF516
NtdllDefWindowProc_W.NTDLL(?,?,?,00000000), ref: 002AF55D
SysFreeString.OLEAUT32(00000000), ref: 002AF585

Strings

~4C, xrefs: 002AF382
P*, xrefs: 002AF24A
P*, xrefs: 002AF1AF, 002AF2A2
L4C, xrefs: 002AF487

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$String$FreeGlobal$AllocCursorLoadNtdllProc_$CriticalEnterLockSectionTextUnlock
String ID: L4C$P*$P*$~4C
API String ID: 4180125975-2871586407
Opcode ID: fd7508535ac0dbfbdd8722c288715d018d3ecc8358611a7aae79a69f7c7ba390
Instruction ID: 23fe2ae23dd55027b6ecb937d2d2bf416517009cd491a24ed2c6898c9f14d18b
Opcode Fuzzy Hash: fd7508535ac0dbfbdd8722c288715d018d3ecc8358611a7aae79a69f7c7ba390
Instruction Fuzzy Hash: 3CD1D271900206EFDF10DFE4CD48BAFBBB8EF4A314F144168E911A7280DB799A15CBA1

Function 002B8CD0 Relevance: 26.8, APIs: 14, Strings: 1, Instructions: 520windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 002B8D83
ShowWindow.USER32(00000000,?), ref: 002B8DA2
SetWindowLongW.USER32(?,000000EB,00000000), ref: 002B8DB0
GetWindowRect.USER32(00000000,?), ref: 002B8DC7
ShowWindow.USER32(00000000,?), ref: 002B8DE8
SetWindowLongW.USER32(?,000000EB,?), ref: 002B8DFF

Part of subcall function 002B2970: RaiseException.KERNEL32(?,?,00000000,00000000,00435A3C,C000008C,00000001,?,00435A6D,00000000,?,002A91C7,00000000,E48E37CD,00000001,?), ref: 002B297C

ShowWindow.USER32(?,?), ref: 002B8F43
GetWindowLongW.USER32(?,000000EB), ref: 002B8F79
ShowWindow.USER32(?,?), ref: 002B8F96
GetWindowRect.USER32(?,?), ref: 002B8FBB
SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 002B90F8
GetWindowRect.USER32(?,?), ref: 002B91B5
GetWindowRect.USER32(?,?), ref: 002B9207
SendMessageW.USER32(00000000,0000000B,00000001,00000000), ref: 002B9243

Strings

L/C, xrefs: 002B90CE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$LongRectShow$MessageSend$ExceptionRaise
String ID: L/C
API String ID: 1022490566-2064156145
Opcode ID: c26cd01edc2025b1bb2c997822101a86675079f9b2cb384b60f8dd65eb6483c6
Instruction ID: 874e2b030eac3eb2ea9c0a1d483f6430060670f245063b4ee2d630cf96fc8c60
Opcode Fuzzy Hash: c26cd01edc2025b1bb2c997822101a86675079f9b2cb384b60f8dd65eb6483c6
Instruction Fuzzy Hash: 1B12CD31914606AFDB25CF68C844BAABBF5FF89344F00491DF58A97260DB30E899CF51

Function 002AEBE0 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 293nativememoryCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 002AECCB
GetWindowLongW.USER32(00000004,000000EC), ref: 002AECDB
SetWindowLongW.USER32(00000004,000000EC,00000000), ref: 002AECE6
NtdllDefWindowProc_W.NTDLL(00000004,?,00000001,?), ref: 002AECF4
GetWindowLongW.USER32(00000004,000000EB), ref: 002AED02
SetWindowTextW.USER32(00000004,004C337C), ref: 002AEDA1
GlobalAlloc.KERNEL32(00000042,00000000), ref: 002AEDD8
GlobalLock.KERNEL32(00000000), ref: 002AEDE6
GlobalUnlock.KERNEL32(?), ref: 002AEE0A
SetWindowLongW.USER32(00000004,000000EB,00000000), ref: 002AEE6F
NtdllDefWindowProc_W.NTDLL(00000004,?,00000000,00000000), ref: 002AEEBD

Strings

~4C, xrefs: 002AED12
L4C, xrefs: 002AEE17

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$Global$NtdllProc_$AllocLockTextUnlock
String ID: L4C$~4C
API String ID: 3555041256-3149871551
Opcode ID: 7074bcd135bbb9a922f751e7dd31e1d926fe53c97a5706f09de207e9caa5561a
Instruction ID: 2888e0bf9da2f1401a17f0a913f8955534844cc61fd2d4bd23943104121e8b63
Opcode Fuzzy Hash: 7074bcd135bbb9a922f751e7dd31e1d926fe53c97a5706f09de207e9caa5561a
Instruction Fuzzy Hash: C0A10071910206EBDF10DFA4CD08BAFBBB9EF46320F254619F911A7291DB388915CBA1

Function 003AC0B0 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 420fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

FindFirstFileW.KERNEL32(?,?,?,00000001), ref: 003AC452
FindClose.KERNEL32(00000000), ref: 003AC480
FindClose.KERNEL32(00000000), ref: 003AC509

Strings

No acceptable version found. It must be downloaded., xrefs: 003AC8DD
An acceptable version was found., xrefs: 003AC8CF
No acceptable version found. It is already downloaded and it will be installed., xrefs: 003AC8F2
No acceptable version found. It must be downloaded manually from a site., xrefs: 003AC8E4
Not selected for install., xrefs: 003AC900
No acceptable version found. Operating System not supported., xrefs: 003AC8EB
No acceptable version found., xrefs: 003AC8F9
No acceptable version found. It must be installed from package., xrefs: 003AC8D6

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Find$CloseInit_thread_footer$FileFirstHeapProcess
String ID: An acceptable version was found.$No acceptable version found.$No acceptable version found. It is already downloaded and it will be installed.$No acceptable version found. It must be downloaded manually from a site.$No acceptable version found. It must be downloaded.$No acceptable version found. It must be installed from package.$No acceptable version found. Operating System not supported.$Not selected for install.
API String ID: 544434140-749633484
Opcode ID: 93842dd9a5c0e3e63aadedbe89107f35f4897cfed1d07dd9a80b255c9288ca06
Instruction ID: 179f33f5c7301fc1f2ad411e180617ae2022acfa20a8e6823c35941f73a17aa5
Opcode Fuzzy Hash: 93842dd9a5c0e3e63aadedbe89107f35f4897cfed1d07dd9a80b255c9288ca06
Instruction Fuzzy Hash: D1F19E30900609CFDB11DF69C9487AEFBF5EF46310F148699E8599B392EB34AA44CF91

Function 002FFA40 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 253windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 002FFC1B
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 002FFC2B
SendMessageW.USER32(00000000,00000421,?,?), ref: 002FFC40
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 002FFC51
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 002FFC64
GetWindowRect.USER32(?,?), ref: 002FFC92

Part of subcall function 003012B0: CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0030130F
Part of subcall function 003012B0: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,002FFDEC,00000000,E48E37CD,?,?), ref: 00301328

Part of subcall function 002B0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 002B0DE6

SendMessageW.USER32(00000000,00000412,00000000), ref: 002FFCF4
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 002FFD04

Strings

,, xrefs: 002FFBC1

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,
API String ID: 1954517558-3772416878
Opcode ID: 094066336ad41b446879842e182500df6950214dfbef2ec3e5faa95e288dc4ba
Instruction ID: fcd367d23795f00c017e167288eeb26636cf3c61cc80564e1f3b455a6744e9cc
Opcode Fuzzy Hash: 094066336ad41b446879842e182500df6950214dfbef2ec3e5faa95e288dc4ba
Instruction Fuzzy Hash: 14A1F571A002199FDB14CFA9CD85BAEBBF9FB48300F50462AE516EB291D774A914CF50

Function 002C6070 Relevance: 12.8, APIs: 6, Strings: 1, Instructions: 512windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 002C6143

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

__Init_thread_footer.LIBCMT ref: 002C610F

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

SendMessageW.USER32(?,0000104D,00000000,?), ref: 002C643F
SendMessageW.USER32(?,0000102B,?,?), ref: 002C64CF
SendMessageW.USER32(?,00001003,00000001,?), ref: 002C6555
SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 002C6695

Part of subcall function 002AC3F0: __floor_pentium4.LIBCMT ref: 002AC40D

Strings

AiFeatIco, xrefs: 002C636D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake__floor_pentium4
String ID: AiFeatIco
API String ID: 4294328693-859831556
Opcode ID: b7591bbd36a7179e93dcdd6c3870c0740e887b18fe5604e9937186c19dee100b
Instruction ID: d0c09bac92262140169b447dc859ad7a3e00bdb378bcb5ff8a878cbd017c49c5
Opcode Fuzzy Hash: b7591bbd36a7179e93dcdd6c3870c0740e887b18fe5604e9937186c19dee100b
Instruction Fuzzy Hash: 1C22BF71900249DFDF14DF68C889BEDBBB5FF59304F144269E805AF292DB70AA44CBA1

Function 00382A50 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 313windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 00382C80
SendMessageW.USER32(?,00000443,00000000), ref: 00382CEA
MulDiv.KERNEL32(?,00000000), ref: 00382D21

Strings

NumberValidationTipMsg, xrefs: 00382B8B
;3C, xrefs: 00382D46
Segoe UI, xrefs: 00382CF8
NumberValidationTipTitle, xrefs: 00382AC4

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSendWindow
String ID: ;3C$NumberValidationTipMsg$NumberValidationTipTitle$Segoe UI
API String ID: 701072176-3522137364
Opcode ID: 59ce2407f9dcf4fab473a24be334e38437e182ffac361119719c4b548ae8ab61
Instruction ID: 43f9c4c6869cd7d6e6d1a6bd7f71a2038325a4e655e2ffba76d5518409baeb30
Opcode Fuzzy Hash: 59ce2407f9dcf4fab473a24be334e38437e182ffac361119719c4b548ae8ab61
Instruction Fuzzy Hash: 44C1BC71A00709AFEB14CF64CC55BEAB7F1EF89300F008299E556AB2D1DB746A49CF94

Function 00458B95 Relevance: 11.9, APIs: 1, Strings: 5, Instructions: 1436COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00458D79

Strings

1#SNAN, xrefs: 00458CA1
1#QNAN, xrefs: 00458CA8
1#IND, xrefs: 00458C9A
`&+, xrefs: 00458B97
1#INF, xrefs: 00458CCB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN$`&+
API String ID: 4168288129-3694619426
Opcode ID: d76cbd32e4eb69a501cbf0d3a5d48f88cdb17db5032f88d2ccf81556d3f1dac4
Instruction ID: 2391e8d383a4fa715678de9ea15771a31caf2977e851f00557481547bbc30b12
Opcode Fuzzy Hash: d76cbd32e4eb69a501cbf0d3a5d48f88cdb17db5032f88d2ccf81556d3f1dac4
Instruction Fuzzy Hash: DBD22871E08228CBDB65CE28CD407EAB7B5EB45306F1445EBD80DE7241DB38AE898F45

Function 003CA620 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

_wcschr.LIBVCRUNTIME ref: 003CA6D9
GetLogicalDriveStringsW.KERNEL32(00000064,?), ref: 003CA82E
GetDriveTypeW.KERNEL32(?), ref: 003CA84A
Wow64DisableWow64FsRedirection.KERNEL32(00000000,00000000), ref: 003CAA37
Wow64RevertWow64FsRedirection.KERNEL32(00000000,00000000), ref: 003CAAC1

Strings

]%!, xrefs: 003CA7C9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Wow64$DriveInit_thread_footerRedirection$DisableHeapLogicalProcessRevertStringsType_wcschr
String ID: ]%!
API String ID: 2638324580-1069524040
Opcode ID: 6fb49250e826b9c4143cb1da5b5a268f337caf371790e0373ef60440780ac079
Instruction ID: a22c1121666dc9f346f3e9f41250ac0ac3ccf6230b4a0fee04811416b0188e1b
Opcode Fuzzy Hash: 6fb49250e826b9c4143cb1da5b5a268f337caf371790e0373ef60440780ac079
Instruction Fuzzy Hash: 69F1CE30900A59DFDB25DB68CC84BADB7B4AF04314F1582EDE41AEB291DB709E84CF91

Function 00453B80 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

GetACP.KERNEL32(?,?,?,?,?,?,004493AE,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00453C41
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004493AE,?,?,?,00000055,?,-00000050,?,?), ref: 00453C6C
_wcschr.LIBVCRUNTIME ref: 00453D00
_wcschr.LIBVCRUNTIME ref: 00453D0E
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00453DCF

Strings

utf8, xrefs: 00453D3E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 8d8a17bfc3a148960dd2d0264b19846864f5c719cb7a362e9a2668596b49db6f
Instruction ID: 028db6e42bdb22424eb4381d3b92cc949fc34003b4befbc31c9aa7a9df2f9b9e
Opcode Fuzzy Hash: 8d8a17bfc3a148960dd2d0264b19846864f5c719cb7a362e9a2668596b49db6f
Instruction Fuzzy Hash: A971F871A00205AAD725AF75CC42B6773B8EF04787F14442FFD05DB282EA78EE48C669

Function 003DFB20 Relevance: 9.2, APIs: 6, Instructions: 196fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,-00000010,?,E48E37CD,?,00000000,00000000), ref: 003DFBF1
FindNextFileW.KERNEL32(?,00000000), ref: 003DFC0C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: b090e4db9fb3fed8c548e998b6d765da3b74ade75593ad2db74b231bf36b069e
Instruction ID: 99a014b78f1c0329036c2dcabf2ee856a105b6d84ecd0705351e1a6f38362ef0
Opcode Fuzzy Hash: b090e4db9fb3fed8c548e998b6d765da3b74ade75593ad2db74b231bf36b069e
Instruction Fuzzy Hash: 3B716C71900289DFDB11DFA9CC48BEEBBB8FF05314F15826AE815AB291DB749E04CB50

Function 0044DD6A Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 337COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0044DDF7

Strings

`&+, xrefs: 0044DD6C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: _strrchr
String ID: `&+
API String ID: 3213747228-3639896150
Opcode ID: 61616e26537ace8c997b701a72d866b1042ed0193a591e10dac063b8da873d44
Instruction ID: 83bd5b5a10836bbcef22d22cb4a10d439434ee50a50f811470bd78a3964eccb7
Opcode Fuzzy Hash: 61616e26537ace8c997b701a72d866b1042ed0193a591e10dac063b8da873d44
Instruction Fuzzy Hash: D5B16932D042559FEB25CF28C8817EEBBA5EF59304F14816BE815AB341C27C9D05CBA9

Function 003A3A50 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 321fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

FindFirstFileW.KERNEL32(?,00000000,?,?,00000000), ref: 003A3BA8
FindFirstFileW.KERNEL32(?,00000000,0000002A,?,00000000,?,?,00000000), ref: 003A3C45
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 003A3C6B
FindClose.KERNEL32(00000000,?,00000000,?,?,00000000), ref: 003A3CB5

Strings

P3L, xrefs: 003A3B4D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Find$CloseFileFirstInit_thread_footer$HeapProcess
String ID: P3L
API String ID: 3625725927-419209001
Opcode ID: fb06dd6e97db8f0072e78f845b3fefe8e08cf80e0d34cf7ab93bfb18184f099d
Instruction ID: aa754fef8b9ce888dfacd67a8dbb59aa2d222d19140bee78681c46dd7dc710b4
Opcode Fuzzy Hash: fb06dd6e97db8f0072e78f845b3fefe8e08cf80e0d34cf7ab93bfb18184f099d
Instruction Fuzzy Hash: FDA1B271A002099FDB15DF68CC49BAEB7F5FF45324F24862EE81597381EBB59A048B90

Function 00300BAA Relevance: 9.1, APIs: 6, Instructions: 70nativeCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000000), ref: 00300B67
ShowWindow.USER32(?,00000005), ref: 00300B93
GetWindowLongW.USER32(?,000000F0), ref: 00300BC5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00300BE3
NtdllDefWindowProc_W.NTDLL(?,0000000C,?,?), ref: 00300BF6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00300C0D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$Show$NtdllProc_
String ID:
API String ID: 3227303085-0
Opcode ID: 5a8e9e514b5e364a6c8697a582b0aa53a8603fbea817bcb5160dac96c580f65c
Instruction ID: 2e861a5ed95189285b4bcdb9baacfb295595177264467ebe5339d188c83d92c6
Opcode Fuzzy Hash: 5a8e9e514b5e364a6c8697a582b0aa53a8603fbea817bcb5160dac96c580f65c
Instruction Fuzzy Hash: FB215935A45204DFDB159F58DC58BADBBB2FF49324F210229E426AB3E1CB366814DF40

Function 00435CA1 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000C,00435BBD,00000000,?,00435D55,00000000,?,?,002B0B74,?), ref: 00435CA3
GetProcessHeap.KERNEL32(00000008,00000008,00000000,00000000,?,?,002B0B74,?), ref: 00435CCA
HeapAlloc.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435CD1
InitializeSListHead.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435CDE
GetProcessHeap.KERNEL32(00000000,00000000,?,?,002B0B74,?), ref: 00435CF3
HeapFree.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435CFA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$Process$AllocFeatureFreeHeadInitializeListPresentProcessor
String ID:
API String ID: 1475849761-0
Opcode ID: 63f4e7ae83183da5fb1577058d8d947f21f13db7a34c253921fe4ba3be8f3d95
Instruction ID: 3eab032fcb727d9e3f845b5211f2dea6dc88ef7fc6609482d6067484629f927d
Opcode Fuzzy Hash: 63f4e7ae83183da5fb1577058d8d947f21f13db7a34c253921fe4ba3be8f3d95
Instruction Fuzzy Hash: 14F0CD35641A019BDB20AF29BC48B0B37ECBB98B56F06863DF942C3350DF74C804DA68

Function 0045430F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,0045462D,00000002,00000000,?,?,?,0045462D,?,00000000), ref: 004543A8
GetLocaleInfoW.KERNEL32(?,20001004,0045462D,00000002,00000000,?,?,?,0045462D,?,00000000), ref: 004543D1
GetACP.KERNEL32(?,?,0045462D,?,00000000), ref: 004543E6

Strings

OCP, xrefs: 00454363
ACP, xrefs: 0045432D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 3fefda5bfe33a24281c7e616bcb5ff5b81159eed1861502198da7466d332f990
Instruction ID: ba4cc8167420b325102272f75a6aff5dae757d32ece5d4d9e856ba1c3e78cc38
Opcode Fuzzy Hash: 3fefda5bfe33a24281c7e616bcb5ff5b81159eed1861502198da7466d332f990
Instruction Fuzzy Hash: AE21F432701100A7D7348F54C901A9B73AAEFD4B5AB568476ED0ACF326E736DE89C358

Function 004544E4 Relevance: 7.7, APIs: 5, Instructions: 183COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 004545F0
IsValidCodePage.KERNEL32(00000000), ref: 00454639
IsValidLocale.KERNEL32(?,00000001), ref: 00454648
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00454690
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 004546AF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 56960d070d74530ec4b6c47ae03905ef30ea43ce48957d0c381f739476fa2566
Instruction ID: 8ec2445c47cf08bbf3cd846ce190d4590409bd8ccb278e35104d91e914774c5c
Opcode Fuzzy Hash: 56960d070d74530ec4b6c47ae03905ef30ea43ce48957d0c381f739476fa2566
Instruction Fuzzy Hash: 6051B671900209ABDF10DF65CC45ABB73B8BF4570AF04056AFE04DB252E7789948CB69

Function 002BC4F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000003,000000FC), ref: 002BC546
SetWindowLongW.USER32(00000003,000000FC,?), ref: 002BC558
DeleteCriticalSection.KERNEL32(?,E48E37CD,?,?,?,?,004619C4,000000FF), ref: 002BC583

Strings

PVL, xrefs: 002BC5AA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: LongWindow$CriticalDeleteSection
String ID: PVL
API String ID: 1978754570-7733451
Opcode ID: 254d0e4ae26c2db48db8fdefe3bc042aa5c4250fd983cdbc9041fe57660d8a8b
Instruction ID: a563b2a3cb84dc3554f24acc63220e861800cefa6f62236a449636ad70fbbd04
Opcode Fuzzy Hash: 254d0e4ae26c2db48db8fdefe3bc042aa5c4250fd983cdbc9041fe57660d8a8b
Instruction Fuzzy Hash: 5B31D474900646EBCF20DF24CC48B9ABBF8BF15354F14821AE814A36D1D775EA14DB90

Function 003CB3D0 Relevance: 6.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca7f8c7eb1af99be2373199dc3b1da3ffc7bd8e3fb1902ae682f47b1f51a6204
Instruction ID: de89b569ebcc64a83b427c2a6853217ebd2817472d39772195e9947e478f3a62
Opcode Fuzzy Hash: ca7f8c7eb1af99be2373199dc3b1da3ffc7bd8e3fb1902ae682f47b1f51a6204
Instruction Fuzzy Hash: E1816A719012199FDB50DF68CC8AB99F7B8EF45314F1482DDE818AB292DB709E84CF91

Function 0033AB40 Relevance: 6.1, APIs: 4, Instructions: 87COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000017,E48E37CD,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 0033AB88
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 0033AB9B
LockResource.KERNEL32(00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 0033ABAA
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,?,00000000,Function_001C791D,000000FF), ref: 0033ABBA

Part of subcall function 003A1480: MultiByteToWideChar.KERNEL32(?,00000000,00000000,?,00000000,00000000,E48E37CD,00000000,00000000), ref: 003A14D4

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Resource$ByteCharFindLoadLockMultiSizeofWide
String ID:
API String ID: 203124936-0
Opcode ID: f47150750eb0b14f1f2374b0a91e2a5760d6e86d50fdf4ec8f54d96df9284b3b
Instruction ID: e098b156c6f3840fe23587c1af29a7258451371f287ac118790866a482d65e91
Opcode Fuzzy Hash: f47150750eb0b14f1f2374b0a91e2a5760d6e86d50fdf4ec8f54d96df9284b3b
Instruction Fuzzy Hash: 2C31E471E04B05ABDB209F74DC45BABF7B8EB48750F015729E855A73C0EB70A904CBA2

Function 00300CE3 Relevance: 6.1, APIs: 4, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00300D3E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00300D5C
NtdllDefWindowProc_W.NTDLL(?,00000086,?,00000000), ref: 00300D6E
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00300D80

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: f2bbae604c3b22c59595e4acd64fd2dab0cd44ea2ac261c95560223b0cee7837
Instruction ID: ff932ecba19253bd31ece3b23d3c26a69a05f04373da9953e482c7ff4f18f78f
Opcode Fuzzy Hash: f2bbae604c3b22c59595e4acd64fd2dab0cd44ea2ac261c95560223b0cee7837
Instruction Fuzzy Hash: D6319A70A48254AFDB11CF68DD89B99BBB1EF46320F10429AE811AB3E1CB756D14DB50

Function 00300C22 Relevance: 6.0, APIs: 4, Instructions: 48nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00300C3C
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00300C5A
NtdllDefWindowProc_W.NTDLL(?,00000080,?,?), ref: 00300C70
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00300C87

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$NtdllProc_
String ID:
API String ID: 3674618424-0
Opcode ID: b55db4e67a3a914bed7555d4613b07b74d2f18005d2824217437f68a413c2f39
Instruction ID: c150bd8dc2f16fea7dbdafc7845e40c9189af867b93a93d2b64f6bbbe04dfc65
Opcode Fuzzy Hash: b55db4e67a3a914bed7555d4613b07b74d2f18005d2824217437f68a413c2f39
Instruction Fuzzy Hash: 42111276A04259AFDF219F98DC44B9DBBB5EB49320F21032AE925A33E0CB7219149B40

Function 00313FC0 Relevance: 5.9, Strings: 4, Instructions: 907COMMON

Download Yara Rule

Strings

&, xrefs: 00314CB2
<a>, xrefs: 003142DD
tYT, xrefs: 003148FD
</a>, xrefs: 00314308

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer
String ID: &$</a>$<a>$tYT
API String ID: 1385522511-4292537815
Opcode ID: 61322bbf198561f52976c05f72a3af3c50aff1929311197641b2933c0e730efa
Instruction ID: e214eb006b70cd23e618dd309980f8011af76405f7ba6987980c1956ac5c5d04
Opcode Fuzzy Hash: 61322bbf198561f52976c05f72a3af3c50aff1929311197641b2933c0e730efa
Instruction Fuzzy Hash: D6922270D012A9DFDB25DBA8C944BDDBBB4AF18304F1085DAE409B7292DB745E88CF61

Function 0041D550 Relevance: 5.5, Strings: 4, Instructions: 529COMMON

Download Yara Rule

Strings

yxxx, xrefs: 0041D91D
yxxx, xrefs: 0041D904
yxxx, xrefs: 0041D944
yxxx, xrefs: 0041DA08

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: yxxx$yxxx$yxxx$yxxx
API String ID: 0-3504637693
Opcode ID: a6aa1bece39e65445dd18bb5d8ecf3d7e7659061379142ec94ce2fb52e19cada
Instruction ID: 87f330455e20a50e73a41db49bc31685af034f464b4f591fe11d64a1397dbce4
Opcode Fuzzy Hash: a6aa1bece39e65445dd18bb5d8ecf3d7e7659061379142ec94ce2fb52e19cada
Instruction Fuzzy Hash: 2702B4B1E005059FCB18DF59C981AAEB7F5EF88300F14862EE816EB395DB34E941CB94

Function 003CB7D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?), ref: 003CB88C
FindClose.KERNEL32(00000000), ref: 003CB9D7

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Strings

%d.%d.%d.%d, xrefs: 003CB969

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Find$AllocateCloseFileFirstHeap
String ID: %d.%d.%d.%d
API String ID: 1673784098-3491811756
Opcode ID: 2daa240c7b79a83c1777d5af572907cfd55ee42bca6f13404acb1fd24a037a91
Instruction ID: afc1bf9c249008c5b9df03a1356eb3f424f6acbbcb65cf6ccf4d2efa9bb7c448
Opcode Fuzzy Hash: 2daa240c7b79a83c1777d5af572907cfd55ee42bca6f13404acb1fd24a037a91
Instruction Fuzzy Hash: 8A616971905219DFDF20DF68CC49B9DBBB4AF05314F10829AE819AB291DB769E84CF90

Function 002BE290 Relevance: 5.3, Strings: 4, Instructions: 346COMMON

Download Yara Rule

Strings

AI_NO_BORDER_NORMAL, xrefs: 002BE360
AI_CONTROL_VISUAL_STYLE, xrefs: 002BE2F8
AI_CONTROL_VISUAL_STYLE_EX, xrefs: 002BE5B8
AI_NO_BORDER_HOVER, xrefs: 002BE3DB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: AI_CONTROL_VISUAL_STYLE$AI_CONTROL_VISUAL_STYLE_EX$AI_NO_BORDER_HOVER$AI_NO_BORDER_NORMAL
API String ID: 0-932585912
Opcode ID: eaec2a7afb93f956c7c7e2905ce5d621ebd021fbbf3c115a4d051fbc2a545370
Instruction ID: 7351e33e3bb03e40f787ad2216839efe1543fe2d14c4d1f400e24ec799044348
Opcode Fuzzy Hash: eaec2a7afb93f956c7c7e2905ce5d621ebd021fbbf3c115a4d051fbc2a545370
Instruction Fuzzy Hash: CBD19D70D10218DFEF04CFA9CC45BEEBBB1AF45304F508159E455AB286DB78AA19CBA1

Function 00453F93 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00453FE7
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00454031
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004540F7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: InfoLocale$ErrorLast
String ID:
API String ID: 661929714-0
Opcode ID: b95d89cfbf8cca70a4b6dd5eb4337435c0fc91e66bfd85e96ea9933e92a604f6
Instruction ID: 27985903e4afa6825571b6caebc94e0768a5e6d4044c83eb537cffd588d0bec0
Opcode Fuzzy Hash: b95d89cfbf8cca70a4b6dd5eb4337435c0fc91e66bfd85e96ea9933e92a604f6
Instruction Fuzzy Hash: C761E4719105079BDB289F29CC86B7BB3A8EF54309F10417AED05CA282E738D9C9CB58

Function 002B8890 Relevance: 4.6, APIs: 3, Instructions: 93COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000004), ref: 002B88DE
GetWindowLongW.USER32(00000004,000000FC), ref: 002B88F7
SetWindowLongW.USER32(00000004,000000FC,?), ref: 002B8909

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 7f37f173dc1fb8dcd85fd58550afc493c863538c0f22dddf6fa620aa5f9a925b
Instruction ID: cbe17075cd6ade978936fcd629269de589c3cc7357db35310ccec1410fdf05b2
Opcode Fuzzy Hash: 7f37f173dc1fb8dcd85fd58550afc493c863538c0f22dddf6fa620aa5f9a925b
Instruction Fuzzy Hash: 1E419DB0601A46EFDB10CF65D908B9AFBB8FF05314F00826DE41897790DB76E924CB91

Function 0043AD13 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 0043AE0B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 0043AE15
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 0043AE22

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 52126ac4033531ae5e038a983e6132f6edd3637c4761e568cf2415dbdd12fca3
Instruction ID: 8dda349dea06951ae7aa468ce970612e930ce9cba489f9dd490c6ad085495a1c
Opcode Fuzzy Hash: 52126ac4033531ae5e038a983e6132f6edd3637c4761e568cf2415dbdd12fca3
Instruction Fuzzy Hash: 7731C5759412189BCB21DF69DC8978DBBB8BF1C310F5051EAE40CA7290EB749F858F49

Function 002B1670 Relevance: 4.5, APIs: 3, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000FC), ref: 002B1689
SetWindowLongW.USER32(?,000000FC,?), ref: 002B1697
DestroyWindow.USER32(?,?,?,?,?,?,80004003,?,00000001,?,?,00000001,?,?,004C383C), ref: 002B16C3

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$Destroy
String ID:
API String ID: 3055081903-0
Opcode ID: abe1316d143d326c653d244743ea41657c4a0b0c65ede447a1cfb258c4e6ccc9
Instruction ID: 314af6dd902d0bb1dd247610cfcc1bbc7ec81e92f61bd9aca001f2f1b0a00174
Opcode Fuzzy Hash: abe1316d143d326c653d244743ea41657c4a0b0c65ede447a1cfb258c4e6ccc9
Instruction Fuzzy Hash: 0AF03A34004B119BDB605F28ED08BC2BBE4BF05725F048B1DE4AA825F0CB35E864EB00

Function 002C7630 Relevance: 3.3, APIs: 2, Instructions: 252windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000102B,00000000,?), ref: 002C774D
SendMessageW.USER32(?,0000102B,0000009B,?), ref: 002C7932

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: db12f38f8c88aa383c07fd8b593d0dc8d26ef551ba767d0bdba5a0d7d1a1fd71
Instruction ID: 634587cdc629eb1f2dab8ddaa559d974f722103f79e62f4c8b1eb0b610e84ece
Opcode Fuzzy Hash: db12f38f8c88aa383c07fd8b593d0dc8d26ef551ba767d0bdba5a0d7d1a1fd71
Instruction Fuzzy Hash: FAA1FF71A14646AFDB18CF24C999FA9FBE5FB04304F14836EE45ADB281D734AA11CF90

Function 003BE3A0 Relevance: 3.1, APIs: 2, Instructions: 140fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,00000000,?,?,00000003,E48E37CD,00000000,?,00000000), ref: 003BE48E
FindClose.KERNEL32(00000000,?,00000000), ref: 003BE4D9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ea5f71becec58962fce15ecb59eeb3d8377d6daf478199d460e3f41c41c78d43
Instruction ID: 4d335752f0065e9239dbe20d46c1bb2050e55b9ad629836e8720032208e1893d
Opcode Fuzzy Hash: ea5f71becec58962fce15ecb59eeb3d8377d6daf478199d460e3f41c41c78d43
Instruction Fuzzy Hash: 52517B7190060ACFDB21DF68C848BEEB7F4FF45318F10455AE9159B781DB74AA04CB90

Function 003A2230 Relevance: 3.1, APIs: 2, Instructions: 105windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,E48E37CD,00000008,00000000), ref: 003A227B
GetLastError.KERNEL32 ref: 003A2285

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 7dcd1f07539061bf976092a30c80803714a0f6c9671e2cb346bf9d4549a6d6e2
Instruction ID: 293016e6b99d82c643cb5f6e1b339d884be6478719b95b060962c25065311246
Opcode Fuzzy Hash: 7dcd1f07539061bf976092a30c80803714a0f6c9671e2cb346bf9d4549a6d6e2
Instruction Fuzzy Hash: 28318171A002099FDB10DF9DDC45BAEBBF8EB45714F20062EF918E7380DBB599048B95

Function 00300010 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 0030007F
SetWindowLongW.USER32(00000000,000000FC,?), ref: 0030008D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 7f8186651c635b5f12585092e2a9ce60c2fcae1c4b3f4e40c4eb633a77672b13
Instruction ID: f5ce36d94a501e52d460cd51597011c9e877e6c5d7205231233fcd92a20a66ab
Opcode Fuzzy Hash: 7f8186651c635b5f12585092e2a9ce60c2fcae1c4b3f4e40c4eb633a77672b13
Instruction Fuzzy Hash: 7D319C71901605EFCB15DF69C948B9AFBF4FF05324F148269E424A77D0C776AA14CB90

Function 003CE610 Relevance: 3.1, APIs: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,E48E37CD,?,00000000,00000000,00000000,004A351D,000000FF), ref: 003CE678
FindClose.KERNEL32(00000000,?,E48E37CD,?,00000000,00000000,00000000,004A351D,000000FF), ref: 003CE6C2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 3e1c932a91fc50b0477f16893b596b5b0de31e6528c7f558737b98817b0eb7e6
Instruction ID: 410bf8205dcb15f1c7cc0e608fd0912696e5da62f30eac4a2092be256521f678
Opcode Fuzzy Hash: 3e1c932a91fc50b0477f16893b596b5b0de31e6528c7f558737b98817b0eb7e6
Instruction Fuzzy Hash: 1F2181719005499FDB10DF68CC49BAEF7B8EF44724F14466AE825972D0EB745A08CB94

Function 002D52F0 Relevance: 1.9, Strings: 1, Instructions: 617COMMON

Download Yara Rule

Strings

2, xrefs: 002D5576

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: 2
API String ID: 0-450215437
Opcode ID: d9561e64a6a71d563b0baa20c5f748bbbb5a574cb3a4a36444864dd223ce0522
Instruction ID: 8e29ffbd76d57f6964d230ad61957dadf31f4c9a9c7af3488dc0074417a1d081
Opcode Fuzzy Hash: d9561e64a6a71d563b0baa20c5f748bbbb5a574cb3a4a36444864dd223ce0522
Instruction Fuzzy Hash: 0C32B0B1A047628BCB10CF26D95056BB7E5AF94308F444E3EF5C6CB381EA74E958C792

Function 0043E64C Relevance: 1.6, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

`&+, xrefs: 0043E64E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: `&+
API String ID: 0-3639896150
Opcode ID: 0705b04ec5ca8766b435fef831862ce973736f006e6e917cd87b78ae14dcfe1c
Instruction ID: b890858b72de49242f6df5fc30b1fa03a6498cd603fa99cc7f040cd6470057e9
Opcode Fuzzy Hash: 0705b04ec5ca8766b435fef831862ce973736f006e6e917cd87b78ae14dcfe1c
Instruction Fuzzy Hash: 48E1B970A026058FCB28DF6AC480AABB7B1BF4C314F20665ED4569B3D1D738EC46CB59

Function 004541E6 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0045423A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: be4c0d2035f9737d3c5990258faee2438188caa77338e9eb904fc6834e431514
Instruction ID: 37bf567c09738dd518fff12d5811f67d7385119d091d859548d20b0df54e9fd6
Opcode Fuzzy Hash: be4c0d2035f9737d3c5990258faee2438188caa77338e9eb904fc6834e431514
Instruction Fuzzy Hash: 4421B872510116ABDB289E26DC42A7B77A8EF84359F1040BFFD05CA282EA78DD45C658

Function 00453E6D Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

EnumSystemLocalesW.KERNEL32(00453F93,00000001,00000000,?,-00000050,?,004545C4,00000000,?,?,?,00000055,?), ref: 00453EDF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 0be9cb21bf123b83910262be2db4c1a5c27976d251d00e226a5ff3176f01ea09
Instruction ID: 2213b57ee8be50a3a461e2a82fe21b68018a3b691df4c1c67ca7e615ea8fa009
Opcode Fuzzy Hash: 0be9cb21bf123b83910262be2db4c1a5c27976d251d00e226a5ff3176f01ea09
Instruction Fuzzy Hash: FC115937A043019FDB189F39C89167ABBA1FF8035AB14442EE94787B41E3757906C740

Function 00454415 Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004541AF,00000000,00000000,?), ref: 00454441

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 6367b67dc74f8451312354fe962a44589ad639042af7584b0f252e62752d1893
Instruction ID: e96b026a6e1d4ae87a5531d1993312c142da8e112d0593eb30ba07b7d26ab999
Opcode Fuzzy Hash: 6367b67dc74f8451312354fe962a44589ad639042af7584b0f252e62752d1893
Instruction Fuzzy Hash: 6DF07D329401117BDB245B25CC057BB3768EB8175DF05442AED55A7241EB3CFE87C6A4

Function 00453D7B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00453DCF

Strings

utf8, xrefs: 00453D3E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$InfoLocale
String ID: utf8
API String ID: 3736152602-905460609
Opcode ID: 817269a0374961658a91cfdccaf92d2a9ad6b6be03e54d036ee3707be36d7445
Instruction ID: 8153a1e4bde24b3eef1e2c001dcc3e42c66716cd4f1dd1a291b2260841ee23a3
Opcode Fuzzy Hash: 817269a0374961658a91cfdccaf92d2a9ad6b6be03e54d036ee3707be36d7445
Instruction Fuzzy Hash: 76F02832A00105ABD724AF39DC4AABA73ECDB44355F00407EBA06D7381EE78AD0A8754

Function 00453F08 Relevance: 1.5, APIs: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

EnumSystemLocalesW.KERNEL32(004541E6,00000001,?,?,-00000050,?,00454588,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 00453F52

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 02a8e4d2505d6769cad38914a68b6bb99d253172622f8bfb3e43eb83f8ff9e30
Instruction ID: 06ac7fec3f7140ef63ffa8a403700c10f3a67337d4d6838b856062d86dc4d97b
Opcode Fuzzy Hash: 02a8e4d2505d6769cad38914a68b6bb99d253172622f8bfb3e43eb83f8ff9e30
Instruction Fuzzy Hash: CBF046376003046FDB249F399C81A7A7BA4FF807AAF04402EFD058B681D6B99D42C604

Function 0044FC09 Relevance: 1.5, APIs: 1, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044A89A: EnterCriticalSection.KERNEL32(-00545108,?,0044CE16,002A9F56,00539668,0000000C,0044D0E1,?), ref: 0044A8A9

EnumSystemLocalesW.KERNEL32(0044FBFC,00000001,005397A8,0000000C,0045002B,00000000), ref: 0044FC41

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 2e8c9e69976236189af4d30845d7416e39e351642a6872538feea0a9596303aa
Instruction ID: 8e084552d363fb47ae1fac8f2ec6eef4254b7fd5c58ff3f990cd72e4d43ec438
Opcode Fuzzy Hash: 2e8c9e69976236189af4d30845d7416e39e351642a6872538feea0a9596303aa
Instruction Fuzzy Hash: DEF04F76A40204DFE704EFA9E842B9C77F0FB05725F10416BF404DB2E1DB7959459B54

Function 00453E22 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044D836: GetLastError.KERNEL32(?,00000008,0044F453), ref: 0044D83A
Part of subcall function 0044D836: SetLastError.KERNEL32(00000000,00000000,00000002,000000FF), ref: 0044D8DC

EnumSystemLocalesW.KERNEL32(00453D7B,00000001,?,?,?,004545E6,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 00453E59

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: 4033d3b44b77c58949dffc04550df0595d66554acb2b16eb73e467e6132e1150
Instruction ID: a11c944ea8df005f0808e7f7ace1c56a3237d4b4ba4a6d08bed4ea1516e963ac
Opcode Fuzzy Hash: 4033d3b44b77c58949dffc04550df0595d66554acb2b16eb73e467e6132e1150
Instruction Fuzzy Hash: 39F0553670020557CB04AF3AD84676ABFA4EFC1796F0A005EEE098B252C63A9947C754

Function 002C15F0 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_W.NTDLL(?,-00002000,?,?,002BFD16,?,?,?,?,?,?,?,?,002BFB78,?,?), ref: 002C1640

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 40db40636491084975f960613d21d38d9019fb0e9f0d23c73f6415d5318ac4af
Instruction ID: 35a35a4b1a09af4c36126b3c6a7f97f359148c5baecfa3209ba01820976703e6
Opcode Fuzzy Hash: 40db40636491084975f960613d21d38d9019fb0e9f0d23c73f6415d5318ac4af
Instruction Fuzzy Hash: D6F03474014182DAE7008F14D89AF69BBAAFB47346F6C46F9E19885462C339CA78DE10

Function 00450186 Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00449F14,?,20001004,00000000,00000002,?,?,00449516), ref: 004501BA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7537b5b8685fe636db020b5d555bdb104d0d2db13df52a42206c48cdffc3e926
Instruction ID: ae5dcd2777061bd645a1502862b41300f90be9bfe5ad79b6cc98b68cdcf92360
Opcode Fuzzy Hash: 7537b5b8685fe636db020b5d555bdb104d0d2db13df52a42206c48cdffc3e926
Instruction Fuzzy Hash: 56E04F35501518BBCF122F61DC05AAE7E29FF44751F00412AFD0565222CB368921EAD9

Function 002F6EE0 Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

1, xrefs: 002F72E7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: 1
API String ID: 0-2212294583
Opcode ID: 88b973a663ae5f8e1658e7aae917f832a5030b96f90c282c64da9bfbf5a8c8e5
Instruction ID: 33129385f6370281f3b058daeb3aa05f60f55f65e396c64f8d4691f6ac7ec977
Opcode Fuzzy Hash: 88b973a663ae5f8e1658e7aae917f832a5030b96f90c282c64da9bfbf5a8c8e5
Instruction Fuzzy Hash: 17D123B0901B8AEFE749CF64C55878AFBF4BF05308F14825DD4685B281D3BAA618CBD1

Function 00347F20 Relevance: 1.3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

Strings

{L, xrefs: 00347F8C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: {L
API String ID: 0-1469069594
Opcode ID: fdf94f0775ce67cfe98d88220695568798d1f017f42e4eb2c908cdc992de85b3
Instruction ID: 2f72cd5baf374dbef97d32747a641303f946021a6a33293bd6f37bb814c274fe
Opcode Fuzzy Hash: fdf94f0775ce67cfe98d88220695568798d1f017f42e4eb2c908cdc992de85b3
Instruction Fuzzy Hash: 5F41F7B0905745EED704CF69C51878AFBF0BB09318F10865EC4589B781D3BAA619CFD5

Function 002B8720 Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

`VL, xrefs: 002B878D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: `VL
API String ID: 0-605939035
Opcode ID: 6fc07e64245b133664ad03991d03b65b5e6ab02620ba9013c3e0995e97648524
Instruction ID: 1e3e146324b95ee4f6c2c7db4e4ca740d3075c4ee83818e2bb90a63e8a2a7534
Opcode Fuzzy Hash: 6fc07e64245b133664ad03991d03b65b5e6ab02620ba9013c3e0995e97648524
Instruction Fuzzy Hash: 0431CFB0405B84CEE721CF29C55878BBFF0BB15718F108A4DD4A64BB91D3BAA548CF91

Function 0037B7A0 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1aab5b5333348179645d9ad4a4ff604e9f191f47d66afd00b9194913baa56a06
Instruction ID: bbe5084b89a90bebfca8e71792f4228a86ae35dfaa535c4afb5390e41dba125f
Opcode Fuzzy Hash: 1aab5b5333348179645d9ad4a4ff604e9f191f47d66afd00b9194913baa56a06
Instruction Fuzzy Hash: 14020872E002059FCB29DF68C881BAEF7B5EB59314F15822EE819D7391E734AD04CB91

Function 0043E2BE Relevance: .3, Instructions: 344COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 674d362d59339a1e37758a0b0c3e29b05e532d1f67931a5b2a4b84f6c7ec0208
Instruction ID: a95e1281cc041099c9a1eff8426bebbd0caadbf26210de10e09d6ebc7dba8fe0
Opcode Fuzzy Hash: 674d362d59339a1e37758a0b0c3e29b05e532d1f67931a5b2a4b84f6c7ec0208
Instruction Fuzzy Hash: 6CC1DF30902646CFCB24CE6AC48066FB7A1AB1D318F64661FD892973D2D739EC46CB59

Function 002AF7C0 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 716995e39b52f0425e30decb5e7c56b4dc977b3e393c6ac8a9bb09aa8fcb9551
Instruction ID: 880fa2632bc01989ac5d30416ea8bd6eedc884a9fc1abe64cba8b786ac3f6363
Opcode Fuzzy Hash: 716995e39b52f0425e30decb5e7c56b4dc977b3e393c6ac8a9bb09aa8fcb9551
Instruction Fuzzy Hash: 3271E8B0805B48DFE761CF68C95478ABFF0BB09314F108A5EC4A99B391D3B96648DF91

Function 00396BF0 Relevance: .1, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fba1932744c78b5263ead70bcc6989d81ec1f93e884d4006cf6bbf5e353cef37
Instruction ID: 8942347741e17c5135b53d8ffcb1dff06039bc21b7941d7ccf80d07f9ad14deb
Opcode Fuzzy Hash: fba1932744c78b5263ead70bcc6989d81ec1f93e884d4006cf6bbf5e353cef37
Instruction Fuzzy Hash: 1101C0B2A056466BEF228E569C82B63BBDCDB19360F04013AFC4583281EB35D80486A4

Function 002B2250 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6db90538effc4f463ad807d62faf7dc2b83bd5abfff3b0ad44c28b3bdbdcef78
Instruction ID: b2738cc961e3a79f4e19d71b50d3316f310a40ddb624f90e6138e6a0cade4440
Opcode Fuzzy Hash: 6db90538effc4f463ad807d62faf7dc2b83bd5abfff3b0ad44c28b3bdbdcef78
Instruction Fuzzy Hash: 6E2158B0804788CFD710CF58C944B8ABBF4FB19324F1186AED4559B791E3B9AA48CF94

Function 002B1C90 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fc8e6fb70453dda7604cdc666e69c15ad1227c6ba0795378497da1575ac9949
Instruction ID: 1e7b7a33382a8e71aca39ce7433535d25d766bfeea6f9be9cb09d768b16fde69
Opcode Fuzzy Hash: 9fc8e6fb70453dda7604cdc666e69c15ad1227c6ba0795378497da1575ac9949
Instruction Fuzzy Hash: 74216DB4804788DFD710CF58C944B8ABBF4FB19314F1186AED455AB791E3B9AA48CF90

Function 002CD320 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d45719f69723dd870886a800345e069ec0a51cfde85f7530f04f0d9e140047bc
Instruction ID: b42494b38b08cdfc9fba0b53d71b7b5fb17c607414f60601f011838e16d90578
Opcode Fuzzy Hash: d45719f69723dd870886a800345e069ec0a51cfde85f7530f04f0d9e140047bc
Instruction Fuzzy Hash: 0411EDB5904248DFCB44CF58C545749BBF4FB09728F20829EE8189B781D37B9A06DF84

Function 0045783E Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction ID: a7e860b50278bf20a3605196130f68172e6c02a614f500d0ed3a1013d55bb1fa
Opcode Fuzzy Hash: 53d55dbc7befab1462941653f93551db49e582fd117fd3c7d9640c03956ee69d
Instruction Fuzzy Hash: DEE08C32915228EBCB14EBDAD948D8AF3ECEB45B05B1104ABF901D3201C274DE04C7D4

Function 0044C66D Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144c5401b694974f51f95ed054cfd58255e5e3608f4b0faf65206ff88c737fe7
Instruction ID: f6e12d9a91c7e3bd3bd09be48b1adf329f243a3ce659ad378327b9805720df47
Opcode Fuzzy Hash: 144c5401b694974f51f95ed054cfd58255e5e3608f4b0faf65206ff88c737fe7
Instruction Fuzzy Hash: 85C08C74003D0057DE29992482B13A63354A3A1782F9A248EC8020BB42C51E9C8AD7A8

Function 0038A2B0 Relevance: 56.2, APIs: 7, Strings: 25, Instructions: 238libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

GetModuleHandleW.KERNEL32(kernel32,E48E37CD,?,?,00000000), ref: 0038A3B3
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 0038A3FB
__Init_thread_footer.LIBCMT ref: 0038A40E
GetProcAddress.KERNEL32(00000000,SetDllDirectory), ref: 0038A456
__Init_thread_footer.LIBCMT ref: 0038A469
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0038A4B1
__Init_thread_footer.LIBCMT ref: 0038A4C4

Part of subcall function 00361FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00361FF1
Part of subcall function 00361FB0: _wcschr.LIBVCRUNTIME ref: 003620AF

Strings

0|M, xrefs: 0038A5F8
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 0038A347
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r ", xrefs: 0038A340, 0038A34F
@|M, xrefs: 0038A50A
P*M, xrefs: 0038A582
T|M, xrefs: 0038A4EC
SetDefaultDllDirectories, xrefs: 0038A4AB
H}M, xrefs: 0038A596
d}M, xrefs: 0038A5A0
SetSearchPathMode, xrefs: 0038A3F5
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 0038A327, 0038A32F
0}M, xrefs: 0038A550
~M, xrefs: 0038A653
SetDllDirectory, xrefs: 0038A450
$~M, xrefs: 0038A61B
@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls, xrefs: 0038A322
x}M, xrefs: 0038A56E
kernel32.dll, xrefs: 0038A60D
|M, xrefs: 0038A55A
T~M, xrefs: 0038A5E3
<~M, xrefs: 0038A5DC
kernel32, xrefs: 0038A3AE
0|M, xrefs: 0038A500
x|M, xrefs: 0038A4F6
l~M, xrefs: 0038A630

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$AddressProc$DirectoryHandleHeapModuleProcessSystem_wcschr
String ID: $~M$0|M$0|M$0}M$<~M$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try del "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" :try rd "%s" if exist "%s" goto try%%SystemRoot%%\System32\attrib.exe -r "%s" del "%s" | cls$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1rd "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@echo off %%SystemRoot%%\System32\attrib.exe -r "%s" SET count=0 :try %%SystemRoot%%\System32\timeout.exe 5 SET /a count=%%count%%+1del "%s" if %%count%% GTR %lu goto breakif exist "%s" goto try:break %%SystemRoot%%\System32\attrib.exe -r "$@|M$H}M$P*M$SetDefaultDllDirectories$SetDllDirectory$SetSearchPathMode$T|M$T~M$d}M$kernel32$kernel32.dll$l~M$x|M$x}M$|M$~M
API String ID: 1258094593-1623089638
Opcode ID: a1034c14bdd24db90c459fd2f733397798c063c338ded0a98e8b88479540a0a8
Instruction ID: 065241a7f4f7bb8e0884f74b96ec49ddcda88ba79e98f1d942d69b8af8d16f40
Opcode Fuzzy Hash: a1034c14bdd24db90c459fd2f733397798c063c338ded0a98e8b88479540a0a8
Instruction Fuzzy Hash: BDA15BB09043189FDB20DF55D859B9EBBB4FB02718F50819FE4186B381E7B85948CF9A

Function 003E2F90 Relevance: 51.2, APIs: 26, Strings: 3, Instructions: 487timefilememoryCOMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(?,00000000,00000000,0000005C,Everyone,10000000,00000000,?,00000000), ref: 003E2FA9
LocalFree.KERNEL32(?,00000000,00000000,0000005C,Everyone,10000000,00000000,?,00000000), ref: 003E2FB9
GetLastError.KERNEL32(?,00000000), ref: 003E2FF7
LocalAlloc.KERNEL32(00000040,00000014,?,00000000), ref: 003E3036
GetLastError.KERNEL32(?,00000000), ref: 003E3050
LocalFree.KERNEL32(?,?,00000000), ref: 003E3061
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000,E48E37CD,774CF530,?,?), ref: 003E3100
GetLastError.KERNEL32 ref: 003E311E
GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 003E314B
GetLastError.KERNEL32 ref: 003E3155
FileTimeToSystemTime.KERNEL32(?,?), ref: 003E31DA
GetLastError.KERNEL32 ref: 003E31E4
SystemTimeToFileTime.KERNEL32(?,?), ref: 003E321C
SystemTimeToFileTime.KERNEL32(00000000,004C341C), ref: 003E323D
CompareFileTime.KERNEL32(004C341C,?), ref: 003E324F
PathFileExistsW.SHLWAPI(?,00000005), ref: 003E32EC
CreateFileW.KERNEL32(?,C0000000,00000000,0000000C,00000002,00000080,00000000,00000001,S-1-1-0,10000000,00000001), ref: 003E3387
GetLastError.KERNEL32 ref: 003E3397
CloseHandle.KERNEL32(00000000), ref: 003E339F

Strings

S-1-1-0, xrefs: 003E3341
S-1-5-18, xrefs: 003E3352
.part, xrefs: 003E3291

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: FileTime$ErrorLast$Local$FreeSystem$Create$AllocCloseCompareExistsHandlePath
String ID: .part$S-1-1-0$S-1-5-18
API String ID: 1123205858-2727065896
Opcode ID: 8caf83891f3c7b930fa95f16ef10171e80708dbfe1c4e0bdf4d0be758c4e3656
Instruction ID: 74f47bc4f173e5e129e5570a3350d1d0d359d2f5eaa5403c9ccb2390cb6e5563
Opcode Fuzzy Hash: 8caf83891f3c7b930fa95f16ef10171e80708dbfe1c4e0bdf4d0be758c4e3656
Instruction Fuzzy Hash: 57127B70A007949FDB22DF6AC848BAABBF4BF44304F15462DE546976E0DBB0EA44CF51

Function 003ADB40 Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 167COMMON

Download Yara Rule

APIs

OutputDebugStringW.KERNEL32(?,E48E37CD,?,?,?,0049C4C5,000000FF,?,003E04CF,?,?,?,00000000), ref: 003ADCD8
GetActiveWindow.USER32 ref: 003ADC3A

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Strings

TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1, xrefs: 003AE8B7
"%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 003AECDF
REINSTALL=ALL REINSTALLMODE=vomus , xrefs: 003AED93
TRANSFORMS=:%s.mst MSINEWINSTANCE=1 , xrefs: 003AE910
.mst, xrefs: 003AE797, 003AE7FE, 003AECBE
AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 , xrefs: 003AEB95
majorupgrade-content.mst, xrefs: 003AE756, 003AEC4F
|3L, xrefs: 003AEA9F
.msi, xrefs: 003AE747, 003AEC40
MSINEWINSTANCE=1 , xrefs: 003AE8E6
T`T, xrefs: 003ADBC6
|3L, xrefs: 003AE992
bT, xrefs: 003AE2E7
"%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 003AE7B2
TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 , xrefs: 003AE8FF
%s , xrefs: 003AEA4C, 003AED81
"%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 , xrefs: 003AE818

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$ActiveDebugHeapOutputProcessStringWindow
String ID: "%s" TRANSFORMS="%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_MAJORUPGRADE=1 AI_NEWINST=1 $ "%s" TRANSFORMS="%s;%s;%s" AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ %s $ AI_INST_PRODCODES=%s AI_INTANCE_LOCATION="%s" AI_INST_MAJORUPGRADE=1 $ MSINEWINSTANCE=1 $ REINSTALL=ALL REINSTALLMODE=vomus $ TRANSFORMS="%s" AI_INST_MAJORUPGRADE=1$ TRANSFORMS=":%s.mst;%s" MSINEWINSTANCE=1 $ TRANSFORMS=:%s.mst MSINEWINSTANCE=1 $.msi$.mst$T`T$majorupgrade-content.mst$|3L$|3L$bT
API String ID: 758407959-2942436244
Opcode ID: ae711d88230327bf4a3985d8f94aa7d578a18b12816edb8758060a13e80a9de2
Instruction ID: 8bc97dcd2ad3b5d0a92ee1cb93f605e71b2946d3edbdd7543cd4dbb94de259b5
Opcode Fuzzy Hash: ae711d88230327bf4a3985d8f94aa7d578a18b12816edb8758060a13e80a9de2
Instruction Fuzzy Hash: 9F51CE75A002059FDB15DB6CC8497AEBBF4EF46324F1582A9E8169B291DB309D04CFA1

Function 003D4B10 Relevance: 30.1, APIs: 9, Strings: 8, Instructions: 335COMMON

Download Yara Rule

Strings

ps1, xrefs: 003D4BB6, 003D4BC8, 003D4BD2
Unable to retrieve PowerShell output from file: , xrefs: 003D4E6F
Unable to get a temp file for script output, temp path: , xrefs: 003D4C1F
txt, xrefs: 003D4BE3
powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new, xrefs: 003D4C6F
Unable to find file , xrefs: 003D4B43
Unable to create process: , xrefs: 003D4D15
Unable to retrieve exit code from process., xrefs: 003D4E92

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Unable to create process: $Unable to find file $Unable to get a temp file for script output, temp path: $Unable to retrieve PowerShell output from file: $Unable to retrieve exit code from process.$powershell.exe -NonInteractive -NoLogo -ExecutionPolicy Unrestricted -WindowStyle Hidden -Command "$host.UI.RawUI.BufferSize = new$ps1$txt
API String ID: 0-4129021124
Opcode ID: 0f2561f19779dd982f1e978a2dfec1e6803f4df1e6b2291d0b05002d483b4072
Instruction ID: e555946293e048f8e46ac3142bd2b9bc116ea589640eae20897819f7f1c0f396
Opcode Fuzzy Hash: 0f2561f19779dd982f1e978a2dfec1e6803f4df1e6b2291d0b05002d483b4072
Instruction Fuzzy Hash: 91C1CF71D01649EFDB11DFA8DD05BAEBBB8BF05314F20825AF414AB291DB74AA44CF90

Function 002AF5F0 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 119COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00546250,E48E37CD,00000000,?,?,?,?,?,?,P*,0045F68D,000000FF), ref: 002AF62D
LoadCursorW.USER32(00000000,00007F00), ref: 002AF6A8
LoadCursorW.USER32(00000000,00007F00), ref: 002AF74E
LeaveCriticalSection.KERNEL32(00546250), ref: 002AF7A3

Strings

cw, xrefs: 002AF7A3
PbT, xrefs: 002AF616
P*, xrefs: 002AF600
AtlAxWinLic140, xrefs: 002AF70F, 002AF765
f.C, xrefs: 002AF6D1, 002AF76F
WM_ATLGETHOST, xrefs: 002AF639
AtlAxWin140, xrefs: 002AF65F, 002AF6C3
p.C, xrefs: 002AF650
WM_ATLGETCONTROL, xrefs: 002AF644
lbT, xrefs: 002AF6E9
0, xrefs: 002AF733
lbT, xrefs: 002AF783

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalCursorLoadSection$EnterLeave
String ID: cw$0$AtlAxWin140$AtlAxWinLic140$PbT$P*$WM_ATLGETCONTROL$WM_ATLGETHOST$f.C$lbT$lbT$p.C
API String ID: 3727441302-1407494585
Opcode ID: 9ba2d6931ff2c79fd98801b8698c6a15886da19ce320c5682a470b4812b125fe
Instruction ID: e0d86904920c430da3f03ad54d2b74773e69b442f6bc1b1540d0ed17c527f97b
Opcode Fuzzy Hash: 9ba2d6931ff2c79fd98801b8698c6a15886da19ce320c5682a470b4812b125fe
Instruction Fuzzy Hash: 89513CB8C11319AFCB51DF94D944BDEBFF8BB09718F10412AE404B7290DBB955098FA4

Function 002B16D0 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 359stringCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 002B1770
GetParent.USER32(?), ref: 002B17B1
lstrcmpW.KERNEL32(?,#32770), ref: 002B17D1
GetWindowLongW.USER32(?,000000F0), ref: 002B1871

Strings

#32770, xrefs: 002B17C8
L4C, xrefs: 002B19B9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$LongParentlstrcmp
String ID: #32770$L4C
API String ID: 4031819654-1073857517
Opcode ID: c417ae4c4dd2979e0511a7a9a6297db811cab755b17040663bd71abced4d9cbb
Instruction ID: dd66144f5ad94a467a31f63ef765a59d34aa18e8a4a5bfbe083a5b2094083e12
Opcode Fuzzy Hash: c417ae4c4dd2979e0511a7a9a6297db811cab755b17040663bd71abced4d9cbb
Instruction Fuzzy Hash: C1E1AD74A1120AEFDB14CFA4C858BEEBBB5FF09354F548159E801AB290DB74AD64CF60

Function 003A9E90 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000001F6), ref: 003A9EDE
GetDlgItem.USER32(?,000001F8), ref: 003A9EEB
GetDlgItem.USER32(?,000001F7), ref: 003A9F38
SetWindowTextW.USER32(00000000,00000000), ref: 003A9F47
ShowWindow.USER32(?,00000005), ref: 003A9F67

Part of subcall function 003A93B0: GetWindowLongW.USER32(?,000000F0), ref: 003A93EF
Part of subcall function 003A93B0: GetWindowLongW.USER32(?,000000F0), ref: 003A9400
Part of subcall function 003A93B0: SetWindowLongW.USER32(?,000000F0,00000000), ref: 003A9412
Part of subcall function 003A93B0: GetWindowLongW.USER32(?,000000EC), ref: 003A9425
Part of subcall function 003A93B0: SetWindowLongW.USER32(?,000000EC,00000000), ref: 003A9434
Part of subcall function 003A93B0: SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 003A9448
Part of subcall function 003A93B0: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003A9457

GetDlgItem.USER32(?,000001F7), ref: 003A9F86
SetWindowTextW.USER32(00000000,00000000), ref: 003A9F95
ShowWindow.USER32(?,00000000), ref: 003A9FB5
ShowWindow.USER32(?,00000000), ref: 003A9FBC
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000616), ref: 003AA005
GetDlgItem.USER32(00000000,00000000), ref: 003AA039
IsWindow.USER32(00000000), ref: 003AA043
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,00000616), ref: 003AA090

Strings

Details >>, xrefs: 003A9F6D
Details <<, xrefs: 003A9F1F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$ItemLong$Show$MessageSendText
String ID: Details <<$Details >>
API String ID: 1573988680-3763984547
Opcode ID: a489654c9d3eb707eaf3da083139643d4a48c9379b59f6251f6db3d130af4112
Instruction ID: 294a166ee244e9ccd134b32fd15969ecf89e5a9af7e8cf75a06b09fb1dee741f
Opcode Fuzzy Hash: a489654c9d3eb707eaf3da083139643d4a48c9379b59f6251f6db3d130af4112
Instruction Fuzzy Hash: F171CB72900608ABDF25DFA8DC46BAEFBF4EF59704F20861DE401A72A0DB71A845DF50

Function 002D2860 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 404memorysynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

CreateThread.KERNEL32(00000000,00000000,002D29B0,004C7458,00000000,?), ref: 002D292A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 002D2943
CloseHandle.KERNEL32(00000000), ref: 002D2959
CoInitializeEx.COMBASE(00000000,00000000), ref: 002D2A09
GetProcessHeap.KERNEL32(?,00000000), ref: 002D2B0B
HeapFree.KERNEL32(00000000,?,00000000), ref: 002D2B11
GetProcessHeap.KERNEL32(?,00000000), ref: 002D2B90
HeapFree.KERNEL32(00000000,?,00000000), ref: 002D2B96
CoUninitialize.COMBASE ref: 002D2CEA
Concurrency::cancel_current_task.LIBCPMT ref: 002D2D6B

Strings

$tL, xrefs: 002D2BCE
|3L, xrefs: 002D2B69
|3L, xrefs: 002D2AE5
XtL, xrefs: 002D2902

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$Process$FreeInit_thread_footer$CloseConcurrency::cancel_current_taskCreateHandleInitializeObjectSingleThreadUninitializeWait
String ID: $tL$XtL$|3L$|3L
API String ID: 1779960141-2943586925
Opcode ID: 714d86a90f0cbf1bf56f67660c5ad60fd42c1bde2fd7d98ee47fba857643a4d9
Instruction ID: c934d65b00c5328f2bde0fed9a530158f021ad549211f23d88f544759004a37c
Opcode Fuzzy Hash: 714d86a90f0cbf1bf56f67660c5ad60fd42c1bde2fd7d98ee47fba857643a4d9
Instruction Fuzzy Hash: 6AF16C70D10249DFDB14CFA8C945BEEBBB8EF54304F24815AE815AB391DB749E48CBA1

Function 003E2A10 Relevance: 24.9, APIs: 11, Strings: 3, Instructions: 390libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Advapi32.dll,E48E37CD,00000000,00000000), ref: 003E2AA1
GetLastError.KERNEL32 ref: 003E2ACF

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

GetProcAddress.KERNEL32(00000000,ConvertStringSidToSidW), ref: 003E2AE5
FreeLibrary.KERNEL32(00000000), ref: 003E2AFE
GetLastError.KERNEL32 ref: 003E2B0B
GetLastError.KERNEL32 ref: 003E2CF9
GetLastError.KERNEL32 ref: 003E2D5E

Strings

ConvertStringSidToSidW, xrefs: 003E2ADF
,(M, xrefs: 003E2B30
Advapi32.dll, xrefs: 003E2A9C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLast$Library$AddressAllocateFreeHeapLoadProc
String ID: ,(M$Advapi32.dll$ConvertStringSidToSidW
API String ID: 3460774402-317402887
Opcode ID: 9682417a43f03c5a78d22a67eee0105e79e87b8d881f6f982e7a74846fcf96cd
Instruction ID: 32a42aee424ae3086f0586b127903387312748b5eb9f9c505ad8caa7d1c320c4
Opcode Fuzzy Hash: 9682417a43f03c5a78d22a67eee0105e79e87b8d881f6f982e7a74846fcf96cd
Instruction Fuzzy Hash: 49F1ADB1C0125AABDF01DF95C944BEEBBB8FF08314F218219E914B7280D774AA45CBA5

Function 002DD6E0 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 246libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,E48E37CD,?,?,00000000,?,?,?,?,?,?,E48E37CD,00468E95,000000FF), ref: 002DD74D
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002DD753
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,?,E48E37CD,00468E95,000000FF,?,002F45FA,004CB84C,E48E37CD,E48E37CD), ref: 002DD783
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002DD789

Strings

combase.dll, xrefs: 002DD748, 002DD77E
DllGetActivationFactory, xrefs: 002DD902
RoGetActivationFactory, xrefs: 002DD743
CoIncrementMTAUsage, xrefs: 002DD779
.dll, xrefs: 002DD8A6
|3L, xrefs: 002DD81D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$|3L
API String ID: 2574300362-1837049438
Opcode ID: 0d34914e36183910fd7ac1845c39a622171b3510cc0b860a4c353f37c6fd4350
Instruction ID: f142aeb54a3a39350bd04cf5db779681772b602694a5b6c8fc2d383f2119ca97
Opcode Fuzzy Hash: 0d34914e36183910fd7ac1845c39a622171b3510cc0b860a4c353f37c6fd4350
Instruction Fuzzy Hash: 75A1AD7192060AEFDF15DFA9C895BEDBBB4EF08314F24402AE411E7291DBB49E19CB50

Function 003A8440 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 223threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(0054611C,E48E37CD,?,?,00000000,?,?,?,?,?,00000000,0049B407,000000FF), ref: 003A84B3
EnterCriticalSection.KERNEL32(?,E48E37CD,?,?,00000000,?,?,?,?,?,00000000,0049B407,000000FF), ref: 003A84C5
GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,00000000,0049B407,000000FF), ref: 003A84D2
GetCurrentThread.KERNEL32 ref: 003A84DD
GetModuleHandleW.KERNEL32(00000000,*** Stack Trace (x86) ***,0000001F,00000000,?,004C337C,00000000,?,?,?,?,?,00000000,0049B407,000000FF), ref: 003A86BE
LeaveCriticalSection.KERNEL32(?,004C337C,00000000,?,?,?,?,?,00000000,0049B407,000000FF), ref: 003A879A

Strings

cw, xrefs: 003A879A
[0x%.8Ix] , xrefs: 003A86C5
MODULE_BASE_ADDRESS, xrefs: 003A870B
4aT, xrefs: 003A84BB
<--------------------MORE--FRAMES-------------------->, xrefs: 003A8662
*** Stack Trace (x86) ***, xrefs: 003A85B7
{tC, xrefs: 003A8502

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$Current$EnterHandleInitializeLeaveModuleProcessThread
String ID: *** Stack Trace (x86) ***$ cw$4aT$<--------------------MORE--FRAMES-------------------->$MODULE_BASE_ADDRESS$[0x%.8Ix] ${tC
API String ID: 3051236879-3119634080
Opcode ID: a826d207ae59db2c6e43abc55fab92b78bdf0691ff016ee1955dd4b3e420244b
Instruction ID: 515762e217dcb6ad89f0af4e95c799c7926e9dc2a843654541d816976f8a1571
Opcode Fuzzy Hash: a826d207ae59db2c6e43abc55fab92b78bdf0691ff016ee1955dd4b3e420244b
Instruction Fuzzy Hash: AFA18A709002889FDF26DFA4CC45BEE7BA8FF06308F104129E909AB291DBB55B08CF55

Function 002D3400 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 222libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoGetActivationFactory,E48E37CD,?,?,?,?,?,?,?,E48E37CD,004664A5,000000FF,?,002D371A,004C74D0), ref: 002D3467
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002D346D
LoadLibraryW.KERNEL32(combase.dll,CoIncrementMTAUsage,?,?,?,?,?,E48E37CD,004664A5,000000FF,?,002D371A,004C74D0,E48E37CD,E48E37CD), ref: 002D349E
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002D34A4

Strings

combase.dll, xrefs: 002D3462, 002D3499
DllGetActivationFactory, xrefs: 002D35E9
|3L, xrefs: 002D353A
RoGetActivationFactory, xrefs: 002D345D
CoIncrementMTAUsage, xrefs: 002D3494
.dll, xrefs: 002D35A9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$CoIncrementMTAUsage$DllGetActivationFactory$RoGetActivationFactory$combase.dll$|3L
API String ID: 2574300362-1837049438
Opcode ID: bd472b4367a855be950555b0beb9cc0e51c89447f00d5dbc444a6fe42e82b4df
Instruction ID: d779c5c2f7cfd98a0e942b939517f376f786e81f4ef21a5898fd8c41e81a37c1
Opcode Fuzzy Hash: bd472b4367a855be950555b0beb9cc0e51c89447f00d5dbc444a6fe42e82b4df
Instruction Fuzzy Hash: CA81A070910209EFDB15DFA8D885BEEBBB4EF08314F14412AE411B7391DBB49E58CBA5

Function 003D74C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 192fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00546054,E48E37CD,?,00000010), ref: 003D74FC

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

EnterCriticalSection.KERNEL32(00000010,E48E37CD,?,00000010), ref: 003D7509
WriteFile.KERNEL32(00000000,?,?,000000FF,00000000), ref: 003D753B
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 003D7544
WriteFile.KERNEL32(00000000,003C3C07,6054B9EC,004A500D,00000000,004C334C,00000001,?,?,000000FF,00000000), ref: 003D75C6
FlushFileBuffers.KERNEL32(00000000,?,?,000000FF,00000000), ref: 003D75CF
WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 003D7605
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 003D760E
WriteFile.KERNEL32(00000000,?,?,?,00000000,004C58A8,00000002,?,?,?,00000000,?,?,000000FF,00000000), ref: 003D766F
FlushFileBuffers.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 003D7678
LeaveCriticalSection.KERNEL32(00000000,?,?,?,00000000,?,?,000000FF,00000000), ref: 003D76A8

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Strings

cw, xrefs: 003D76A8
L3L, xrefs: 003D7589

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$BuffersFlushWrite$CriticalSection$AllocateEnterFindHeapInitializeLeaveResource
String ID: cw$L3L
API String ID: 201293332-527411866
Opcode ID: 438fa2c2e4dbef36781773c3aee92a7de60e7135391495df5c1e3a029de0789d
Instruction ID: 94d5096c8e64212c42f5ad2539b7a647de28e2784e155231c639e285466a9c09
Opcode Fuzzy Hash: 438fa2c2e4dbef36781773c3aee92a7de60e7135391495df5c1e3a029de0789d
Instruction Fuzzy Hash: 11619D31905645AFDB01DF68DD49BAABBB8FF06314F14826AF805973A1EB309D14CFA4

Function 002FA430 Relevance: 21.2, APIs: 14, Instructions: 243COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 002FA49E
SetWindowLongW.USER32(?,000000F0,00C80000), ref: 002FA4CC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 002FA4E1
GetWindowLongW.USER32(?,000000EC), ref: 002FA518
SetWindowLongW.USER32(?,000000EC,00000000), ref: 002FA545
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 002FA559
GetWindowLongW.USER32(?,000000F0), ref: 002FA57B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 002FA592
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037), ref: 002FA5A6
GetWindowRect.USER32(?,?), ref: 002FA5F6
GetWindowLongW.USER32(?,000000EC), ref: 002FA61C
GetWindowRect.USER32(?,?), ref: 002FA66A
SetWindowPos.USER32(?,00000000,?,?,?,?,00000604,?,?), ref: 002FA6A0
SetWindowTextW.USER32(?,?), ref: 002FA6E1

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$Rect$Text
String ID:
API String ID: 445026432-0
Opcode ID: ea5f642f7c128f946fad53edd58b187b195b424158b7a40f75d42c6798585ee4
Instruction ID: 57b95f4efc40d16e014f12dac289fb02101a2bb886db29bd992c4e5834e4d0f4
Opcode Fuzzy Hash: ea5f642f7c128f946fad53edd58b187b195b424158b7a40f75d42c6798585ee4
Instruction Fuzzy Hash: F0917E75A00609AFDF04CFA8DC45BEEBBB5FF48314F204229F526A72A4DB35A914CB50

Function 003059B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 170COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 003059F7
GetParent.USER32 ref: 00305A0D
GetWindowRect.USER32(?,?), ref: 00305A18
GetParent.USER32(?), ref: 00305A20
GetWindow.USER32(?,00000004), ref: 00305A52
GetWindowRect.USER32(?,?), ref: 00305A60
GetWindowLongW.USER32(00000000,000000F0), ref: 00305A6D
MonitorFromWindow.USER32(?,00000002), ref: 00305A85
GetMonitorInfoW.USER32(00000000,?), ref: 00305A9F
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015,?,00000004), ref: 00305B4D

Strings

$/C, xrefs: 00305A44

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$LongMonitorParentRect$FromInfo
String ID: $/C
API String ID: 1820395375-1036787561
Opcode ID: 97890378fe88a0a620fc2081a53ad5f4f092465d2db6107eaf5e8b02fc9542de
Instruction ID: 45eb99033a80a3de85275996ba05faef5a7d68ac9f914665400b8d29e165a8ef
Opcode Fuzzy Hash: 97890378fe88a0a620fc2081a53ad5f4f092465d2db6107eaf5e8b02fc9542de
Instruction Fuzzy Hash: D3516D76E01519AFDF11CFA8CD45BEEBBB9EB49710F254229E815A3294DB30AD04CF90

Function 003A93B0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 150windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 003A93EF
GetWindowLongW.USER32(?,000000F0), ref: 003A9400
SetWindowLongW.USER32(?,000000F0,00000000), ref: 003A9412
GetWindowLongW.USER32(?,000000EC), ref: 003A9425
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003A9434
SendMessageW.USER32(?,0000007F,00000000,00000000), ref: 003A9448
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003A9457
GetWindowRect.USER32(?,?), ref: 003A9496
GetDlgItem.USER32(?,?), ref: 003A94D2
IsWindow.USER32(00000000), ref: 003A94DD
GetWindowRect.USER32(?,?), ref: 003A94F8

Strings

$/C, xrefs: 003A9509

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$MessageRectSend$Item
String ID: $/C
API String ID: 661679956-1036787561
Opcode ID: 5d3bbdaed82bba2db6c090e4cb2c310333dfae4ff9bb536efeb054233dcf1c24
Instruction ID: f1a4ff14cb7f0f41063d29e4c786fa5e6304a3b7ea3294d6bc54ab5b9b6fce6a
Opcode Fuzzy Hash: 5d3bbdaed82bba2db6c090e4cb2c310333dfae4ff9bb536efeb054233dcf1c24
Instruction Fuzzy Hash: FD41BF355047019FDB21DF69DC84B6BB7E4FF6A314F118A1EF599A2291DB30E8888F21

Function 003A9D00 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A2350: LoadLibraryW.KERNEL32(ComCtl32.dll,E48E37CD,00000000,?,00000000), ref: 003A238E
Part of subcall function 003A2350: GetProcAddress.KERNEL32(00000000,LoadIconMetric), ref: 003A23B1
Part of subcall function 003A2350: FreeLibrary.KERNEL32(00000000), ref: 003A242F

GetDlgItem.USER32(?,000001F4), ref: 003A9D41
SendMessageW.USER32(00000000,00000170,00000000,00000000), ref: 003A9D52
MulDiv.KERNEL32(00000009,00000000), ref: 003A9D6A
GetDlgItem.USER32(?,000001F6), ref: 003A9DA4
IsWindow.USER32(00000000), ref: 003A9DAD
SendMessageW.USER32(00000000,00000030,?,00000000), ref: 003A9DC4
GetDlgItem.USER32(?,000001F8), ref: 003A9DCE
GetWindowRect.USER32(?,?), ref: 003A9DDF
GetWindowRect.USER32(?,?), ref: 003A9DF2
GetWindowRect.USER32(00000000,?), ref: 003A9E02

Strings

Courier New, xrefs: 003A9D70
;3C, xrefs: 003A9D93

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$ItemRect$LibraryMessageSend$AddressFreeLoadProc
String ID: ;3C$Courier New
API String ID: 1717253393-4221049048
Opcode ID: 261864c9eee09e5b8b7a0e57a16e633757c0f3eeb7828199f9beb8cc875766b4
Instruction ID: c2e0eceda4275d61b9aa3fc1dffcf716478fc60eac2e7bb1559d129ffa4d0db3
Opcode Fuzzy Hash: 261864c9eee09e5b8b7a0e57a16e633757c0f3eeb7828199f9beb8cc875766b4
Instruction Fuzzy Hash: 7641D475BC43087BEB14AF21CC46FEE77A9EF59B08F010619FB057A1C1DAB4A8448B54

Function 003CEC20 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 413registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,Software\JavaSoft\Java Development Kit\,00000000,?,?,E48E37CD,?,?), ref: 003CEC83
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,?,?,?), ref: 003CEE19
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?,?,?,?), ref: 003CEE75
RegQueryValueExW.ADVAPI32(?,JavaHome,00000000,00000000,00000000,?), ref: 003CEEC5
RegCloseKey.ADVAPI32(?), ref: 003CEF05

Strings

Software\JavaSoft\Java Development Kit\, xrefs: 003CEC75, 003CEC7D
Software\JavaSoft\Java Runtime Environment\, xrefs: 003CEC66
JavaHome, xrefs: 003CEE6F, 003CEEBA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: OpenQueryValue$Close
String ID: JavaHome$Software\JavaSoft\Java Development Kit\$Software\JavaSoft\Java Runtime Environment\
API String ID: 2529929805-1079072530
Opcode ID: 906de394bc1be0127f2a5adde41a363d5b9ea1b20dacd5e4e7f81aa3db6262f6
Instruction ID: 33a121aff357250567d09a8ec2e938dad532b45cb2ccabc4059d58441d179a55
Opcode Fuzzy Hash: 906de394bc1be0127f2a5adde41a363d5b9ea1b20dacd5e4e7f81aa3db6262f6
Instruction Fuzzy Hash: A6027B709012699FDB21DF28CC88BDEB7B5AF54304F1442E9E809E7291DB75AE84CF50

Function 003D81B0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 302libraryloaderCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000023,?,E48E37CD,?,?,00546054), ref: 003D81F8
LoadLibraryW.KERNEL32(Shell32.dll,?,00546054), ref: 003D8207
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 003D821B
SHGetPathFromIDListW.SHELL32(?,00000000), ref: 003D829A
SHGetMalloc.SHELL32(?), ref: 003D82D7
PathFileExistsW.SHLWAPI(?,ADVINST_LOGS,0000000C,?,00000000), ref: 003D832A
CreateDirectoryW.KERNEL32(?,?,Everyone,10000000,00000000,?,00000000), ref: 003D83B5

Strings

ADVINST_LOGS, xrefs: 003D831D
Shell32.dll, xrefs: 003D8202
SHGetSpecialFolderPathW, xrefs: 003D8215
Everyone, xrefs: 003D8371

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Path$AddressCreateDirectoryExistsFileFolderFromLibraryListLoadLocationMallocProcSpecial
String ID: ADVINST_LOGS$Everyone$SHGetSpecialFolderPathW$Shell32.dll
API String ID: 1254244429-1733115844
Opcode ID: cc10c04c5b88ee8056b4f438075c38b3e08304b7cd7503b6ebb81cb65bfcabad
Instruction ID: 6a60bce17c8719786e1515a765786493c65a2e35c566efdc44a19dc22d1d9803
Opcode Fuzzy Hash: cc10c04c5b88ee8056b4f438075c38b3e08304b7cd7503b6ebb81cb65bfcabad
Instruction Fuzzy Hash: FBB1DC72D00609DFDB11DFA9D849BAEBBF4AF55314F25821AE411AB3A0EB746A04CF50

Function 002CC7D0 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,tooltips_class32,00000000,80000063,80000000,80000000,80000000,80000000,?,00000000,00000000,E48E37CD), ref: 002CC85C

Part of subcall function 002B0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 002B0DE6

SendMessageW.USER32(00000000,00000432,00000000,0000002C), ref: 002CC95F
SendMessageW.USER32(00000000,00000439,00000000,0000002C), ref: 002CC973
SendMessageW.USER32(00000000,00000421,00000003,?), ref: 002CC988
SendMessageW.USER32(00000000,00000418,00000000,0000012C), ref: 002CC99D
SendMessageW.USER32(?,000000D6,-00000001,00000000), ref: 002CC9B4
GetWindowRect.USER32(?,?), ref: 002CC9E6
SendMessageW.USER32(00000000,00000412,00000000), ref: 002CCA48
SendMessageW.USER32(00000000,00000411,00000001,0000002C), ref: 002CCA58

Strings

tooltips_class32, xrefs: 002CC855
,, xrefs: 002CC90E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$Window$CreateLongRect
String ID: ,$tooltips_class32
API String ID: 1954517558-3856767331
Opcode ID: cbbcd334ea189b457a7c74785760386d8113550d7daef971301d198a5c99c943
Instruction ID: ca51296881fd4c8424194d50920d8c31efb72d7b32e64b8bc0a8b83da99a4d57
Opcode Fuzzy Hash: cbbcd334ea189b457a7c74785760386d8113550d7daef971301d198a5c99c943
Instruction Fuzzy Hash: 5E913B71A40208AFEB14CFA4DD95FEEBBF8FB08304F10452AE516EA290D774A914DF50

Function 003A9A60 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 202COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 003A9A94
EndDialog.USER32(?,00000000), ref: 003A9B52

Part of subcall function 003A9550: SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 003A9582
Part of subcall function 003A9550: GetWindowLongW.USER32(?,000000F0), ref: 003A9588
Part of subcall function 003A9550: GetDlgItem.USER32(?,?), ref: 003A95FA
Part of subcall function 003A9550: GetWindowRect.USER32(00000000,?), ref: 003A9612

Strings

L/C, xrefs: 003A9B71
U2C, xrefs: 003A9AE0

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Long$DialogItemMessageRectSend
String ID: L/C$U2C
API String ID: 188208873-2968307040
Opcode ID: 2e3e3d03232698fc4dc4a986a51ef94a9acb7f9f2d97d187acd40b7ca37ca1a2
Instruction ID: a9dd7eb18eddd2d24ef31ed9901d47aba4b9641a55742781c2e16aafaf3fc072
Opcode Fuzzy Hash: 2e3e3d03232698fc4dc4a986a51ef94a9acb7f9f2d97d187acd40b7ca37ca1a2
Instruction Fuzzy Hash: 5E71BF35A006059BDB25CF68CC89BAEBBF8FB4A724F11061AE412F7AD0D774D944DB50

Function 003A5310 Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 492COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 003A54AE
__Init_thread_footer.LIBCMT ref: 003A5607
GetStdHandle.KERNEL32(000000F5,?,E48E37CD,?,?), ref: 003A568F
GetConsoleScreenBufferInfo.KERNEL32(00000000,?,?), ref: 003A5696
GetStdHandle.KERNEL32(000000F5,0000000C,?,?), ref: 003A56AA
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 003A56B1

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

GetStdHandle.KERNEL32(000000F5,000000FF,?,00000000,00000000,00000000,004C58A8,00000002,?,?), ref: 003A5740
SetConsoleTextAttribute.KERNEL32(00000000,?,?), ref: 003A5747
IsWindow.USER32(00000000), ref: 003A5960

Strings

Error, xrefs: 003A58FF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ConsoleHandle$AttributeCriticalInit_thread_footerSectionText$BufferEnterInfoLeaveScreenWindow
String ID: Error
API String ID: 2811146417-2619118453
Opcode ID: c1eee61d2e544af6cb002bb97cfb65f57175e4fbea56b1cba0f454f5a66656b4
Instruction ID: cc06795f948bd8f6a80f3064af55d789cd11d0f38a9b264f4b3a2ec4ae5edb57
Opcode Fuzzy Hash: c1eee61d2e544af6cb002bb97cfb65f57175e4fbea56b1cba0f454f5a66656b4
Instruction Fuzzy Hash: 512238B0D10708DFDB10CFA4C845BDEBBB4EF5A318F244299E419AB291DB759A88CF51

Function 003CF880 Relevance: 17.8, APIs: 4, Strings: 6, Instructions: 296libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00361FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00361FF1
Part of subcall function 00361FB0: _wcschr.LIBVCRUNTIME ref: 003620AF

GetLastError.KERNEL32(E48E37CD,?,?,?,000000FF,?,003B4196,?,?), ref: 003CF8ED
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 003CFA7A
GetProcAddress.KERNEL32(00000000,GetPackagePath), ref: 003CFADE
FreeLibrary.KERNEL32(00000000,?,?,000000FF,?,003B4196,?,?), ref: 003CFBD2

Strings

x64, xrefs: 003CF966
,(M, xrefs: 003CFBC6
Kernel32.dll, xrefs: 003CF8C1
neutral, xrefs: 003CF982
GetPackagePath, xrefs: 003CFA74, 003CFAD8
x86, xrefs: 003CF938

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressProc$DirectoryErrorFreeLastLibrarySystem_wcschr
String ID: ,(M$GetPackagePath$Kernel32.dll$neutral$x64$x86
API String ID: 3734293021-3400532891
Opcode ID: 4abfc2d98521adcc4dd6306a40517ac56cce219ec75488e08c130c0831fa66ea
Instruction ID: b40df37a59274ab4d2160aa8eea059d34c3c06826887f15d2ea9753546f0405a
Opcode Fuzzy Hash: 4abfc2d98521adcc4dd6306a40517ac56cce219ec75488e08c130c0831fa66ea
Instruction Fuzzy Hash: 93C14674A002099FDB04DFA9C894BAEBBB5EF09314F15826DE815EB391DB749D44CFA0

Function 002B2500 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 155COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00546250,E48E37CD,00000000,0054626C), ref: 002B2573
LeaveCriticalSection.KERNEL32(00546250), ref: 002B25D7
LoadCursorW.USER32(002A0000,?), ref: 002B2630
LeaveCriticalSection.KERNEL32(00546250), ref: 002B26C8

Strings

cw, xrefs: 002B25D7, 002B26C8
f.C, xrefs: 002B2699
p.C, xrefs: 002B25AA, 002B25C1, 002B2686
ATL:%p, xrefs: 002B2650
lbT, xrefs: 002B26AD
PbT, xrefs: 002B255C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$Leave$CursorEnterLoad
String ID: cw$ATL:%p$PbT$f.C$lbT$p.C
API String ID: 2080323225-2779732177
Opcode ID: 51c3128e5509ed23c79bedd3d302289eadf053f31c074c03de4a08266c7184da
Instruction ID: fcd0f325bcf94d8e98e8dd5ee756817b524373ada2601ac2b88dd890f0935caf
Opcode Fuzzy Hash: 51c3128e5509ed23c79bedd3d302289eadf053f31c074c03de4a08266c7184da
Instruction Fuzzy Hash: 9E519B74D04B45DBDB20CF69C9457AAFBF4FF19314F00861DE896A3690EB70A998CB50

Function 003F2A80 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 282COMMON

Download Yara Rule

Strings

Progress, xrefs: 003F2ABD
PropertyValue, xrefs: 003F2CC9
Visible, xrefs: 003F2B6D
Text, xrefs: 003F2AFA
TimeRemaining, xrefs: 003F2C4F
Enabled, xrefs: 003F2BE0

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Enabled$Progress$PropertyValue$Text$TimeRemaining$Visible
API String ID: 0-2691827946
Opcode ID: 83ac30c6ef55a216e8928e34e86db8e645a6c8c5356aa21cfddde2ed00c72ffc
Instruction ID: 1e2feee5cddd3f238e15752ce39a0d308f1e16aaaabb881f65b9effaf4b9a927
Opcode Fuzzy Hash: 83ac30c6ef55a216e8928e34e86db8e645a6c8c5356aa21cfddde2ed00c72ffc
Instruction Fuzzy Hash: 42B19BB1A00349DFDB14CF48D944BAEBBB1FB55320F10826EE9259B390D7B99A10CB95

Function 003CD7C0 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 121COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 003CD7F6

Strings

HKCR, xrefs: 003CD87D
HKEY_LOCAL_MACHINE, xrefs: 003CD83D
HKEY_CURRENT_USER, xrefs: 003CD869
HKEY_CURRENT_CONFIG, xrefs: 003CD8B9
HKEY_CLASSES_ROOT, xrefs: 003CD891
HKLM, xrefs: 003CD825
HKCU, xrefs: 003CD855
HKCC, xrefs: 003CD8A5

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: _wcschr
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKLM
API String ID: 2691759472-1956487666
Opcode ID: fbc92ee330ee7bc1047c44852e98fc6674a8e863639320815946426d4814d33c
Instruction ID: cfaf11b12af3802618300204ab9d917e13e504acc03c98ede4a7e96162d593f9
Opcode Fuzzy Hash: fbc92ee330ee7bc1047c44852e98fc6674a8e863639320815946426d4814d33c
Instruction Fuzzy Hash: 1A41F676E40605ABEB115B65CC02F2AB7A8EB00311F14063FBC10E26D0EB79DC10CB65

Function 002C3190 Relevance: 15.3, APIs: 10, Instructions: 339memoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002C31EA
VariantClear.OLEAUT32(?), ref: 002C321C
VariantClear.OLEAUT32(?), ref: 002C3316
VariantClear.OLEAUT32(?), ref: 002C3345
SysFreeString.OLEAUT32(00000000), ref: 002C334C
SysAllocString.OLEAUT32(00000000), ref: 002C3393
VariantClear.OLEAUT32(?), ref: 002C341A
VariantClear.OLEAUT32(?), ref: 002C344C
VariantClear.OLEAUT32(?), ref: 002C3527
VariantClear.OLEAUT32(?), ref: 002C3556

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ClearVariant$String$AllocFree
String ID:
API String ID: 1305860026-0
Opcode ID: 4f7ea667ac7896245a65531c066240b1bcd210677ce5b7f0c1156c1fbb741126
Instruction ID: cf98338a678c8b011ebfd3525e9e6c5fbe8767653a76224f94de0d2d7440c74a
Opcode Fuzzy Hash: 4f7ea667ac7896245a65531c066240b1bcd210677ce5b7f0c1156c1fbb741126
Instruction Fuzzy Hash: 0AC19B71910249DFCB10DFA8C844BDEBBB4FF09314F148669E804E7391EB78AA55CBA5

Function 003D2BC0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 343synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

ResetEvent.KERNEL32(?,?,?), ref: 003D2C4A
SetEvent.KERNEL32(?,?,?,?,?,00000001,08000000,?,?,?), ref: 003D2C83
ResetEvent.KERNEL32(?,?,?,?,?,00000001,08000000,?,?,?), ref: 003D2E19
SetEvent.KERNEL32(?,?,?,?,?,?,00000001,08000000,?,?,?), ref: 003D2E4B
ResetEvent.KERNEL32(?,?,?,?,?,?,00000001,08000000), ref: 003D2F26
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000001,08000000), ref: 003D2F43
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,?,00000001,08000000), ref: 003D2F4A

Strings

FTP Server, xrefs: 003D2CF6, 003D2D08, 003D2D12

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Event$Reset$Init_thread_footerObjectSingleWait$HeapProcess
String ID: FTP Server
API String ID: 3860647947-688436434
Opcode ID: 00cfee93a1a5edf4395a41359bf803e23333f159c7f76b63505768f1b9ea8c75
Instruction ID: 0813760a427d9b1d645276faf0828d47fc7a9d48693521280f86331c2bbd9642
Opcode Fuzzy Hash: 00cfee93a1a5edf4395a41359bf803e23333f159c7f76b63505768f1b9ea8c75
Instruction Fuzzy Hash: 48D18E31A00249DFDB02DF68C988B9EBBB9FF59314F15825AE814AB391DB74DD44CB90

Function 00389FD0 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 232fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,?), ref: 0038A069
CloseHandle.KERNEL32(00000000), ref: 0038A090

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Part of subcall function 0038BC00: FindResourceW.KERNEL32(00000000,00000001,00000006,?,00000000,?,?,80070057,E48E37CD,?,?,00000000,0045D670,000000FF,?,003D338D), ref: 0038BC3D
Part of subcall function 0038BC00: WideCharToMultiByte.KERNEL32(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000), ref: 0038BC6E

WriteFile.KERNEL32(00000000,?,?,?,00000000,?,?,?), ref: 0038A105
CloseHandle.KERNEL32(00000000), ref: 0038A157

Part of subcall function 0038BA20: WideCharToMultiByte.KERNEL32(00000003,00000000,003B3DCA,000000FF,00000000,00000000,00000000,00000000,?,?,?,003B3DCA,?,?), ref: 0038BA3C
Part of subcall function 0038BA20: WideCharToMultiByte.KERNEL32(00000003,00000000,003B3DCA,000000FF,?,-00000001,00000000,00000000,?,?,?,003B3DCA,?,?), ref: 0038BA73

Strings

EXE, xrefs: 0038A023
.bat, xrefs: 0038A01E
3C, xrefs: 0038A18A
open, xrefs: 0038A183

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ByteCharMultiWide$CloseFileHandleInit_thread_footer$CreateFindHeapProcessResourceWrite
String ID: .bat$EXE$open$3C
API String ID: 4275363648-1225271249
Opcode ID: d9930475206097a38b134b153bcc937bcad06978c9994183f3ee435aa74bd27e
Instruction ID: 778a0991505170af012aba2fd62ee5e99d0e238aed0a241ec4bea30e892f32c8
Opcode Fuzzy Hash: d9930475206097a38b134b153bcc937bcad06978c9994183f3ee435aa74bd27e
Instruction Fuzzy Hash: A4A15A70901648EFEB11DFA8CD48B8DFBB4BF45314F24829AE414AB291DB749D48CF51

Function 002CB720 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 218windowstringCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000C5,?,00000000), ref: 002CB771
SendMessageW.USER32(?,0000043A,00000000,00000074), ref: 002CB7D5
lstrcpynW.KERNEL32(?,?,00000020), ref: 002CB847
MulDiv.KERNEL32(?,00000048,00000000), ref: 002CB884
SendMessageW.USER32(?,00000444,00000000,00000074), ref: 002CB8B6

Strings

t, xrefs: 002CB892
?, xrefs: 002CB88A
U2C, xrefs: 002CB8F2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$lstrcpyn
String ID: ?$U2C$t
API String ID: 3928028829-569858670
Opcode ID: 3494d21194c5fa97d5f4a12a033a76b06935c3445f833e2366056f10f712bc5f
Instruction ID: 8d6ae3bc590a5516d663b408535a5327eab286fc5c3b7e9a54aeae3c6b596761
Opcode Fuzzy Hash: 3494d21194c5fa97d5f4a12a033a76b06935c3445f833e2366056f10f712bc5f
Instruction Fuzzy Hash: CB919F71618340AFE721DF64CC45F9ABBE8AF89304F004A2EF699D71A0EB74A544CF56

Function 003D4900 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 178fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,?,ps1,ps1,00000003,?,003B4998), ref: 003D49F3
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 003D4A37
WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 003D4A54
CloseHandle.KERNEL32(00000000), ref: 003D4A6E
CloseHandle.KERNEL32(00000000,?,?,00000000,00000000), ref: 003D4AAD

Strings

ps1, xrefs: 003D4969, 003D497B, 003D4985, 003D4996
Unable to save script file , xrefs: 003D4A7D
Unable to get temp file , xrefs: 003D49D4

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$CloseHandleInit_thread_footerWrite$CreateFindHeapProcessResource
String ID: Unable to get temp file $Unable to save script file $ps1
API String ID: 2821137686-4253966538
Opcode ID: 4136b1e46e9f5bab8b0298522e13b94ddf523e70be16f8e9d44618db6164f781
Instruction ID: 18dda12a45b5a7dd802e63f7a181230ca941a22646a7f27eeda9ea5d16680c3c
Opcode Fuzzy Hash: 4136b1e46e9f5bab8b0298522e13b94ddf523e70be16f8e9d44618db6164f781
Instruction Fuzzy Hash: 4751D771A40609EFDB11DF68CD45BAEBBB8EF05314F14825AE510AB3D1D7749D04CBA8

Function 003A9550 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 003A9582
GetWindowLongW.USER32(?,000000F0), ref: 003A9588
GetDlgItem.USER32(?,?), ref: 003A95FA
GetWindowRect.USER32(00000000,?), ref: 003A9612
SetWindowPos.USER32(00000014,00000000,?,00000002,00000002,?,00000014,?,00000002,00000002,?,?,?,000000F0,?,00000000), ref: 003A969F
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 003A96D3

Strings

L/C, xrefs: 003A9566
$/C, xrefs: 003A9623

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$MessageSend$ItemLongRect
String ID: $/C$L/C
API String ID: 3432912040-3828232961
Opcode ID: ec17e39a880a6e74300d558c5d5c4be7c999c86c558409b21d8dcc2a466997c5
Instruction ID: b272b91098eaebc9aebb0fb343fd62e1c4050f48ed43f6d8b6912f3e07592f32
Opcode Fuzzy Hash: ec17e39a880a6e74300d558c5d5c4be7c999c86c558409b21d8dcc2a466997c5
Instruction Fuzzy Hash: 99518B30204300DFDB25CF28C989B2ABBE1FF8A718F154A1EF585AB2A5D771E844CB55

Function 003C3C80 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 150libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32 ref: 003C3CBE
GetUserDefaultLangID.KERNEL32 ref: 003C3CCB
LoadLibraryW.KERNEL32(kernel32.dll), ref: 003C3CDD
GetProcAddress.KERNEL32(00000000,GetSystemDefaultUILanguage), ref: 003C3CF1
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 003C3D06

Strings

kernel32.dll, xrefs: 003C3CD4
GetUserDefaultUILanguage, xrefs: 003C3D00
GetSystemDefaultUILanguage, xrefs: 003C3CEB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressDefaultLangProc$LibraryLoadSystemUser
String ID: GetSystemDefaultUILanguage$GetUserDefaultUILanguage$kernel32.dll
API String ID: 667524283-3528650308
Opcode ID: 0c573c7e2bd6bcc9b69a8f40afbd965cfa0be521beffae8667afa6c5c6c5ceba
Instruction ID: 00cf85bffd01059d798aa69350d2fd3d5b110764253350a0a0635203b1062345
Opcode Fuzzy Hash: 0c573c7e2bd6bcc9b69a8f40afbd965cfa0be521beffae8667afa6c5c6c5ceba
Instruction Fuzzy Hash: C041B1716083019BC745EF28D854BBAB7E1AFA8345F52592EF886C7280DB359E44CB52

Function 002B6C00 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 148fileCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 002B6CEF

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

CreateFileW.KERNEL32(00000000,40000000,00000001,00000000,00000002,00000080,00000000,?), ref: 002B6D43
CloseHandle.KERNEL32(00000000), ref: 002B6D92

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

WriteFile.KERNEL32(00000000,00000000,?,?,00000000,00000000,?), ref: 002B6DF6
CloseHandle.KERNEL32(00000000,?), ref: 002B6E1C

Strings

|bT, xrefs: 002B6DCD
html, xrefs: 002B6CFC
aix, xrefs: 002B6D01

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$CloseEnterFileHandleLeave$ConditionCreateInit_thread_footerVariableWakeWrite
String ID: aix$html$|bT
API String ID: 2030708724-1674552349
Opcode ID: bd6e3744dd0fe04900a6285b097be6a843bc79db596c15d38bd544f6c3a3b752
Instruction ID: 589e0118561f16c55006fce1baeaead304e5d88a4f921853d36d9c0b31c42565
Opcode Fuzzy Hash: bd6e3744dd0fe04900a6285b097be6a843bc79db596c15d38bd544f6c3a3b752
Instruction Fuzzy Hash: 5F516FB8904248EFDB10DFA4DC59BDEBBB4FB16308F10416DE401AB291D7F95A08DB66

Function 00439810 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00439847
___except_validate_context_record.LIBVCRUNTIME ref: 0043984F
_ValidateLocalCookies.LIBCMT ref: 004398D8
__IsNonwritableInCurrentImage.LIBCMT ref: 00439903
_ValidateLocalCookies.LIBCMT ref: 00439958
___vcrt_initialize_locks.LIBVCRUNTIME ref: 0043996E
___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00439983

Strings

csm, xrefs: 004398ED

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record___vcrt_initialize_locks___vcrt_uninitialize_locks
String ID: csm
API String ID: 1385549066-1018135373
Opcode ID: 16aced292b0c93de703a69703a86e70a20d787c466c61af78fd9b7dfc45b4971
Instruction ID: a95ad915443bc6e1f31b919d7ed06df686f627914754e4e43bd16626be4ef8bd
Opcode Fuzzy Hash: 16aced292b0c93de703a69703a86e70a20d787c466c61af78fd9b7dfc45b4971
Instruction Fuzzy Hash: E8410734D00208DBCF14EF69C881A9FBBA1AF49318F14905BE8145B392C779DD15CF95

Function 003D0260 Relevance: 12.7, APIs: 3, Strings: 4, Instructions: 454synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 003D2140: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,003D029A,?,E48E37CD,?,?,?,000000FF,?), ref: 003D2154
Part of subcall function 003D2140: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,003D029A,?,E48E37CD,?,?,?,000000FF,?,003CFC64), ref: 003D2171
Part of subcall function 003D2140: GetLastError.KERNEL32(?,E48E37CD,?,?,?,000000FF,?,003CFC64,?,?,00000000,00000000,E48E37CD,?,?), ref: 003D21D0

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

ResetEvent.KERNEL32(?,00000000,004A38DD), ref: 003D036A
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 003D0389
WaitForSingleObject.KERNEL32(E48E37CD,000000FF), ref: 003D0390

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

Strings

h[L, xrefs: 003D052F
filename, xrefs: 003D06E1
attachment, xrefs: 003D059D
GET, xrefs: 003D02EA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Event$CreateInit_thread_footerObjectSingleWait$ErrorFindHeapLastProcessResetResource
String ID: GET$attachment$filename$h[L
API String ID: 818129584-4055808260
Opcode ID: 9ba5c3e2eb0d8f19155cc2b8d1a9b69a29e788242b86bfb5d70ce2683140008e
Instruction ID: 5b3a60fa05ff80eb2573c1b7b9380b0b6835d57bc8dfa393cee46d9079cd6d53
Opcode Fuzzy Hash: 9ba5c3e2eb0d8f19155cc2b8d1a9b69a29e788242b86bfb5d70ce2683140008e
Instruction Fuzzy Hash: 8B02ED71901249DFDB05DFA8D944BAEBBF4FF15314F14816AE815AB391EB70AA04CFA0

Function 002B4E50 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00546008,E48E37CD,?,?,?,?,?,?,?,?,?,?,?,?,00000000,004604E5), ref: 002B4EBA
GetModuleFileNameW.KERNEL32(0000FFFF,00000104,?,?,?,?,?,?,?,?,?,?,?,?,00000000,004604E5), ref: 002B4F3A
EnterCriticalSection.KERNEL32(00546024,?,?,?,?,?,?,?,?,?,?,?,00000000,004604E5,000000FF), ref: 002B50F3
LeaveCriticalSection.KERNEL32(00546024,?,?,?,?,?,?,?,?,?,?,00000000,004604E5,000000FF), ref: 002B5114

Strings

cw, xrefs: 002B510D
8YT, xrefs: 002B4EDC

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$Enter$FileLeaveModuleName
String ID: cw$8YT
API String ID: 1807155316-3236524397
Opcode ID: e49ffaf29e32412d25b4a69af975c860a014ccd82567831774df4f9d995babd1
Instruction ID: f956fc6ed0f9a99821aa597923a61444e8e98acf35c99b82339c1f3dec731dcf
Opcode Fuzzy Hash: e49ffaf29e32412d25b4a69af975c860a014ccd82567831774df4f9d995babd1
Instruction Fuzzy Hash: 57B1CF70A10259DFDB11DFA8C888BEEBBF4BF19354F144598E405AB391C779AD48CBA0

Function 002B0E10 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 194comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(004C37FC,00000000,00000001,004C3E84,?), ref: 002B0EE0

Strings

>L, xrefs: 002B0EFE
{, xrefs: 002B0F40
:, xrefs: 002B0ECA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateInstance
String ID: :${$>L
API String ID: 542301482-1321501944
Opcode ID: aea17d8461d9900adfe77e17be93f25e21c66c738f02e5ea64979b7e3bf2c03c
Instruction ID: 8eb748c90cf8cbdba72d301728bd56db2cd4ade1723471b72295bb0abd99dd56
Opcode Fuzzy Hash: aea17d8461d9900adfe77e17be93f25e21c66c738f02e5ea64979b7e3bf2c03c
Instruction Fuzzy Hash: B561E274A502469BDF299F588894BFEB7F4EB09794F244829FC01EB280D775DC90CB64

Function 002CDE90 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 178windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000318,00000000,00000004), ref: 002CDEF7
SendMessageW.USER32(?,00001304,00000000,00000000), ref: 002CDF1F
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 002CDF37
SendMessageW.USER32(?,0000130A,00000000,?), ref: 002CDF68
GetParent.USER32(?), ref: 002CE044
SendMessageW.USER32(00000000,00000136,?,?), ref: 002CE055

Strings

U2C, xrefs: 002CDFB9, 002CE064

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$Parent
String ID: U2C
API String ID: 1020955656-2543022354
Opcode ID: debc8d05473a2fef349121dda8a085d609dcec9f3088ad663d8f2a9777ae66b8
Instruction ID: 56f9907bb51c58ea73be92985bda883335ab7e55512af3afbc8c871a136efa5e
Opcode Fuzzy Hash: debc8d05473a2fef349121dda8a085d609dcec9f3088ad663d8f2a9777ae66b8
Instruction Fuzzy Hash: CB612176A50618AFDB119BE4DC09FEEBBB9FF19714F100119F609AB2A0C7706904DF50

Function 003D7150 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004A13BF,000000FF), ref: 003D72D3
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004A13BF,000000FF), ref: 003D7361

Strings

T`T, xrefs: 003D7250
T`T, xrefs: 003D7178
<< Advanced Installer (x86) Log >>, xrefs: 003D723F
YT, xrefs: 003D71FB, 003D7217, 003D7238
|`T, xrefs: 003D71D6

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$CloseCriticalDeleteHandleHeapProcessSection
String ID: << Advanced Installer (x86) Log >>$ YT$T`T$T`T$|`T
API String ID: 3699736680-2837310433
Opcode ID: 8700f74a41c57c44d294cccf20493ffefa5cd1ad255af594c8e2b476a6aba294
Instruction ID: bcbeb246e8abd2fb395e8544bf04f23f1a8ce929dc20c31acb304f024c21453c
Opcode Fuzzy Hash: 8700f74a41c57c44d294cccf20493ffefa5cd1ad255af594c8e2b476a6aba294
Instruction Fuzzy Hash: 7A610E70900684CFD711CF68D94879EFBF0EF46318F1482AEE4089B391DB749A08CB91

Function 00382240 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 155windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001036,00010000,00000000), ref: 003822AB
GetParent.USER32(00000000), ref: 003822FE
GetWindowRect.USER32(00000000), ref: 00382301
GetParent.USER32(00000000), ref: 00382310

Part of subcall function 0033FCF0: GetWindowRect.USER32(?,?), ref: 0033FD8B
Part of subcall function 0033FCF0: GetWindowRect.USER32(?,?), ref: 0033FDA3

SendMessageW.USER32(?,00001026,00000000,000000FF), ref: 00382400
SendMessageW.USER32(?,0000108A,00000000,00000011), ref: 00382413

Strings

$/C, xrefs: 003823A6

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageRectSendWindow$Parent
String ID: $/C
API String ID: 425339167-1036787561
Opcode ID: c4c734bd7a6f71d487ffc8a6fbc26575b25b9317dce6c3b76f427a27fdc59b1d
Instruction ID: 25ebc4316d8311b434fa913f97deec6530677c260e7c4e44622c1a9831447e3c
Opcode Fuzzy Hash: c4c734bd7a6f71d487ffc8a6fbc26575b25b9317dce6c3b76f427a27fdc59b1d
Instruction Fuzzy Hash: 5C515775D00708ABDB21DFA8CD45BDEBBF8EF5A714F20431AE805A7291EB706984CB50

Function 00382470 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74libraryloaderwindowCOMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00382500

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

GetProcAddress.KERNEL32(SetWindowTheme), ref: 0038253D
__Init_thread_footer.LIBCMT ref: 00382554
SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 0038257F

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

Part of subcall function 00361FB0: GetSystemDirectoryW.KERNEL32(?,00000105), ref: 00361FF1
Part of subcall function 00361FB0: _wcschr.LIBVCRUNTIME ref: 003620AF

Strings

UxTheme.dll, xrefs: 003824D1
SetWindowTheme, xrefs: 00382532
explorer, xrefs: 00382567

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$AddressConditionDirectoryMessageProcSendSystemVariableWake_wcschr
String ID: SetWindowTheme$UxTheme.dll$explorer
API String ID: 3852524043-3123591815
Opcode ID: efef6db472c0fbcca0ce081ee86fe0fe2eab886bfb8e29e6f274e57c514ff088
Instruction ID: 9cb1e762f8f7cd3e9c0cb340d0066465d65edd43e208e0521803b1d58bf902ff
Opcode Fuzzy Hash: efef6db472c0fbcca0ce081ee86fe0fe2eab886bfb8e29e6f274e57c514ff088
Instruction Fuzzy Hash: 3221E4B0A40300EBC721DF14ED16BCAB7B4FB27728F51422AF824972D4D7B8A905DB56

Function 002B97E0 Relevance: 12.1, APIs: 8, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002B980A
GetWindow.USER32(?,00000005), ref: 002B9817
GetWindow.USER32(00000000,00000002), ref: 002B9952

Part of subcall function 002B9660: GetWindowRect.USER32(?,?), ref: 002B968C
Part of subcall function 002B9660: GetWindowRect.USER32(?,?), ref: 002B969C

GetWindowRect.USER32(?,?), ref: 002B98AB
GetWindowRect.USER32(00000000,?), ref: 002B98BB
GetWindowRect.USER32(00000000,?), ref: 002B98D5

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Rect
String ID:
API String ID: 3200805268-0
Opcode ID: 460d2b5abfd2218f659f7c1d748662391d4c19c84d0a439f5a707d4da4e29282
Instruction ID: 1d7fdcba9c13c2b45da45515b2ad40412275d635d633b0c99b9cd58d9df35215
Opcode Fuzzy Hash: 460d2b5abfd2218f659f7c1d748662391d4c19c84d0a439f5a707d4da4e29282
Instruction Fuzzy Hash: D841C0305187029FC721DF25C980AABF7F9BF96744F544A1DF28593621EB30E998CB12

Function 00435BAB Relevance: 12.1, APIs: 8, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000D,00000000,?,00435D55,00000000,?,?,002B0B74,?), ref: 00435BCF
HeapAlloc.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435BD6

Part of subcall function 00435CA1: IsProcessorFeaturePresent.KERNEL32(0000000C,00435BBD,00000000,?,00435D55,00000000,?,?,002B0B74,?), ref: 00435CA3

InterlockedPopEntrySList.KERNEL32(00000000,00000000,?,00435D55,00000000,?,?,002B0B74,?), ref: 00435BE6
VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,002B0B74,?), ref: 00435C0D
RaiseException.KERNEL32(C0000017,00000000,00000000,00000000,?,?,002B0B74,?), ref: 00435C21
InterlockedPopEntrySList.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435C34
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,002B0B74,?), ref: 00435C47

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AllocEntryHeapInterlockedListVirtual$ExceptionFeatureFreePresentProcessProcessorRaise
String ID:
API String ID: 2460949444-0
Opcode ID: 047755614e01e0f72fe0ec6b11e9d42825edd3df2c58707c6169492d07c13063
Instruction ID: 9ee989251351e09150ee9a78494425acc155e0d6a5381d0a90db169608fc2a74
Opcode Fuzzy Hash: 047755614e01e0f72fe0ec6b11e9d42825edd3df2c58707c6169492d07c13063
Instruction Fuzzy Hash: E711B671641F11ABE7211B65AC88F6B765CEB0C78DF192537F901E6250DE24DC009ABD

Function 003E6EA0 Relevance: 10.9, APIs: 5, Strings: 1, Instructions: 371COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

_wcschr.LIBVCRUNTIME ref: 003E6F6B
_wcschr.LIBVCRUNTIME ref: 003E701D
_wcschr.LIBVCRUNTIME ref: 003E703C

Part of subcall function 002A9390: FindResourceW.KERNEL32(00000000,?,00000006,?,00000001,?,002B69F0,-00000010,?,002BAA9D,*.*), ref: 002A93B7

_wcschr.LIBVCRUNTIME ref: 003E70E2
GetTickCount.KERNEL32 ref: 003E728A

Strings

0123456789AaBbCcDdEeFf, xrefs: 003E6F01, 003E6F13, 003E6F1D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: _wcschr$Init_thread_footer$CountFindHeapProcessResourceTick
String ID: 0123456789AaBbCcDdEeFf
API String ID: 2181188311-3822820098
Opcode ID: c058401ba46ec1fb001011773091129ce879a682c0ee667eea1d230c32dbbef5
Instruction ID: 36f19fa3c30924d45ad3d59e1a3f0960b7198fbe5940c99602065ceefaa3ab85
Opcode Fuzzy Hash: c058401ba46ec1fb001011773091129ce879a682c0ee667eea1d230c32dbbef5
Instruction Fuzzy Hash: 04D1EC70A006558FDB22CF6AC888BAAB7F5EF48320F14875DE4659B2C1DB34ED45CB90

Function 002CF780 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 369windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000030,00000000,00000001), ref: 002CF7CD

Strings

,nL, xrefs: 002CFA85
ControlEvent, xrefs: 002CFA59
AiTabPage, xrefs: 002CF9E3, 002CFAEA
`Dialog_`=', xrefs: 002CF900
' AND `Control_`=', xrefs: 002CF947

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend
String ID: ' AND `Control_`='$,nL$AiTabPage$ControlEvent$`Dialog_`='
API String ID: 3850602802-3887494272
Opcode ID: c76f2cc56218c0753c517b5662971d8c9e64ac3926279413b872a86786cd3698
Instruction ID: 47674a2ce9679090b5016c6fba34ce58f2943925fe4507ce6501b3208d36368f
Opcode Fuzzy Hash: c76f2cc56218c0753c517b5662971d8c9e64ac3926279413b872a86786cd3698
Instruction Fuzzy Hash: C3F17875910248DFDF04DF68C999BEEBBB1BF08304F1542A9ED149B292DB74AA14CF90

Function 003A09E0 Relevance: 10.8, APIs: 7, Instructions: 300fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,E48E37CD,?,00000000), ref: 003A0A69
ReadFile.KERNEL32(00000000,00000000,00001000,?,00000000), ref: 003A0AEC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 003A0B39
GetFileSize.KERNEL32(00000000,00000000), ref: 003A0B42
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 003A0BA5
CloseHandle.KERNEL32(00000000), ref: 003A0CF7
ReadFile.KERNEL32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 003A0D7F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$Read$CloseCreateHandlePointerSize
String ID:
API String ID: 4181610692-0
Opcode ID: 44548ca57ba1da3fbf5f480a190cbf4ab375a8a35b34f56f9a140c6d91b1d822
Instruction ID: 0dd5f3cac1d9ec42100615e67347b0d567b6efbdb540284b663660d97d85b554
Opcode Fuzzy Hash: 44548ca57ba1da3fbf5f480a190cbf4ab375a8a35b34f56f9a140c6d91b1d822
Instruction Fuzzy Hash: 07C19071D00308DFDB19CFA4C945BAEBBB9EF46304F21825DE415AB281DB74AA45CB94

Function 002AEFA0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 271memoryCOMMON

Download Yara Rule

APIs

SysAllocStringLen.OLEAUT32(00000000,?), ref: 002AF06A
SysFreeString.OLEAUT32(00000000), ref: 002AF0B6
SysFreeString.OLEAUT32(00000000), ref: 002AF0D8
SysFreeString.OLEAUT32(00000000), ref: 002AF233

Strings

P*, xrefs: 002AF24A
P*, xrefs: 002AF1AF, 002AF2A2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: String$Free$Alloc
String ID: P*$P*
API String ID: 986138563-181659991
Opcode ID: 84599760cf6fe0849fe953e6e7653466131ec698156fddd885ffaeb2d04fbc0f
Instruction ID: d3caab57cdfa92a63014fd59188585265fdc793323d66a6b138a084103b43965
Opcode Fuzzy Hash: 84599760cf6fe0849fe953e6e7653466131ec698156fddd885ffaeb2d04fbc0f
Instruction Fuzzy Hash: 33A19F71A1020AEFDB54CFA8CD44BAFB7B8FF45714F104529E919E7280DB78AA05CB61

Function 002D4CC3 Relevance: 10.7, APIs: 7, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 002D4D55
SysFreeString.OLEAUT32(00000000), ref: 002D4DCA
GetProcessHeap.KERNEL32(?,?), ref: 002D4E30
HeapFree.KERNEL32(00000000,?,?), ref: 002D4E36
GetProcessHeap.KERNEL32(?,00000000,?,00000000), ref: 002D4E66
HeapFree.KERNEL32(00000000,?,00000000,?,00000000), ref: 002D4E6C
SysFreeString.OLEAUT32(00000000), ref: 002D4E84

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Free$Heap$String$Process
String ID:
API String ID: 2680101141-0
Opcode ID: c14391def34d30c0b168fa8ca342d20c76c682d681f1f84f8917b2a93bac1295
Instruction ID: c5550fb7aaf860792a02921b06735303693017a79518c8ad128a4c6f822b2425
Opcode Fuzzy Hash: c14391def34d30c0b168fa8ca342d20c76c682d681f1f84f8917b2a93bac1295
Instruction Fuzzy Hash: BA61AC70D1025A9FDF11EFA8C885BAEBBB4BF05314F14415AE821A7382C7789E15CBA1

Function 002AB550 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 131COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 002AB5D2

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

__Init_thread_footer.LIBCMT ref: 002AB658
CreateDirectoryW.KERNEL32(005461F4,00000000,?,00000000,E48E37CD,?,00000000), ref: 002AB695

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

Strings

,bT, xrefs: 002AB6E9
,bT, xrefs: 002AB664
,bT, xrefs: 002AB5AE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInit_thread_footerLeave$ConditionCreateDirectoryVariableWake
String ID: ,bT$,bT$,bT
API String ID: 2312781895-3320417264
Opcode ID: c60838737d669644022a35d9dfbab438f072677f0f68d3d28d8e890d4f6c11df
Instruction ID: 2f162c732814ed31574f04843e4840282d022ce5e7098a21c29079aaed799851
Opcode Fuzzy Hash: c60838737d669644022a35d9dfbab438f072677f0f68d3d28d8e890d4f6c11df
Instruction Fuzzy Hash: B551B174D04309EBCB15DFA4DC45BDEBBB4BB16318F104269E411A7292DBB8AA08CF56

Function 0033FCF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 131COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0033FD8B
GetWindowRect.USER32(?,?), ref: 0033FDA3
GetWindowRect.USER32(?,?), ref: 0033FE10
GetWindowLongW.USER32(?,000000EC), ref: 0033FE34

Strings

L/C, xrefs: 0033FD73
$/C, xrefs: 0033FE25

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Rect$Long
String ID: $/C$L/C
API String ID: 3486571012-3828232961
Opcode ID: 51f66e967f2ca33b5639292f3a977e2b93a0e7d648f58fb8fc5e445cf8d34172
Instruction ID: e4a993c0edd0babb0ff5ade186c9f7dac5dd75bc0046dd850b2a4ac8f09e5073
Opcode Fuzzy Hash: 51f66e967f2ca33b5639292f3a977e2b93a0e7d648f58fb8fc5e445cf8d34172
Instruction Fuzzy Hash: D6419F35A083059FC700CF15D884BABB7E8FFAA704F45462EF94597251DB30E949CB52

Function 003CE2C0 Relevance: 10.6, APIs: 7, Instructions: 108processsynchronizationCOMMON

Download Yara Rule

APIs

Wow64DisableWow64FsRedirection.KERNEL32(00000000,E48E37CD,?,?), ref: 003CE307
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,E48E37CD,004A344D), ref: 003CE37F
GetLastError.KERNEL32 ref: 003CE390
WaitForSingleObject.KERNEL32(004A344D,000000FF), ref: 003CE3AC
GetExitCodeProcess.KERNEL32(004A344D,00000000), ref: 003CE3BD
CloseHandle.KERNEL32(004A344D), ref: 003CE3C7
Wow64RevertWow64FsRedirection.KERNEL32(00000000), ref: 003CE3E2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Wow64$ProcessRedirection$CloseCodeCreateDisableErrorExitHandleLastObjectRevertSingleWait
String ID:
API String ID: 1153077990-0
Opcode ID: b8295fe31a8a62b7cbd6b9739b8166e9f933dc629a59dd8a913fedac5ecfa2c9
Instruction ID: c9a29c695c2fea2d6d29f9964349c9e3663ce8356e65c9eadbaed0889e24d4a3
Opcode Fuzzy Hash: b8295fe31a8a62b7cbd6b9739b8166e9f933dc629a59dd8a913fedac5ecfa2c9
Instruction Fuzzy Hash: AC418C31E04389ABDB11CFA4CD04BEEBBF8AF49314F145669E824E7290DB749E40CB60

Function 003E0E90 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shlwapi.dll,?,00000010,?,00000000,003C6881,00000000,E48E37CD,?,00000010,00000000), ref: 003E0EAB
GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 003E0EC1
FreeLibrary.KERNEL32(00000000), ref: 003E0EFA
FreeLibrary.KERNEL32(00000000,?,00000010,?,00000000,003C6881,00000000,E48E37CD,?,00000010,00000000), ref: 003E0F16

Strings

Shlwapi.dll, xrefs: 003E0EAA
DllGetVersion, xrefs: 003E0EBB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Library$Free$AddressLoadProc
String ID: DllGetVersion$Shlwapi.dll
API String ID: 1386263645-2240825258
Opcode ID: 923c7c911ff94bb414ea1b0415fcb348068c3adc97b692976e67c0040237e856
Instruction ID: a0a7f083f3d838580e3a742e1b74a023571823629e2e4896d74795d4c72b7b14
Opcode Fuzzy Hash: 923c7c911ff94bb414ea1b0415fcb348068c3adc97b692976e67c0040237e856
Instruction Fuzzy Hash: A221F5326043019BC714AF2AEC4166BB3E4BFED700F82066EF449C3241EB7498498AA2

Function 0030E970 Relevance: 9.4, APIs: 4, Strings: 2, Instructions: 419memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 0030EB86
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000004), ref: 0030EB8C

Part of subcall function 00310530: GetProcessHeap.KERNEL32(?,?,E48E37CD,00000000,?,00000000), ref: 003105EA
Part of subcall function 00310530: HeapFree.KERNEL32(00000000,?,?,E48E37CD,00000000,?,00000000), ref: 003105F0

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0030ED97
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0030ED9D

Strings

|3L, xrefs: 0030ECEC
|3L, xrefs: 0030EAE1

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3L$|3L
API String ID: 3859560861-1358128316
Opcode ID: 37b1d7d8f4bbd3664b7754c7a829faff3df8f03ecdda4b73496662ebec1d7cd2
Instruction ID: 83ff7ad042d30df15327e0a7238097e8fbbe1b375e467368a470b9ac101908bb
Opcode Fuzzy Hash: 37b1d7d8f4bbd3664b7754c7a829faff3df8f03ecdda4b73496662ebec1d7cd2
Instruction Fuzzy Hash: 47F18970A01249DFDB05DFA8C959BEEBBB4FF05314F20459DE411AB2D2DB74AA08CB91

Function 00306CB0 Relevance: 9.2, APIs: 4, Strings: 2, Instructions: 226memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00306ED0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00306ED6
GetProcessHeap.KERNEL32(-000000FF,00000000), ref: 00306F01
HeapFree.KERNEL32(00000000,-000000FF,00000000), ref: 00306F07

Strings

_TEMP, xrefs: 00306DF7, 00306E2A
|3L, xrefs: 00306E2B

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: _TEMP$|3L
API String ID: 3859560861-4275186244
Opcode ID: 2702cdfdd4ff8c01d10da007ec27e761a7167f72f1cb61313380c831f6a39a9b
Instruction ID: 728a606eda0a6e1f0b76214584d6369c20aa46b08f41238cb7a8aec7f6ac7875
Opcode Fuzzy Hash: 2702cdfdd4ff8c01d10da007ec27e761a7167f72f1cb61313380c831f6a39a9b
Instruction Fuzzy Hash: F6918E71D02249DFDB10DFA8C985BEEBBB4EF48314F2442AAE415B72D1CB745A05CBA1

Function 00396080 Relevance: 9.1, APIs: 6, Instructions: 149COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 003960CA
std::_Lockit::_Lockit.LIBCPMT ref: 003960EC
std::_Lockit::~_Lockit.LIBCPMT ref: 00396114
__Getctype.LIBCPMT ref: 003961E5
std::_Facet_Register.LIBCPMT ref: 00396247
std::_Lockit::~_Lockit.LIBCPMT ref: 00396271

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 16bdc1ead2a2fd71704137c6eeff02d77a149eb722e397ee05228c92c4e14cf4
Instruction ID: 80e504b38695fd642ee93d0b9980f1006c9fc4baf7f0b5e8a8fba4bd455d0796
Opcode Fuzzy Hash: 16bdc1ead2a2fd71704137c6eeff02d77a149eb722e397ee05228c92c4e14cf4
Instruction Fuzzy Hash: 9751DFB0D01608CFDF11CF68C9427AAB7F4EF18318F14815ED845AB392DB35AA45DB91

Function 002B9980 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 330COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002B99D7
GetWindowRect.USER32(?,?), ref: 002B9AB3

Strings

$/C, xrefs: 002B9B83
PVL, xrefs: 002B9D39
U2C, xrefs: 002B9C6D, 002B9DB8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: RectWindow
String ID: $/C$PVL$U2C
API String ID: 861336768-1513382390
Opcode ID: f1e96658205f708a021b93f6c6f6c355e553cee40779cf9f1719ad7f000d6c23
Instruction ID: b0132d4e53bcc243a0a0dd09c3bc90a12f8bdc407e6c86ad884b1f8f34d0f9d4
Opcode Fuzzy Hash: f1e96658205f708a021b93f6c6f6c355e553cee40779cf9f1719ad7f000d6c23
Instruction Fuzzy Hash: 37E12775D04619EFEB20CFA8C948BDEBBF8EF1A704F108259E909A7251D7706A84DF50

Function 00437D52 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00437D49,00437D15,?,?,002D21FD,003A0140,?,00000008), ref: 00437D60
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00437D6E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00437D87
SetLastError.KERNEL32(00000000,00437D49,00437D15,?,?,002D21FD,003A0140,?,00000008), ref: 00437DD9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: f57ad7afc310ceaa9d1ca18ed28c66515cef1c3e92a87e9f9f55b9e8b2469381
Instruction ID: 61344b88a2571e9a83ab7c8496a72ce00faa7f8d2eb0eec799d573b083ed925c
Opcode Fuzzy Hash: f57ad7afc310ceaa9d1ca18ed28c66515cef1c3e92a87e9f9f55b9e8b2469381
Instruction Fuzzy Hash: 230128B210D2115EE73826757C8A7372B84EF19378F21272FF550612E1EF5D0C15694D

Function 002BFFD0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 292windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001037,00000000,00000000), ref: 002C0118
SendMessageW.USER32(?,00001036,00000000,00000000), ref: 002C012D

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Part of subcall function 00382040: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,002C0168,00000000,80004005), ref: 003820AB
Part of subcall function 00382040: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003820DB

SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 002C025E
SendMessageW.USER32(?,00001061,00000000,00000005), ref: 002C035A

Strings

|3L, xrefs: 002C009A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID: |3L
API String ID: 3168177373-699080877
Opcode ID: 2c28678726b0a8a3b1ef440ff638f53b192575b1006418d4f7846241bfc34103
Instruction ID: c0851def418f51647711d21c2b0515c1179bb70f959bef3fb8a06cbd22aa2a95
Opcode Fuzzy Hash: 2c28678726b0a8a3b1ef440ff638f53b192575b1006418d4f7846241bfc34103
Instruction Fuzzy Hash: 6CB18C71A10209EFDB14CFA8C885FEEFBB4FF48314F144219E415AB290DBB5A954CBA4

Function 003B3CC0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 288COMMON

Download Yara Rule

APIs

GetShortPathNameW.KERNEL32(E48E37CD,00000000,00000000), ref: 003B3D1F
GetShortPathNameW.KERNEL32(?,?,?), ref: 003B3D8D

Strings

x64, xrefs: 003B3FAA
neutral, xrefs: 003B3EE6
x86, xrefs: 003B3F4A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: NamePathShort
String ID: neutral$x64$x86
API String ID: 1295925010-1541741584
Opcode ID: 2ac91285cb599c141804112a6556ba45d32e6ba87ce0d442d73557b6679930d2
Instruction ID: bef592cfa1186267b19d970e61de5f5773f6121fc027bbb868d4a5cc806a54ef
Opcode Fuzzy Hash: 2ac91285cb599c141804112a6556ba45d32e6ba87ce0d442d73557b6679930d2
Instruction Fuzzy Hash: 90B1AE71A00208EFDB01DFA8C859BDEFBB4EF45324F10825DE515AB291DB75AA44CFA4

Function 002C8180 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 266windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,?), ref: 002C8258
SendMessageW.USER32(?,0000110A,00000001,00000000), ref: 002C8287
SendMessageW.USER32(00000000,0000110A,00000004,0A74C085), ref: 002C8443
SendMessageW.USER32(0000110A,0000110A,00000001,00000000), ref: 002C8466

Strings

_T, xrefs: 002C8325

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend
String ID: _T
API String ID: 3850602802-3038003434
Opcode ID: e286e15d441a332719b5c36079a1a6856da57b7a6d9d6bb2d207984dfac1d7d3
Instruction ID: d13a4c1f41203e2a1c0f347379a70715c1ca3d1dc5548e4041ce7ac0385182f4
Opcode Fuzzy Hash: e286e15d441a332719b5c36079a1a6856da57b7a6d9d6bb2d207984dfac1d7d3
Instruction Fuzzy Hash: 7FA16D72910245DFCB25DF68C884FEEB7B5BF09710F1592A9E801AB291DB70E855CBA0

Function 003A9710 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 260COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000080,00000001,Close,50000001,?,00000128,?,00000032,0000000E,00000082,000001F5,?,50000000,?,00000026), ref: 003A99E8

Strings

Close, xrefs: 003A9904
Details >>, xrefs: 003A996E
Send Error Report, xrefs: 003A994A
Copy, xrefs: 003A99CF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: HandleModule
String ID: Close$Copy$Details >>$Send Error Report
API String ID: 4139908857-113472931
Opcode ID: 5d44e2711fcd59e1af3fa2257dbed126687410ccbddb11b23d223aea22965632
Instruction ID: ad29d340a64c405f1ebb5a2d9d2f7c7305f66040a8aaee47b5b04ff53fdc00f2
Opcode Fuzzy Hash: 5d44e2711fcd59e1af3fa2257dbed126687410ccbddb11b23d223aea22965632
Instruction Fuzzy Hash: B991C070A40305AFDB15DF60DC56FAAB7B5EF49704F10422AF611BB2D0EBB4A900CB54

Function 002A8890 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 238COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 002A8975
__Init_thread_footer.LIBCMT ref: 002A89EF

Strings

<a href=", xrefs: 002A8937
<a>, xrefs: 002A8BA1
</a>, xrefs: 002A8AF9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer
String ID: </a>$<a href="$<a>
API String ID: 1385522511-4210067781
Opcode ID: 9724feeeeb3ba456ddfa10a710a870b9e672007933aa17da72f3d75678068c93
Instruction ID: 975bc8e09a20fcf7ca17122c633798b8966f27ae5defeb0f1ed68c0b74a41ac8
Opcode Fuzzy Hash: 9724feeeeb3ba456ddfa10a710a870b9e672007933aa17da72f3d75678068c93
Instruction Fuzzy Hash: B1A1DBB0A10605EFCB04DF68D859BADB7B1FB4A318F104219E421AB2D2EF34A954CF65

Function 002C5E20 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 220windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Part of subcall function 00382040: SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000037,?,?,?,000000EF,?,002C0168,00000000,80004005), ref: 003820AB
Part of subcall function 00382040: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 003820DB

SendMessageW.USER32(?,00001036,00000004,00000004), ref: 002C5FDC
SendMessageW.USER32(?,00001036,00000400,00000400), ref: 002C5FF3
SendMessageW.USER32(?,00001061,00000000,?), ref: 002C604F

Strings

QuickSelectionList, xrefs: 002C5F15, 002C5F27, 002C5F31
|3L, xrefs: 002C6012

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$AllocateHeapWindow
String ID: QuickSelectionList$|3L
API String ID: 3168177373-988513940
Opcode ID: 6df2f2e2daaba8dc42d92abbd427dd8654286d6d4572ef5d840a1b0dcf0c5972
Instruction ID: 18f949ec6d99d0fcc4f9ac6d36461a23b569e4328e99a115bbf5aceadb438fa9
Opcode Fuzzy Hash: 6df2f2e2daaba8dc42d92abbd427dd8654286d6d4572ef5d840a1b0dcf0c5972
Instruction Fuzzy Hash: 53819971A006099FCB14DF69C894BAAF7F4FF88324F10865DE919A7290DB75A944CFA0

Function 002F99D0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 207threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003A0F40: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 003A0F84
Part of subcall function 003A0F40: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 003A0F8F

GetCurrentThreadId.KERNEL32 ref: 002F9B3C
SendMessageW.USER32(?,00000127,00030003,00000000), ref: 002F9BC5

Strings

AI_HIDE_CAPTION_ICON_AND_TEXT_ALL, xrefs: 002F9A69
0^T, xrefs: 002F9A33
AI_HIDE_CAPTION_ICON_AND_TEXT, xrefs: 002F9AE0

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$CurrentThread
String ID: 0^T$AI_HIDE_CAPTION_ICON_AND_TEXT$AI_HIDE_CAPTION_ICON_AND_TEXT_ALL
API String ID: 2377075789-3159816273
Opcode ID: 029317b4d657da0ca53896ec0c0478def70b44d3642e38d15e73869e90cb7f7f
Instruction ID: e28b2d344a5601bb26630350582aaee559693ebfa71bca48742fa41334bd8507
Opcode Fuzzy Hash: 029317b4d657da0ca53896ec0c0478def70b44d3642e38d15e73869e90cb7f7f
Instruction Fuzzy Hash: D181A130A11208DFDF05EF64C895BEDBBB5AF45304F1441A9E906AF292DB74AE08CF91

Function 003A2450 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 195COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

SHGetSpecialFolderLocation.SHELL32(00000000,00000011,?,?,E48E37CD,00000000,?), ref: 003A266C
SHGetMalloc.SHELL32(?), ref: 003A2695

Strings

%s, %.2u %s %.4u %.2u:%.2u:%.2u GMT, xrefs: 003A2566
C:\FAKE_DIR\, xrefs: 003A263A, 003A2657
C:\, xrefs: 003A2621

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer$FolderHeapLocationMallocProcessSpecial
String ID: %s, %.2u %s %.4u %.2u:%.2u:%.2u GMT$C:\$C:\FAKE_DIR\
API String ID: 3216538967-785558474
Opcode ID: 69cf29010b6effa0fe968b28c63aa9331189574b25a921bcf76e7937f44a272f
Instruction ID: 487f1e4dbc96fda2849839b05b25bd0f43b30fd9ade1978fe8d3b6c803c801a8
Opcode Fuzzy Hash: 69cf29010b6effa0fe968b28c63aa9331189574b25a921bcf76e7937f44a272f
Instruction Fuzzy Hash: 29715CB1900249ABDB10DF99CC45BAEBBF9FB08704F10851BF915AB391D7B89944CB98

Function 002CDC60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 182windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,SysTabControl32,?,46010000,?,?,?,?,00000000,00000309,00000000), ref: 002CDD5D
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 002CDD72
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 002CDD7A

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Part of subcall function 002CF780: SendMessageW.USER32(?,00000030,00000000,00000001), ref: 002CF7CD

Strings

SysTabControl32, xrefs: 002CDD55
TabHost, xrefs: 002CDCE9, 002CDCFB, 002CDD05

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$AllocateCreateHeapWindow
String ID: SysTabControl32$TabHost
API String ID: 2359350451-2872506973
Opcode ID: 67e9d1909d350f9b25dbb652f2453e4f80a83748594dafb59376ad16b3ef720f
Instruction ID: 9f5e436239efbb60072e70e3c58f43b78ef1acca92bd96c7eaa40c3068a43ea1
Opcode Fuzzy Hash: 67e9d1909d350f9b25dbb652f2453e4f80a83748594dafb59376ad16b3ef720f
Instruction Fuzzy Hash: 5D519C35A00605AFDB04DF69C884FAABBB8EF49710F10866DE815A7391DB75A804CBA4

Function 002B6E60 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 159registryCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,Caphyon.AI.ExtUI.IEClickSoundRemover,E48E37CD), ref: 002B6EF3
GetLastError.KERNEL32 ref: 002B6F1C
RegCloseKey.ADVAPI32(?,00000000,00000000,?,004C337C,00000000,00000000,80000001,00000000,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033), ref: 002B7065

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 002B6F5C
Caphyon.AI.ExtUI.IEClickSoundRemover, xrefs: 002B6EE8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CloseCreateErrorEventLast
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current$Caphyon.AI.ExtUI.IEClickSoundRemover
API String ID: 1713683948-2079760225
Opcode ID: 17ce3ae21b7dc17a82b4143950a174bf7265d2a023e9daf7121d5cce6135bb21
Instruction ID: c2ad360c85c6df8f1374a8aba5f85b807ec1674f423125f3c2fb8c8bbd79549f
Opcode Fuzzy Hash: 17ce3ae21b7dc17a82b4143950a174bf7265d2a023e9daf7121d5cce6135bb21
Instruction Fuzzy Hash: 66618A70D14349EFDB10DF68C945B9EFBF4AF15304F108299E459A7282DBB4AA08CFA5

Function 002DD090 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,005459E8,Windows.UI.Xaml.Controls.TextBlock,00000022,E48E37CD,00000001,00000000,?,YT,00466017,000000FF), ref: 002DD168

Strings

YT, xrefs: 002DD137
YT, xrefs: 002DD149
Windows.UI.Xaml.Controls.TextBlock, xrefs: 002DD0BA
YT, xrefs: 002DD0A0

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Controls.TextBlock$YT$YT$YT
API String ID: 4129690577-2938975705
Opcode ID: 3993ad33654a1066cb53b079e3e9c10b967140eed0035ded98190b8bf22cef81
Instruction ID: 88f2a72e7d32c376588bcdd931656f6bc3717b8f6aa1053b92f129b4ad5af8d8
Opcode Fuzzy Hash: 3993ad33654a1066cb53b079e3e9c10b967140eed0035ded98190b8bf22cef81
Instruction Fuzzy Hash: B6316A7191161AEBDB00DF94C946BEEBBB4FB15718F10412AE814AB3C1E7B55E08CBD1

Function 002B2990 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002B29C6
EnterCriticalSection.KERNEL32(00546250), ref: 002B29E6
LeaveCriticalSection.KERNEL32(00546250), ref: 002B2A0A

Strings

cw, xrefs: 002B2A0A
PbT, xrefs: 002B29CF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: cw$PbT
API String ID: 2351996187-3130983629
Opcode ID: 8d88d1b47c7a675393569ce56be36c175413e3d3e35d3c4b686b44a550324b9f
Instruction ID: e8b6bc44dd503a36acc27ff932e95ff2dd20783796b56c480f1861bf76a6cd67
Opcode Fuzzy Hash: 8d88d1b47c7a675393569ce56be36c175413e3d3e35d3c4b686b44a550324b9f
Instruction Fuzzy Hash: 30210271908744EFCB20CF58DC45B8ABBF8FB0AB14F10462EE82497780D7B9A408CB91

Function 003C6820 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

ProgramFilesFolder, xrefs: 003C68E7
PROGRAMFILES, xrefs: 003C6A3D
AppDataFolder, xrefs: 003C69C8, 003C6A05
APPDATA, xrefs: 003C6A57, 003C6A5F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: APPDATA$AppDataFolder$PROGRAMFILES$ProgramFilesFolder
API String ID: 0-3551742416
Opcode ID: c054d23cb5549532813ced0d303c7bae3dca243c2bc268910fe6d6a06b4e1f18
Instruction ID: 6c9adcbb9e76f503178430932f300186a591d1ddc2cd4176b7738e7495d04b0e
Opcode Fuzzy Hash: c054d23cb5549532813ced0d303c7bae3dca243c2bc268910fe6d6a06b4e1f18
Instruction Fuzzy Hash: 86210E36A00205ABCB249F28CC55FAAB3A8EB15720F1086AFE911D7390EB35DD04CB44

Function 0043A78C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,?,?,0043A84D,?,?,00000000,?,?,0043A8FF,00000002,FlsGetValue,004BA0D0,004BA0D8), ref: 0043A81C

Strings

api-ms-, xrefs: 0043A7DC

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 0d72abbc88f07c834d54e358a86f8ebcf5ebd06a0feff80027afcbeb2387e7f0
Instruction ID: debfb66d76cdd69218de67de7394c635f076b8a492e3f6daee57c7bbf43274b0
Opcode Fuzzy Hash: 0d72abbc88f07c834d54e358a86f8ebcf5ebd06a0feff80027afcbeb2387e7f0
Instruction Fuzzy Hash: D4110D31980235A7DF32AB589C8475E33A49F05770F150122E950E7380D774ED15C6DF

Function 002B2700 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00546250), ref: 002B273C
GetCurrentThreadId.KERNEL32 ref: 002B2750
LeaveCriticalSection.KERNEL32(00546250), ref: 002B278E

Strings

cw, xrefs: 002B278E
PbT, xrefs: 002B2729

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: cw$PbT
API String ID: 2351996187-3130983629
Opcode ID: 4d7c33223462a4d21da355549d0f2c4a47ff620679ed67472866bae7f6b14ee0
Instruction ID: dec1dc4b1f845a71ddf1506c04e55f8490948e5a795ca44fdf908b382f12298d
Opcode Fuzzy Hash: 4d7c33223462a4d21da355549d0f2c4a47ff620679ed67472866bae7f6b14ee0
Instruction Fuzzy Hash: DA112739908345DBCB20CF59CD047AAFBF4FB56764F10466ED81197390DBB05908D795

Function 0044C68F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,E48E37CD,?,?,00000000,004B6426,000000FF,?,0044C662,?,?,0044C636,?), ref: 0044C6C4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0044C6D6
FreeLibrary.KERNEL32(00000000,?,00000000,004B6426,000000FF,?,0044C662,?,?,0044C636,?), ref: 0044C6F8

Strings

mscoree.dll, xrefs: 0044C6BD
CorExitProcess, xrefs: 0044C6CE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 928fdc9aad48219fe1f1bd2b115bd998d1f2729f7a24eb2866770bfdbc51361e
Instruction ID: d4fb6e13103e1b873cb104fd3d1b0b54f5287468b7988c5f96baea1a42dfd0b8
Opcode Fuzzy Hash: 928fdc9aad48219fe1f1bd2b115bd998d1f2729f7a24eb2866770bfdbc51361e
Instruction Fuzzy Hash: 4001A231904619EFDB159F54CC45BAFBBB8FB04B11F05463AE811A23D0DF789900CAA8

Function 003A79C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

LoadLibraryA.KERNEL32(Dbghelp.dll,SymFromAddr), ref: 003A7A1E
GetProcAddress.KERNEL32(00000000), ref: 003A7A25
__Init_thread_footer.LIBCMT ref: 003A7A3C

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

Strings

Dbghelp.dll, xrefs: 003A7A19
SymFromAddr, xrefs: 003A7A14

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AddressConditionInit_thread_footerLibraryLoadProcVariableWake
String ID: Dbghelp.dll$SymFromAddr
API String ID: 3268644551-642441706
Opcode ID: f3f2e1c3e51275c12a30cd818d0f39c31ed6b83ca910dcb700d7644a4938f35f
Instruction ID: 524fa59933e797a46b96c231d35bbbadcdd689ff347517ce21342d456c8a048f
Opcode Fuzzy Hash: f3f2e1c3e51275c12a30cd818d0f39c31ed6b83ca910dcb700d7644a4938f35f
Instruction Fuzzy Hash: 9901F775948700EFC710CF58ED46B5877A4F71AB38F10436AE816833D0C779A504EB16

Function 004366EA Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00436687,00000064), ref: 0043670D
LeaveCriticalSection.KERNEL32(00544CD8,?,?,00436687,00000064,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 00436717
WaitForSingleObjectEx.KERNEL32(?,00000000,?,00436687,00000064,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 00436728
EnterCriticalSection.KERNEL32(00544CD8,?,00436687,00000064,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043672F

Strings

cw, xrefs: 00436717

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: cw
API String ID: 3269011525-348920815
Opcode ID: cebbf792574ae4578a1c886ba1f106878bde163732e5ec56e070e57eae4a8ef9
Instruction ID: 320ffbe591f8f10d19ce5ee8742dd32b21e0882e752cc9743d4b03ad089ed5f3
Opcode Fuzzy Hash: cebbf792574ae4578a1c886ba1f106878bde163732e5ec56e070e57eae4a8ef9
Instruction Fuzzy Hash: A7E09235582524B7CA012B94EC8ABDD3F2CFB09B59B0A0025FA0566160CF640C14DFE8

Function 0030DE10 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 316memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?), ref: 0030E08B
HeapFree.KERNEL32(00000000,?,?), ref: 0030E091
GetProcessHeap.KERNEL32(?,?), ref: 0030E160
HeapFree.KERNEL32(00000000,?,?), ref: 0030E166

Strings

|3L, xrefs: 0030DFBF

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3L
API String ID: 3859560861-699080877
Opcode ID: 4099d13147e63abc91d554018592df16ab983b339cbbc6adea10035674d330ee
Instruction ID: 902e72b610533a00ba38aed13c0d46549846ca73298288046a8d60c87b7c5e6b
Opcode Fuzzy Hash: 4099d13147e63abc91d554018592df16ab983b339cbbc6adea10035674d330ee
Instruction Fuzzy Hash: 70D18C30A01208CFDB15DFA8C954BEEBBB5BF14304F2445A9D406AB2D2DB74AE49CF91

Function 002E1B70 Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 268memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?), ref: 002E1E5F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 002E1E65
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?), ref: 002E1F0F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 002E1F15

Strings

|3L, xrefs: 002E1DF1

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3L
API String ID: 3859560861-699080877
Opcode ID: 359c7198bd00fbc5152c87e1c560ac412bc3912c436861b49184581c4d104c58
Instruction ID: 3fc5a7488d41c28a1f5b8a9bb3319af7eddc55b4288547c0b42aba814ad768f6
Opcode Fuzzy Hash: 359c7198bd00fbc5152c87e1c560ac412bc3912c436861b49184581c4d104c58
Instruction Fuzzy Hash: C3B18B70D10298CEEB20DF29CC45B9EBBB5FF05314F5442EAE419A7282DB745A94CF91

Function 002C03C0 Relevance: 7.7, APIs: 5, Instructions: 234windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002C25D0: __Init_thread_footer.LIBCMT ref: 002C263F

SendMessageW.USER32(?,0000104D,00000000,00000000), ref: 002C0502
SendMessageW.USER32(?,0000104D,00000000,?), ref: 002C05B7
SendMessageW.USER32(?,0000104C,00000000,?), ref: 002C0656
SendMessageW.USER32(?,0000104C,00000000,?), ref: 002C0701

Part of subcall function 002B2970: RaiseException.KERNEL32(?,?,00000000,00000000,00435A3C,C000008C,00000001,?,00435A6D,00000000,?,002A91C7,00000000,E48E37CD,00000001,?), ref: 002B297C

SendMessageW.USER32(?,0000104C,00000000,?), ref: 002C0787

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$ExceptionInit_thread_footerRaise
String ID:
API String ID: 3442259968-0
Opcode ID: 3fa65aa14980a672b27b8cf640bef340b9b9cf4e04f31b1b4f4734e514760c71
Instruction ID: 46eba70098b507cb9b0ea0b1bae07fa39ce0af6af825df24846007f97b70dddc
Opcode Fuzzy Hash: 3fa65aa14980a672b27b8cf640bef340b9b9cf4e04f31b1b4f4734e514760c71
Instruction Fuzzy Hash: D2B13BB1D11359DBEB24CF54CD94BDABBB1FF59308F104299E9086B280D7B56A84CF80

Function 002E07E0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?), ref: 002E0A0F
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 002E0A15
GetProcessHeap.KERNEL32(?,?,?,?,?,?), ref: 002E0ABF
HeapFree.KERNEL32(00000000,?,?,?,?,?,?), ref: 002E0AC5

Strings

|3L, xrefs: 002E09A1

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: |3L
API String ID: 3859560861-699080877
Opcode ID: 9902da1650ad989b2f1e83e48e6f7c639691ad33b5b776f7904bb32dac69b4ee
Instruction ID: 44e417e80b0f9c7345af351a25a3c84c7acf3735562781ea621865eed1ce6e14
Opcode Fuzzy Hash: 9902da1650ad989b2f1e83e48e6f7c639691ad33b5b776f7904bb32dac69b4ee
Instruction Fuzzy Hash: 3E916A709103A8CEEB20DF25CC85BDAB7B5AF01304F5442EAD509A7282DBB45E99CF52

Function 002AFCE0 Relevance: 7.6, APIs: 5, Instructions: 120windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 002AFD30
GetDlgItem.USER32(?,?), ref: 002AFD55
SendMessageW.USER32(?,?,?,?), ref: 002AFE1F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ItemMessageSendWindow
String ID:
API String ID: 799199299-0
Opcode ID: 927bbccf9870a7dfd6b087ee0b2eb44df2fecd4a2bed4a2c0a6c9a450a0c49f9
Instruction ID: 004a91d60fb09552f1be48a006356187fb53798b0451060034d85258b3c2aba1
Opcode Fuzzy Hash: 927bbccf9870a7dfd6b087ee0b2eb44df2fecd4a2bed4a2c0a6c9a450a0c49f9
Instruction Fuzzy Hash: E64127363105029FC7658FA8EA88EA6B7A5FB47311F04443AE489C7162DF35EC21DB20

Function 0039BCD0 Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0039BD04
std::_Lockit::_Lockit.LIBCPMT ref: 0039BD24
std::_Lockit::~_Lockit.LIBCPMT ref: 0039BD4C
std::_Facet_Register.LIBCPMT ref: 0039BE2B
std::_Lockit::~_Lockit.LIBCPMT ref: 0039BE55

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: 273fbc6be1a9395a95ac420f12680576e0c4f144d6cae779d46dbc3b80328bb4
Instruction ID: edf94b11823d33e5534e13931aa44105e1151c01d7e968a872dd0433c754e30b
Opcode Fuzzy Hash: 273fbc6be1a9395a95ac420f12680576e0c4f144d6cae779d46dbc3b80328bb4
Instruction Fuzzy Hash: 2151BB74900208DFDF12CF58D9457EEBBF4AF11318F20815EE841AB291DB75AE05CB91

Function 002F7A70 Relevance: 7.6, APIs: 5, Instructions: 100threadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002F7A99
CoInitializeEx.COMBASE(00000000,00000002), ref: 002F7AA9
SendMessageW.USER32(?,000005FA,?,00000000), ref: 002F7BC1

Part of subcall function 00306040: EnterCriticalSection.KERNEL32(E48E37CD,E48E37CD), ref: 00306080
Part of subcall function 00306040: GetCurrentThreadId.KERNEL32 ref: 00306093
Part of subcall function 00306040: LeaveCriticalSection.KERNEL32(?), ref: 00306111

Part of subcall function 00300100: SetLastError.KERNEL32(0000000E,?,002F880B,?,?,?,?), ref: 00300118

GetLastError.KERNEL32(?,?,004CC530,00000000), ref: 002F7B33
ShowWindow.USER32(?,0000000A,?,?,004CC530,00000000), ref: 002F7B45

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalCurrentErrorLastSectionThread$EnterInitializeLeaveMessageSendShowWindow
String ID:
API String ID: 2782539745-0
Opcode ID: ed776e083b0b53a58b1c3cca1a361ad1f970e7991ae1e93f323a7cf24cfc6f7f
Instruction ID: ac3c1d84917feb7df13dd63e53f92141c03eeda14bfcd2d98d73f169c2c8930a
Opcode Fuzzy Hash: ed776e083b0b53a58b1c3cca1a361ad1f970e7991ae1e93f323a7cf24cfc6f7f
Instruction Fuzzy Hash: 2031DC71D10209EBDB15EFA0CC5ABEEFBB4EF10308F104269E5116B2D0DBB95A09CB91

Function 002ADB60 Relevance: 7.6, APIs: 5, Instructions: 81COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002ADBC2
VariantClear.OLEAUT32(?), ref: 002ADC1B
VariantClear.OLEAUT32(?), ref: 002ADC25
VariantClear.OLEAUT32(?), ref: 002ADC2F
VariantClear.OLEAUT32(?), ref: 002ADC3C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Variant$Clear$Init
String ID:
API String ID: 3740757921-0
Opcode ID: 78486b0ba6afd27f93b7f029463b117397037cc3b0597503a5519f9f2c87757f
Instruction ID: 8f4f5ab554aa4f2b8436a8d72d7437327b36f144610986247862fc9ad90674db
Opcode Fuzzy Hash: 78486b0ba6afd27f93b7f029463b117397037cc3b0597503a5519f9f2c87757f
Instruction Fuzzy Hash: BA312A71D05248EFDB05CFA8C944BDEBBF8EF59704F10C59AE410A7290D7B5AA48CBA1

Function 002D46E0 Relevance: 7.6, APIs: 5, Instructions: 60memorywindowCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 002D472A
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 002D4730
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,00000000,00000000,00000000), ref: 002D4753
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,00466756,000000FF), ref: 002D477B
HeapFree.KERNEL32(00000000,00000000,00000000,?,?,?,00466756,000000FF), ref: 002D4781

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess$FormatMessage
String ID:
API String ID: 1606019998-0
Opcode ID: 1e6a57d3b5409937a3543e181e4af3536230fc809488315b22734892c04d643f
Instruction ID: 7c96cc09c7ab6473752850398d11cf614c4e5f6765d0d9f9b5504ef9ee38721b
Opcode Fuzzy Hash: 1e6a57d3b5409937a3543e181e4af3536230fc809488315b22734892c04d643f
Instruction Fuzzy Hash: 341163B1A44219ABEB10DF94CD46BAFB7BCEB04B08F10051AF510BB6C1D7F9A9048795

Function 002C0DC0 Relevance: 7.6, APIs: 5, Instructions: 58windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 002C0DCB
SendMessageW.USER32(?,?,?,0000102B), ref: 002C0E28
SendMessageW.USER32(?,?,?,0000102B), ref: 002C0E77
SendMessageW.USER32(?,00001043,00000000,00000000), ref: 002C0E88
SendMessageW.USER32(?,00001013,00000000,00000000), ref: 002C0E95

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: 547d4cc2a6a134b1ef8cb416b86bc089f16a7c45e506cf14199ba591030c150e
Instruction ID: ea7d1634cf7d15eee095bc392496e0237641153757df6a830781a11d478747b9
Opcode Fuzzy Hash: 547d4cc2a6a134b1ef8cb416b86bc089f16a7c45e506cf14199ba591030c150e
Instruction Fuzzy Hash: 60215131958746A7D220DF11CD44B5ABBF1BFEE758F202B0EF1D4211A4E7F191848E86

Function 003BA780 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Part of subcall function 003BA570: GetModuleFileNameW.KERNEL32(00000000,00000104,00000104,00000010), ref: 003BA59D

_wcschr.LIBVCRUNTIME ref: 003BAAE2
_wcschr.LIBVCRUNTIME ref: 003BAB6F

Strings

hM, xrefs: 003BABF5
lM, xrefs: 003BABEE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Init_thread_footer_wcschr$FileHeapModuleNameProcess
String ID: hM$lM
API String ID: 973101865-1634504729
Opcode ID: bf85fbe62f26a33c63c0c604bb8142db0a82dd6021f339454d320ca8f4ae0ad7
Instruction ID: 0bbaa86850d949c8132de06f0bf4658d020ed0abafaa6fcc927273324aa645c4
Opcode Fuzzy Hash: bf85fbe62f26a33c63c0c604bb8142db0a82dd6021f339454d320ca8f4ae0ad7
Instruction Fuzzy Hash: 7CF10171A00A09DFDB01DFA8C849BDEFBF8EF44314F15826EE515AB291EB709904CB91

Function 003D3F70 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 417COMMON

Download Yara Rule

APIs

_wcschr.LIBVCRUNTIME ref: 003D3FC9
_wcschr.LIBVCRUNTIME ref: 003D40A9

Strings

realm, xrefs: 003D438D, 003D439F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: _wcschr
String ID: realm
API String ID: 2691759472-4204190682
Opcode ID: 50c34606c257566096e354021ee8095d4886208a6faf22f261d49be28f47c03f
Instruction ID: 74e10de24d24d36cf20d50e49b56e1b8657a93158f161d656a64765ae5ed3055
Opcode Fuzzy Hash: 50c34606c257566096e354021ee8095d4886208a6faf22f261d49be28f47c03f
Instruction Fuzzy Hash: 49F1AF32A00609DFDB02DFA8D848B9EBBB9EF55320F15C25AE8149B391DB74DD45CB90

Function 002AD8D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 231windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AtlAxWin140,?,?,?,80000000,00000000,00000000,?,00000000,00000000), ref: 002AD946
SendMessageW.USER32(?,00000000,00000000), ref: 002ADA42

Part of subcall function 002AF190: SysFreeString.OLEAUT32(00000000), ref: 002AF233

Strings

>L, xrefs: 002AD971
AtlAxWin140, xrefs: 002AD93E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateFreeMessageSendStringWindow
String ID: AtlAxWin140$>L
API String ID: 4045344427-2678703139
Opcode ID: aa54b2fbc670f9655aca5d1c3b63d585bc48a11fd3f9b13b1798655f6392dcb3
Instruction ID: 4b16defcfe1b091cbcd968a2aca438fa85a50491b36b367356efec886eeadfc8
Opcode Fuzzy Hash: aa54b2fbc670f9655aca5d1c3b63d585bc48a11fd3f9b13b1798655f6392dcb3
Instruction Fuzzy Hash: B5911474600205EFDB14CF64C888B5ABBB9FF49714F208599F81A9B291CB75E915CF50

Function 003007C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000004,?), ref: 0030083C
MonitorFromWindow.USER32(?,00000002), ref: 00300860
GetMonitorInfoW.USER32(00000000,?), ref: 00300882

Strings

U2C, xrefs: 00300998, 003009A8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MonitorWindow$FromInfoRect
String ID: U2C
API String ID: 1973172141-2543022354
Opcode ID: 4811f54dc325868474f7d0955c719ce29b878a7cb8321f01db235881bf711089
Instruction ID: 1564ada9ce7401fa517a196acf9bb31a8b50c2a774c9d6477b7e6268b48fca27
Opcode Fuzzy Hash: 4811f54dc325868474f7d0955c719ce29b878a7cb8321f01db235881bf711089
Instruction Fuzzy Hash: 19716675E00208ABDB15DFA8DD49BEEBBF9EF59704F114219F805A72A0DB70A904DF60

Function 002FC4B0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 173COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 002FC4EE
SetWindowPos.USER32(?,00000000,?,?,?,00000008,00000604), ref: 002FC6C1

Strings

AiDlgHeight, xrefs: 002FC5E1
AiDlgWeight, xrefs: 002FC50C

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Rect
String ID: AiDlgHeight$AiDlgWeight
API String ID: 3200805268-871102398
Opcode ID: ec900b1fff2d123f9cbd3affb38ddcc69cf5f638d92afba463017cefba2cf657
Instruction ID: 8fac785a3c81eb746ac0e0d51b40064e2cdce4fb32333cf0a2e75f5c68161794
Opcode Fuzzy Hash: ec900b1fff2d123f9cbd3affb38ddcc69cf5f638d92afba463017cefba2cf657
Instruction Fuzzy Hash: 66617E71D0024DEFDB04CFA8C945B9EFBB9EF48304F14816AE911AB291D774AA18CF94

Function 003DF940 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,E48E37CD,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 003DF974

Part of subcall function 003A5170: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,80004005,80004005,?,?,?,00000000,0049A8AD,000000FF), ref: 003A5188
Part of subcall function 003A5170: MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,80004005,80004005,?,?,?,00000000,0049A8AD,000000FF), ref: 003A51BB

Part of subcall function 002B2970: RaiseException.KERNEL32(?,?,00000000,00000000,00435A3C,C000008C,00000001,?,00435A6D,00000000,?,002A91C7,00000000,E48E37CD,00000001,?), ref: 002B297C

Part of subcall function 002A9B10: RtlAllocateHeap.NTDLL(?,00000000,?,E48E37CD,00000000,0045D840,000000FF,?,?,00539A1C,?,003DBB18,80004005,E48E37CD), ref: 002A9B5A

Strings

.pack, xrefs: 003DFCB1
.jar, xrefs: 003DFDFC
*.*, xrefs: 003DF9EA, 003DF9FC, 003DFA04

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateExceptionHeapObjectRaiseSingleWait
String ID: *.*$.jar$.pack
API String ID: 2917691982-3892993289
Opcode ID: 99f83a1e5ff1806182c070346a9e64de4b38190717784336c52a4612122080a5
Instruction ID: 561e9bec4a34aa12f36ac18dd2afc6ec881549ee529e4be6d3dd2b52074163d1
Opcode Fuzzy Hash: 99f83a1e5ff1806182c070346a9e64de4b38190717784336c52a4612122080a5
Instruction Fuzzy Hash: 75518F71A0060A9FDB11DFA9D894BAEB7B4FF05314F15826AE426EB391DB34D904CF90

Function 0030C2E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

P\T, xrefs: 0030C417
T\T, xrefs: 0030C405
Windows.UI.Xaml.Controls.CheckBox, xrefs: 0030C38A

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: P\T$T\T$Windows.UI.Xaml.Controls.CheckBox
API String ID: 0-3626274231
Opcode ID: 1c5347e6356d0e77c73066ef20203f5bf64b15f76af383c0d0639f0cf517e1d8
Instruction ID: b7a12414e66a7885d3c483c210737f2fc41a267eb188743ac183742fb9e9657f
Opcode Fuzzy Hash: 1c5347e6356d0e77c73066ef20203f5bf64b15f76af383c0d0639f0cf517e1d8
Instruction Fuzzy Hash: 0D518FB1D11219DBDB01DF94C985BEEBBB8FB04714F10452AE915A73C1DBB45A08CBE1

Function 002F4340 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

([T, xrefs: 002F4477
Windows.UI.Xaml.Controls.ListBoxItem, xrefs: 002F43EA
,[T, xrefs: 002F4465

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: ([T$,[T$Windows.UI.Xaml.Controls.ListBoxItem
API String ID: 0-881870976
Opcode ID: 4f9783ebf2b8f9d9e42a48ab5a2f538f82b2d8e4b25bb8b19ae860eb17732430
Instruction ID: 32e7e28bf13bc10cd8ca8880c302ec54276d2fcf80a72e33f00f8dafb9dee871
Opcode Fuzzy Hash: 4f9783ebf2b8f9d9e42a48ab5a2f538f82b2d8e4b25bb8b19ae860eb17732430
Instruction Fuzzy Hash: E0519FB191061ADBDB04DF94C945BEFFBB8FB04714F10452AE911A7381D7B45A04CBE1

Function 00308830 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

$\T, xrefs: 00308955
\T, xrefs: 00308967
Windows.Foundation.Uri, xrefs: 003088DA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: \T$$\T$Windows.Foundation.Uri
API String ID: 0-481313770
Opcode ID: 323dc1d7087c4e7a9682f2f797b4b3ec91cf598b88eaafc04dc42b868872bc76
Instruction ID: de97e91ad8e5dc8a37e1c0e5eddbf0826d6102d58b884c4c785f94d2a6d05097
Opcode Fuzzy Hash: 323dc1d7087c4e7a9682f2f797b4b3ec91cf598b88eaafc04dc42b868872bc76
Instruction Fuzzy Hash: 24518CB1D1125ADBDB04DF94C981BEEBBB8FB04714F10452AE815A73C1DBB45A08CBD1

Function 00310D60 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

Windows.UI.Xaml.Controls.ComboBox, xrefs: 00310E0A
p\T, xrefs: 00310E97
t\T, xrefs: 00310E85

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ComboBox$p\T$t\T
API String ID: 0-1935788850
Opcode ID: 598e4a51166cd9ea22cb59ad6d8f04ce4af3ec53d1b05dc827cc86ef25900a3a
Instruction ID: 13fb2660eb79a218ae27f97c8eb570cf723e7b791b42fe5a90d3c407d6c7e9c6
Opcode Fuzzy Hash: 598e4a51166cd9ea22cb59ad6d8f04ce4af3ec53d1b05dc827cc86ef25900a3a
Instruction Fuzzy Hash: F751A0B1D0061ADFCB05DFA8C985BEEBBB8FB04718F10452AE811A7381D7B45A44CBE1

Function 002F5470 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

x[T, xrefs: 002F55A7
Windows.UI.Xaml.Controls.ListViewItem, xrefs: 002F551A
|[T, xrefs: 002F5595

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ListViewItem$x[T$|[T
API String ID: 0-936118318
Opcode ID: b2fbf1235de493ff7bc429a8f573223023b84624cefba1e3ade9326e3ecf1ff7
Instruction ID: 5b960429e5fda64e1b1b2dca2ba1c6ef558319523e8107171f423e1a09f6abe6
Opcode Fuzzy Hash: b2fbf1235de493ff7bc429a8f573223023b84624cefba1e3ade9326e3ecf1ff7
Instruction Fuzzy Hash: 79516FB191061ADBDB01DFA4C946BEEFBB4FB04718F10452AE911A7381D7745A04CBD1

Function 002F3620 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

ZT, xrefs: 002F3757
Windows.UI.Xaml.Controls.Grid, xrefs: 002F36CA
ZT, xrefs: 002F3745

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.Grid$ZT$ZT
API String ID: 0-3490141095
Opcode ID: 4ce0ff4c21c9a8b316c18cd7f12adf5426dfc1d6e53b2866b6db940565d906da
Instruction ID: c9f7e4bd97f0649da47019d445a83f792499d8a634d0b6f837dbe2f780abaec6
Opcode Fuzzy Hash: 4ce0ff4c21c9a8b316c18cd7f12adf5426dfc1d6e53b2866b6db940565d906da
Instruction Fuzzy Hash: 99516DB1D1061ADBDB00DF94C985BEEFBB8FB04715F10452AE911A7381D7B55A08CBD1

Function 002F1D30 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

XZT, xrefs: 002F1E67
Windows.UI.Xaml.Controls.TreeView, xrefs: 002F1DDA
\ZT, xrefs: 002F1E55

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.TreeView$XZT$\ZT
API String ID: 0-810584018
Opcode ID: f4757bd67373f19e4717091db4fb65c84742170ef1f828560ae67429b01d75ec
Instruction ID: 63a08554fc224c55ad0d9e7bf56cafad1fa5fa34058d495e7c0de1448c43875d
Opcode Fuzzy Hash: f4757bd67373f19e4717091db4fb65c84742170ef1f828560ae67429b01d75ec
Instruction Fuzzy Hash: 39518CB191025AEBDB00DF94C985BEEFBB8FB04718F10452AE911A7381D7B45A18CBD1

Function 002F1FA0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

hZT, xrefs: 002F20D7
Windows.UI.Xaml.Controls.ProgressBar, xrefs: 002F204A
lZT, xrefs: 002F20C5

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: Windows.UI.Xaml.Controls.ProgressBar$hZT$lZT
API String ID: 0-1479912524
Opcode ID: 509e03d3de308fd0d18b77c3dfe830d6e10e12d9a6b545713cf82955137c12a6
Instruction ID: 1abd054072ec67f761c4c32cd1b32b16cab3c27e7fde8fa1d61595ccaef19d40
Opcode Fuzzy Hash: 509e03d3de308fd0d18b77c3dfe830d6e10e12d9a6b545713cf82955137c12a6
Instruction Fuzzy Hash: C4517DB191021ADBDB00DF94C985BEEFBB8FB05719F10452AE911A7381DBB55A08CBE1

Function 00327F80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 128COMMON

Download Yara Rule

Strings

]T, xrefs: 003280B7
Windows.UI.Xaml.Controls.TreeViewNode, xrefs: 0032802A
$]T, xrefs: 003280A5

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: ]T$$]T$Windows.UI.Xaml.Controls.TreeViewNode
API String ID: 0-4113699014
Opcode ID: 5969fd82fbccf17885c795d78d3bd393f07d4c69ddf8502baf89a38f36fa518b
Instruction ID: 6bf7d1ac35542ad52a03b6520f867e3e83020edd62a435791e136775a9a15174
Opcode Fuzzy Hash: 5969fd82fbccf17885c795d78d3bd393f07d4c69ddf8502baf89a38f36fa518b
Instruction Fuzzy Hash: 60519CB1D00219EBDB05DF98D945BEEBBB8FB04718F10452AE801A7381DB746A08CBE1

Function 002F48C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 126COMMON

Download Yara Rule

Strings

Windows.UI.Text.FontWeights, xrefs: 002F4969
L[T, xrefs: 002F49E2
H[T, xrefs: 002F49F4

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: H[T$L[T$Windows.UI.Text.FontWeights
API String ID: 0-1129277418
Opcode ID: 658e2ab5d497441732b714a1cfc5af8c3af4c1f7f0ccee234ba25bf70f5728ca
Instruction ID: 956315a345f0deca8c6d752ca800e711e0f784ceca8b957001ad6fd7d7cba267
Opcode Fuzzy Hash: 658e2ab5d497441732b714a1cfc5af8c3af4c1f7f0ccee234ba25bf70f5728ca
Instruction Fuzzy Hash: 36516CB091025ADFDB11DFA8D842BAEFBB4FB05718F10456AE911A7381E7B45A08CBD1

Function 00305E00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(013CE460,E48E37CD,013CE460), ref: 00305E41
GetCurrentThreadId.KERNEL32 ref: 00305E51
LeaveCriticalSection.KERNEL32(?), ref: 00305E77

Strings

cw, xrefs: 00305E77

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: cw
API String ID: 2351996187-348920815
Opcode ID: 0462889de84b3ebd7b93adf48c2953435e7897b002d129265558da0c15d82a54
Instruction ID: c76801a8793ce63ae2a5da64b8bc8a28b9a0527e7a952f98139ea228b1d7b2d4
Opcode Fuzzy Hash: 0462889de84b3ebd7b93adf48c2953435e7897b002d129265558da0c15d82a54
Instruction Fuzzy Hash: 4F41EE71A01916AFDB11CF58C891BABF7A8FB44314F118329E865D7280D731EE58CBD0

Function 002F86F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000005,?,?,?), ref: 002F881F

Strings

|f/, xrefs: 002F8715, 002F882E
(0C, xrefs: 002F8816
|f/, xrefs: 002F8726

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ShowWindow
String ID: (0C$|f/$|f/
API String ID: 1268545403-4180785344
Opcode ID: 94248853f5d4d0824a7af270911dbc6f8efa8186940e7744c790fe72970668d5
Instruction ID: d2d805192c8c450cadbae762c792469074ac2732658b476f67ec1ce412c8f507
Opcode Fuzzy Hash: 94248853f5d4d0824a7af270911dbc6f8efa8186940e7744c790fe72970668d5
Instruction Fuzzy Hash: 28418A34901209EFDB11DFA4C849BDEFBB4EF08304F24416DE815AB292DB75AA04CF90

Function 002D2730 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545958,Windows.Management.Deployment.PackageManager,0000002C,E48E37CD,?,?,?,00545954,00466017,000000FF), ref: 002D2808

Strings

Windows.Management.Deployment.PackageManager, xrefs: 002D275A
TYT, xrefs: 002D27D7
PYT, xrefs: 002D27E9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: PYT$TYT$Windows.Management.Deployment.PackageManager
API String ID: 4129690577-2628066133
Opcode ID: 2592a3307a5c9a28f161199ca516625341513810fdeffe943ea482defb678ea4
Instruction ID: 1b415265947acfd840636ed14be3335e86ea4b678f7747559340c0e4cea51b5f
Opcode Fuzzy Hash: 2592a3307a5c9a28f161199ca516625341513810fdeffe943ea482defb678ea4
Instruction Fuzzy Hash: 78318B7191021AEBDB00CF94C945BEEFBB4FB15714F10412AE814AB381E7B45E18CBD1

Function 002F2211 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545A80,Windows.UI.Xaml.Controls.Image,0000001E,E48E37CD), ref: 002F22E8

Strings

Windows.UI.Xaml.Controls.Image, xrefs: 002F223A
xZT, xrefs: 002F22C9
|ZT, xrefs: 002F22B7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.UI.Xaml.Controls.Image$xZT$|ZT
API String ID: 4129690577-3037087256
Opcode ID: da15cdffe9b63e588760fe33389ee46198c1676c23693b7e3af34796d03fdbd9
Instruction ID: a15e2ffba27dafccd49656896a7c5c457ccbd12a3347c3fa8d1bf0cc0d2f856f
Opcode Fuzzy Hash: da15cdffe9b63e588760fe33389ee46198c1676c23693b7e3af34796d03fdbd9
Instruction Fuzzy Hash: 92317CB191065AEBDB00CFA4C985BEEFBB4FF15315F10412AE810A7391E7B55A08CBD2

Function 0030C0F0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545B70,Windows.Foundation.PropertyValue,00000020,E48E37CD,?,?), ref: 0030C1C6

Strings

Windows.Foundation.PropertyValue, xrefs: 0030C11A
l[T, xrefs: 0030C195
h[T, xrefs: 0030C1A7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.Foundation.PropertyValue$h[T$l[T
API String ID: 4129690577-3456098058
Opcode ID: 4d10fcf5644b86900d7f86d2cf83c93ef4bec5fe3b5992a85786ead691fd8032
Instruction ID: b1dcbd87464365580306095d58729c706cd30dba7a6b58b9770c2dbbc893f666
Opcode Fuzzy Hash: 4d10fcf5644b86900d7f86d2cf83c93ef4bec5fe3b5992a85786ead691fd8032
Instruction Fuzzy Hash: DE31AE71911219DBDB05DF94C956BEEFBB4FB05718F10412AE811772C2DBB45A08CBD1

Function 00304A00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545B70,Windows.Foundation.PropertyValue,00000020,E48E37CD,00000000,00000000), ref: 00304AD6

Strings

Windows.Foundation.PropertyValue, xrefs: 00304A2A
l[T, xrefs: 00304AA5
h[T, xrefs: 00304AB7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.Foundation.PropertyValue$h[T$l[T
API String ID: 4129690577-3456098058
Opcode ID: 4d10fcf5644b86900d7f86d2cf83c93ef4bec5fe3b5992a85786ead691fd8032
Instruction ID: 7024b64c24281ef2ff997891e298fc562230b4d983d645cc9457070b13e3b105
Opcode Fuzzy Hash: 4d10fcf5644b86900d7f86d2cf83c93ef4bec5fe3b5992a85786ead691fd8032
Instruction Fuzzy Hash: 6B319CB1901219DBDB01DF94C856BEEBBB4FB05718F10402AE911772C1DBB45B08CBD1

Function 00319A20 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545B70,Windows.Foundation.PropertyValue,00000020,E48E37CD,?,?), ref: 00319AF6

Strings

Windows.Foundation.PropertyValue, xrefs: 00319A4A
h[T, xrefs: 00319AD7
l[T, xrefs: 00319AC5

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: Windows.Foundation.PropertyValue$h[T$l[T
API String ID: 4129690577-3456098058
Opcode ID: 144b92a0c371c10d678478de4261949e7e1d791248eba0cb6c0e3bce5234fb69
Instruction ID: 74a060cbea37e90ef4fcbb9a0ae952b0d7f3340b020f721b028df2a4fe403244
Opcode Fuzzy Hash: 144b92a0c371c10d678478de4261949e7e1d791248eba0cb6c0e3bce5234fb69
Instruction Fuzzy Hash: A131BA70900219DBCB05DFA4C852BEEFBB4FF08718F10402AE8016B2C1DBB41A48CBD2

Function 00306040 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(E48E37CD,E48E37CD), ref: 00306080
GetCurrentThreadId.KERNEL32 ref: 00306093
LeaveCriticalSection.KERNEL32(?), ref: 00306111

Strings

cw, xrefs: 00306111

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread
String ID: cw
API String ID: 2351996187-348920815
Opcode ID: f464e5ef514046c62a9fc1a15b344693ba5a222fca808f2ce6c101406685d697
Instruction ID: 7b49a34180bb6e30d5636f06c68d0dc7f777b804c8415e57c2fe0caa3e41141c
Opcode Fuzzy Hash: f464e5ef514046c62a9fc1a15b344693ba5a222fca808f2ce6c101406685d697
Instruction Fuzzy Hash: 5531BF71904644DFDB12CF59C84679EBBF4EF09314F14816DE895A33A1E775AA04CB90

Function 002D4B50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(combase.dll,RoOriginateLanguageException), ref: 002D4B92
GetProcAddress.KERNEL32(00000000,combase.dll), ref: 002D4B98

Strings

combase.dll, xrefs: 002D4B8D
RoOriginateLanguageException, xrefs: 002D4B88

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoOriginateLanguageException$combase.dll
API String ID: 2574300362-3996158991
Opcode ID: 7d5ecc93ee863025578f2404f5ede602971f69000ebd2cc54a84d855a65226d3
Instruction ID: 7ed5f524acc7091364cb0db634492b216e25f1fb7dd56f6fdd14d9fdd5c3f317
Opcode Fuzzy Hash: 7d5ecc93ee863025578f2404f5ede602971f69000ebd2cc54a84d855a65226d3
Instruction Fuzzy Hash: 38318F30914209EFDB14EFA8C941BAEB7B4EB04314F10452BE825A73C0E7789E54CB91

Function 003D2140 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,003D029A,?,E48E37CD,?,?,?,000000FF,?), ref: 003D2154
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,003D029A,?,E48E37CD,?,?,?,000000FF,?,003CFC64), ref: 003D2171
GetLastError.KERNEL32(?,E48E37CD,?,?,?,000000FF,?,003CFC64,?,?,00000000,00000000,E48E37CD,?,?), ref: 003D21D0

Strings

AdvancedInstaller, xrefs: 003D21B7

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateEvent$ErrorLast
String ID: AdvancedInstaller
API String ID: 1131763895-1372594473
Opcode ID: 9e20daf372e15df2cf8214315ceb113a3b28202f7738d4c09d36345e4a791fa5
Instruction ID: 5322dc6aad711804aaf957f3dbac996eac676bf85f9ae89c3ddd46e1a5065090
Opcode Fuzzy Hash: 9e20daf372e15df2cf8214315ceb113a3b28202f7738d4c09d36345e4a791fa5
Instruction Fuzzy Hash: D4118E72340602BBE711DB22EC89F56BBA4BB54704F12842AF6059B690CB70B851CBA4

Function 002F95E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 002F962E
DestroyWindow.USER32(?), ref: 002F966A

Strings

Eg/, xrefs: 002F9670
Eg/, xrefs: 002F9602, 002F9682

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Destroy
String ID: Eg/$Eg/
API String ID: 3707531092-89372140
Opcode ID: e7591b31b3ab5d87d755fd8d4a848199f1b2acb8ae2f684dbc8bf94daebb4ffc
Instruction ID: e8b35b50e99e6379859227c4495d093d5212633a3c2c3029a9c063bc836094a6
Opcode Fuzzy Hash: e7591b31b3ab5d87d755fd8d4a848199f1b2acb8ae2f684dbc8bf94daebb4ffc
Instruction Fuzzy Hash: 68210E30904689EFCB01CF68C904BDDFBF8FB05714F10826AE42597290CBB5AA04CB90

Function 00381F50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00382470: __Init_thread_footer.LIBCMT ref: 00382500
Part of subcall function 00382470: GetProcAddress.KERNEL32(SetWindowTheme), ref: 0038253D
Part of subcall function 00382470: __Init_thread_footer.LIBCMT ref: 00382554
Part of subcall function 00382470: SendMessageW.USER32(000000EF,00001036,00010000,00010000), ref: 0038257F

CreateWindowExW.USER32(80000000,SysListView32,?,00000000,00000000,80000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00381FA2
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00381FC0
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00381FC8

Part of subcall function 002B0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 002B0DE6

Strings

SysListView32, xrefs: 00381F99

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSend$Init_thread_footerWindow$AddressCreateLongProc
String ID: SysListView32
API String ID: 605634508-78025650
Opcode ID: e0d7128e29678b7ac043c48d38dd032a344c8d9eef39963193e5b949cba0cd2a
Instruction ID: 9cb72a50303c9ceaab777f82aebb9087f44be3215f330f069bc75fae72b61b99
Opcode Fuzzy Hash: e0d7128e29678b7ac043c48d38dd032a344c8d9eef39963193e5b949cba0cd2a
Instruction Fuzzy Hash: 7F117935341310AFD625AB158C05F9BFBE9FBCA750F054659FA44AB2A1C6B1AC00DBA1

Function 003829C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(46030080,RichEdit20W,?,00000000,46030080,80000000,00000000,00000000,00000000,00000000,00000000), ref: 00382A0B
SendMessageW.USER32(00000000,00000031,00000000,00000000), ref: 00382A23
SendMessageW.USER32(00000000,00000030,00000000,00000001), ref: 00382A2B

Part of subcall function 002B0DB0: SetWindowLongW.USER32(?,000000FC,00000000), ref: 002B0DE6

Strings

RichEdit20W, xrefs: 00382A02

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageSendWindow$CreateLong
String ID: RichEdit20W
API String ID: 4015368215-4173859555
Opcode ID: 7140fc53616db744416a6a4b19b82a9c186a4a1ae3e237bf0dcd2ae89d421085
Instruction ID: 53caf55d0108822dcfda5885eaa7e0e174198627cd5a442e24c68d32c0c36e40
Opcode Fuzzy Hash: 7140fc53616db744416a6a4b19b82a9c186a4a1ae3e237bf0dcd2ae89d421085
Instruction Fuzzy Hash: 97015735341210AFD6159B15DC05F9BFBE9FBCA760F15821AFA48A73A0C6B1AC00DEA1

Function 00304830 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00304881
GetParent.USER32(?), ref: 0030488A
SendMessageW.USER32(?,00000411,00000000,?), ref: 0030489F

Strings

,, xrefs: 00304879

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Parent$MessageSend
String ID: ,
API String ID: 2251359880-3772416878
Opcode ID: 79fe506ba16bba300d8f12626e58fc2c1b976cfa36acaeade1288522569740f6
Instruction ID: 533219d8971c6a8e399d9066e5562c8341b5b4bd0628736399f1747500f85354
Opcode Fuzzy Hash: 79fe506ba16bba300d8f12626e58fc2c1b976cfa36acaeade1288522569740f6
Instruction Fuzzy Hash: BA11C0B1515300AFDB11DF14DC44B1BFBE4FB89300F01892AF61482290C7B2E914CF92

Function 002C3E70 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002C3ECD
VariantClear.OLEAUT32(?), ref: 002C3EFF
VariantClear.OLEAUT32(?), ref: 002C4117
VariantClear.OLEAUT32(?), ref: 002C4146

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 9bcd90a5b09a9420a019098639354d7dbf3a7423987db6d628c68eba3e09460a
Instruction ID: 7099d87bc7a46d9b378cdc7697885f8bade0b5bb471671d647d1483ae5c21a42
Opcode Fuzzy Hash: 9bcd90a5b09a9420a019098639354d7dbf3a7423987db6d628c68eba3e09460a
Instruction Fuzzy Hash: 84A17674910209DFCB10DFA8C884BDEBBB4FF58304F258269E408A7391E774AA59CF95

Function 002C2F00 Relevance: 6.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 002C2F5A
VariantClear.OLEAUT32(?), ref: 002C2F8C
VariantClear.OLEAUT32(?), ref: 002C30F5
VariantClear.OLEAUT32(?), ref: 002C3124

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 235bcfd304fbea05ee4b4d1d4c78e132d35b22d95e2471f53880d39d489a3ff9
Instruction ID: 817ebf4d638a21a598998eed618a5325a3a7cd3239ddd42edc847c1111725055
Opcode Fuzzy Hash: 235bcfd304fbea05ee4b4d1d4c78e132d35b22d95e2471f53880d39d489a3ff9
Instruction Fuzzy Hash: 0881C030910348DFDB10DFA8C844B9EFBB4EF05704F24825DE808AB391E774AA49CB91

Function 002B4650 Relevance: 6.2, APIs: 4, Instructions: 194COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 002B46F0
SysFreeString.OLEAUT32(00000000), ref: 002B4731

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: FreeString
String ID:
API String ID: 3341692771-0
Opcode ID: 887356af4e2365775ff891d0a95a17401096824d646207f1135ad4f34817a17d
Instruction ID: 7277514d865cb9de2c347face18c01ba6edf11ee5d86c2bb46afcebfe186a7a3
Opcode Fuzzy Hash: 887356af4e2365775ff891d0a95a17401096824d646207f1135ad4f34817a17d
Instruction Fuzzy Hash: 0361A076A04209EFDB10DF58D884B9ABBB8FB45760F10416AFC1497391DB76ED20DBA0

Function 002D4140 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,E48E37CD), ref: 002D4209
HeapFree.KERNEL32(00000000,?,?,E48E37CD), ref: 002D420F

Strings

tYT, xrefs: 002D4165
tYT, xrefs: 002D4221

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Heap$FreeProcess
String ID: tYT$tYT
API String ID: 3859560861-411996263
Opcode ID: 7491515543188b3b54534c86ce3cb5da65972efbc613aa0af8ca7e4acebcaf84
Instruction ID: d4ec977e5560a369ee840a42318f99819aec63bf56e4ed4db5428d7af33d8a98
Opcode Fuzzy Hash: 7491515543188b3b54534c86ce3cb5da65972efbc613aa0af8ca7e4acebcaf84
Instruction Fuzzy Hash: 62310531914609DBDB21EF69DC45B9AB7A8EB45734F24432FFC25977C1D738AD008AA0

Function 002BCCF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(E48E37CD,E48E37CD,?), ref: 002BCD2F
EnterCriticalSection.KERNEL32(?,E48E37CD,?), ref: 002BCD3C
LeaveCriticalSection.KERNEL32(?,?,00000000,?), ref: 002BCE13

Strings

cw, xrefs: 002BCE13

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: cw
API String ID: 3991485460-348920815
Opcode ID: 46cfaa1421ebd3b08652fee351246e6298f876f944f58bbf9c9a1c4a09dbea2b
Instruction ID: 6af956548fb07271383f4a2b3a0b53dcc495455d18d90ee6f8688e8e59e73a7e
Opcode Fuzzy Hash: 46cfaa1421ebd3b08652fee351246e6298f876f944f58bbf9c9a1c4a09dbea2b
Instruction Fuzzy Hash: 3F4116792107068FCB21DF38C841BEABBB5EF56350F204539E596D7391CB31A825DB90

Function 003BC6B0 Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,?,00000000,00000000), ref: 003BC70F
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 003BC71C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 003BC739
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 003BC75B

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 9058b719bd9b9e20a8433d49433653c6a97e549eb585ef2bcf57652fb88c46da
Instruction ID: 8ae52471eaa98a621acf902bd2f0e8c43c78bfd9fcb9923f428d982449a5f419
Opcode Fuzzy Hash: 9058b719bd9b9e20a8433d49433653c6a97e549eb585ef2bcf57652fb88c46da
Instruction Fuzzy Hash: 9A2145B27403067BE7209F14EC92FAB775CEB40B08F240128FB019B5C0EBA17D058A64

Function 002F642D Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00000010,?,00000060), ref: 002F6467
GetWindowRect.USER32(?,?), ref: 002F64B6
GetWindowLongW.USER32(?,000000EC), ref: 002F64DF
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?,?,?,00000060), ref: 002F6571

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$LongRect
String ID:
API String ID: 463821813-0
Opcode ID: f0111397e293ba0a2af52e3b55570bc67d259a36a13c59ba46292333c3caf003
Instruction ID: cab86a81ee5461e96cbd6e7255fc2cedbee0945a2e03d6f74d713fbbe961f13e
Opcode Fuzzy Hash: f0111397e293ba0a2af52e3b55570bc67d259a36a13c59ba46292333c3caf003
Instruction Fuzzy Hash: DD417B75108745AFC701DF28DC85AAAFBB4FF99304F044A2EFA8193260E771A898DF51

Function 003A5170 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,00000000,00000000,?,?,80004005,80004005,?,?,?,00000000,0049A8AD,000000FF), ref: 003A5188
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,-00000001,?,?,80004005,80004005,?,?,?,00000000,0049A8AD,000000FF), ref: 003A51BB
GetStdHandle.KERNEL32(000000F5,?,E48E37CD,00000000,0045D840,000000FF,?,80070057,?,-00000001,?,?,80004005,80004005,?,?), ref: 003A5226
SetConsoleTextAttribute.KERNEL32(00000000,?,E48E37CD,00000000,0045D840,000000FF,?,80070057,?,-00000001,?,?,80004005,80004005,?,?), ref: 003A522D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ByteCharMultiWide$AttributeConsoleHandleText
String ID:
API String ID: 3849414675-0
Opcode ID: 14a896727861f8c648b0b2a1ce657d373b06c2580e5fc71429b7efd1d5d25b1c
Instruction ID: 6688c584a537693d7047ef5b3c6d06ba85f37f68360b35a1d59fbcd7f44e803d
Opcode Fuzzy Hash: 14a896727861f8c648b0b2a1ce657d373b06c2580e5fc71429b7efd1d5d25b1c
Instruction Fuzzy Hash: 8521D476705601AFD6109B59DC89F6AF76CEB85720F20432EFA25DB2D0CF305811CBA4

Function 002F98E0 Relevance: 6.1, APIs: 4, Instructions: 84windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 002F996F
GetParent.USER32(00000000), ref: 002F9977
GetParent.USER32(00000000), ref: 002F997C
SendMessageW.USER32(00000000,0000037F,00000000,?), ref: 002F998D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Parent$MessageSend
String ID:
API String ID: 2251359880-0
Opcode ID: 9f7870afab117b6eeae7e4e50b3d1afe018cf63ce4cb73e1ba16c0f6907e1fb9
Instruction ID: 8fe041e30971eb1939b2bd0be0315c389c87942c7ca8b0a1fd623e96eada86e8
Opcode Fuzzy Hash: 9f7870afab117b6eeae7e4e50b3d1afe018cf63ce4cb73e1ba16c0f6907e1fb9
Instruction Fuzzy Hash: 7A21C53261010A6BDB259B28EC84FFEF79CEFA1794F054539F601C2150EB71DDA1CA64

Function 002B89D0 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000FC,00000000), ref: 002B8A19
GetParent.USER32(?), ref: 002B8A4D

Part of subcall function 00435D0D: GetProcessHeap.KERNEL32(00000008,00000008,?,002B0DC7,?,?,002B0B74,?), ref: 00435D12
Part of subcall function 00435D0D: HeapAlloc.KERNEL32(00000000,?,?,002B0B74,?), ref: 00435D19

SetWindowLongW.USER32(?,000000EB), ref: 002B8A80
ShowWindow.USER32(?,00000000), ref: 002B8A96

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$HeapLong$AllocParentProcessShow
String ID:
API String ID: 78937335-0
Opcode ID: 08a2e41d15387d3c82869f8c8b227384cb7a7f92eb564673e6e9bd21cb202b1b
Instruction ID: 30cecd44536b01f8b2561ecf5ba63c706bb3e8401962dfbc34d07b1600cc97c9
Opcode Fuzzy Hash: 08a2e41d15387d3c82869f8c8b227384cb7a7f92eb564673e6e9bd21cb202b1b
Instruction Fuzzy Hash: A12171746047029FC720EF29D849A6BBBE8FF59754B054A2EF49AC3661DB34E804CF61

Function 002BCB20 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,E48E37CD), ref: 002BCB8A
EnterCriticalSection.KERNEL32(?,E48E37CD), ref: 002BCB97
LeaveCriticalSection.KERNEL32(?), ref: 002BCBE8

Strings

cw, xrefs: 002BCBE8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: cw
API String ID: 3991485460-348920815
Opcode ID: f8f7c8ca432677ecb12d514a34b2360efb81a50da08953428b692a933b1f3b1e
Instruction ID: ac456302697957e49080a76615add1574dc7d15cfd930e7ddb71faaf9d076a7a
Opcode Fuzzy Hash: f8f7c8ca432677ecb12d514a34b2360efb81a50da08953428b692a933b1f3b1e
Instruction Fuzzy Hash: 1E21E5369002459FDF11DF64CC45BEABBB4FB16328F2005B9EC59AB382D7315909CB60

Function 002BCC10 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,E48E37CD), ref: 002BCC7A
EnterCriticalSection.KERNEL32(?,E48E37CD), ref: 002BCC87
LeaveCriticalSection.KERNEL32(?), ref: 002BCCCE

Strings

cw, xrefs: 002BCCCE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: cw
API String ID: 3991485460-348920815
Opcode ID: f5242bfa6bd4245b02fa7571afbe1a58f4b4434a6d50439467fc6eb55c1b8ce8
Instruction ID: 55e10fc4fd87cf6f98fc0e9767ba1d06d37e82d0764d41eb518e0f1eefa5d965
Opcode Fuzzy Hash: f5242bfa6bd4245b02fa7571afbe1a58f4b4434a6d50439467fc6eb55c1b8ce8
Instruction Fuzzy Hash: 6C21C4759002459FDF11DF64CC45BE9BBB8FF25324F2006AAEC59AB392D7315909CBA0

Function 002BCA60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,E48E37CD,?), ref: 002BCABD
EnterCriticalSection.KERNEL32(?,E48E37CD,?), ref: 002BCACA
LeaveCriticalSection.KERNEL32(?), ref: 002BCAF2

Strings

cw, xrefs: 002BCAF2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID: cw
API String ID: 3991485460-348920815
Opcode ID: 9b1428e730e2ef0bc8ccb2b2166a5b21325925bf4e22d0debc70eedea85d7f22
Instruction ID: 13ea7b0bf3aac19e7686930ee3ec4f8694e593bc5e60fad614636e0b379eca22
Opcode Fuzzy Hash: 9b1428e730e2ef0bc8ccb2b2166a5b21325925bf4e22d0debc70eedea85d7f22
Instruction Fuzzy Hash: 632129379042499FCF01CF64CC40BEABF78EB16324F2006ADD855A7381D7325A09CBA0

Function 0033F9D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 255windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 0033FAD1
SendMessageW.USER32(00000000,00000317,?,00000014), ref: 0033FB65

Strings

U2C, xrefs: 0033FC62, 0033FC7F

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: MessageRectSendWindow
String ID: U2C
API String ID: 2814762282-2543022354
Opcode ID: 33594be1d0fb07d069798bbc3be82438acd3ed66de29bca74f665e5c8e2bb7b0
Instruction ID: 16fcb52b4c2455a712afff8744e7f73de8053c3e6c30a3eaef4534d435bdd7b3
Opcode Fuzzy Hash: 33594be1d0fb07d069798bbc3be82438acd3ed66de29bca74f665e5c8e2bb7b0
Instruction Fuzzy Hash: CEB187B4E00609DFCB15CFA8C984B9DFBB4FF49304F198229E805AB351D770A955CB90

Function 003E0320 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 244fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

DeleteFileW.KERNEL32(?), ref: 003E03FA
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 003E052F

Part of subcall function 003CF280: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,E48E37CD,00000001,7597EB20,00000000), ref: 003CF2CF
Part of subcall function 003CF280: ReadFile.KERNEL32(00000000,?,000003FF,?,00000000,?,80000000,00000003,00000000,00000003,00000080,00000000,E48E37CD,00000001,7597EB20,00000000), ref: 003CF305

Part of subcall function 003CC7E0: LoadStringW.USER32(000000A1,?,00000514,E48E37CD), ref: 003CC836

Strings

--verbose --log-file="%s" --remove-pack-file "%s" "%s", xrefs: 003E03AE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: File$DeleteInit_thread_footer$CreateHeapLoadProcessReadString
String ID: --verbose --log-file="%s" --remove-pack-file "%s" "%s"
API String ID: 3544038457-3685554107
Opcode ID: 535bc1537ba0ab8b6cb7086dd9aaca90d55397808c42d5b72e2b95e16b811c63
Instruction ID: 5d3338ebdf0a7706b1d2055fd16a6e297ef95e3dfd14fb02494c9865c3412c87
Opcode Fuzzy Hash: 535bc1537ba0ab8b6cb7086dd9aaca90d55397808c42d5b72e2b95e16b811c63
Instruction Fuzzy Hash: 8691E031A006499FDB01DF69C844B9EBBB5EF45324F1882A9E815DB2E2DB70DD04CF90

Function 003C4C40 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 206COMMON

Download Yara Rule

APIs

GetSystemDefaultLangID.KERNEL32(E48E37CD,-00000044,?,-00000048,00000000), ref: 003C4C76

Part of subcall function 002A9E50: GetProcessHeap.KERNEL32 ref: 002A9EA5
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9ED7
Part of subcall function 002A9E50: __Init_thread_footer.LIBCMT ref: 002A9F62

Part of subcall function 003C4050: GetLocaleInfoW.KERNEL32(?,00000002,004C337C,00000000), ref: 003C40C1
Part of subcall function 003C4050: GetLocaleInfoW.KERNEL32(?,00000002,003C3B85,-00000001,00000078,-00000001), ref: 003C40FD

Strings

T`T, xrefs: 003C4CFC
SystemDefault LangID=, xrefs: 003C4CB8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: InfoInit_thread_footerLocale$DefaultHeapLangProcessSystem
String ID: SystemDefault LangID=$T`T
API String ID: 185108660-2467999230
Opcode ID: b84c776f5545f21c1e3a671a655583eb1eb91f10daa252e429b106791374d494
Instruction ID: c51beb8a285ca690b56325701ba1a71a7a3da4bce2d9219195db3de7e257b9c2
Opcode Fuzzy Hash: b84c776f5545f21c1e3a671a655583eb1eb91f10daa252e429b106791374d494
Instruction Fuzzy Hash: 9A51C031A006159BDB11DB6CCC59BAAB7B5FF41321F1583ADE826DB2D2DB34AD01CB90

Function 002ED130 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00436662: EnterCriticalSection.KERNEL32(00544CD8,?,?,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 0043666D
Part of subcall function 00436662: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9EF6,00545904,E48E37CD,?,?,0045DE0D,000000FF,?,003DBABC,E48E37CD), ref: 004366AA

__Init_thread_footer.LIBCMT ref: 002ED28D

Part of subcall function 00436618: EnterCriticalSection.KERNEL32(00544CD8,?,?,002A9F67,00545904,004B6640), ref: 00436622
Part of subcall function 00436618: LeaveCriticalSection.KERNEL32(00544CD8,?,002A9F67,00545904,004B6640), ref: 00436655
Part of subcall function 00436618: RtlWakeAllConditionVariable.NTDLL ref: 004366CC

Strings

Windows.UI.Xaml.Controls.ListViewItem, xrefs: 002ED256
ItemData, xrefs: 002ED2F2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CriticalSection$EnterLeave$ConditionInit_thread_footerVariableWake
String ID: ItemData$Windows.UI.Xaml.Controls.ListViewItem
API String ID: 2296764815-2445763458
Opcode ID: 2e37e4d0a80e5c9236da95710d5e6bb603fd8295eda4edfcae8c6d93b6f66486
Instruction ID: 5380416488675e11825f963b97cbdaf93afe93f4eb09e232606a98b911fa4f59
Opcode Fuzzy Hash: 2e37e4d0a80e5c9236da95710d5e6bb603fd8295eda4edfcae8c6d93b6f66486
Instruction Fuzzy Hash: AC718E70901289EFDB05DFA8C905BDEBBB0BF15308F148259E815672C1D7B99A18DFA2

Function 00393C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 158COMMON

Download Yara Rule

APIs

PathIsUNCW.SHLWAPI(?,E48E37CD,00000000,00000000), ref: 00393D11

Strings

\\?\, xrefs: 00393E0B, 00393E37
\\?\UNC\, xrefs: 00393D3C, 00393D9E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Path
String ID: \\?\$\\?\UNC\
API String ID: 2875597873-3019864461
Opcode ID: d8585bc1b285db782f906ae64c729eace4b07c3afc673522627b0f5ea2d4f1f0
Instruction ID: 325eec93eaddb034798661c607bf636bee64ade0415847b9e770d6cde64fa500
Opcode Fuzzy Hash: d8585bc1b285db782f906ae64c729eace4b07c3afc673522627b0f5ea2d4f1f0
Instruction Fuzzy Hash: A751CEB1D10604DBDF15DF68D889BAEB7F5FF49704F20811DE8116B281EB756A48CBA0

Function 003D8550 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,E48E37CD,?,?,00546054), ref: 003D858F
CreateDirectoryW.KERNEL32(?,00000000,?,00546054), ref: 003D85F0

Strings

ADVINST_LOGS, xrefs: 003D85C8

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CreateDirectoryPathTemp
String ID: ADVINST_LOGS
API String ID: 2885754953-2492584244
Opcode ID: cf6681609e04f68bad7634826f503b061211210953c57df780a2f2cc53c03aaf
Instruction ID: 08f0a7aa267f8080b1440d4953de51da1f34625d992f08361b2e52cf1bf192cc
Opcode Fuzzy Hash: cf6681609e04f68bad7634826f503b061211210953c57df780a2f2cc53c03aaf
Instruction Fuzzy Hash: FB51E376900219CBCB219F28D844BB6B3B4FF14724F2546AFE94997390EF74AD81CB90

Function 002B7110 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,?,00000002,004C337C,00000000,00000000,80000001,00000001,00000000,AppEvents\Schemes\Apps\Explorer\Navigating\.Current,00000033,E48E37CD), ref: 002B7280

Part of subcall function 0038DDA0: GetModuleHandleW.KERNEL32(Advapi32.dll,E48E37CD,?,?,?,00000000,?,Function_001BDD00,000000FF), ref: 0038DDE3

CloseHandle.KERNEL32(?,E48E37CD), ref: 002B72B9

Strings

AppEvents\Schemes\Apps\Explorer\Navigating\.Current, xrefs: 002B7178

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CloseHandle$Module
String ID: AppEvents\Schemes\Apps\Explorer\Navigating\.Current
API String ID: 1412095732-2431777889
Opcode ID: 1f6645c20ee49ad2098a1875662167d5b77d2fb0187f131c601b31c8e6903b7c
Instruction ID: 8cc8530f25ab10233cb40f7295228604337dc5e7b6372ab1200a40a592f18e05
Opcode Fuzzy Hash: 1f6645c20ee49ad2098a1875662167d5b77d2fb0187f131c601b31c8e6903b7c
Instruction Fuzzy Hash: 0D514770D14248DBDB20DFA4CD59BDEBBB4AF14304F108199E445B7281DBB46A48CFA5

Function 00452981 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0044DBDD: RtlFreeHeap.NTDLL(00000000,00000000,?,0045221D,?,00000000,?,?,004524BE,?,00000007,?,?,00452B18,?,?), ref: 0044DBF3
Part of subcall function 0044DBDD: GetLastError.KERNEL32(?,?,0045221D,?,00000000,?,?,004524BE,?,00000007,?,?,00452B18,?,?), ref: 0044DBFE

___free_lconv_mon.LIBCMT ref: 004529C5

Strings

pS, xrefs: 00452997
XS, xrefs: 00452A6D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ErrorFreeHeapLast___free_lconv_mon
String ID: XS$pS
API String ID: 4068849827-569932662
Opcode ID: 61abd49d96065fd1667bf9e2e057668717230982f0dc05b8255683136d3247a6
Instruction ID: 7c8133f0ea26293141766542d6fcd144055b285f78e83da7cdbbe6d366c4c699
Opcode Fuzzy Hash: 61abd49d96065fd1667bf9e2e057668717230982f0dc05b8255683136d3247a6
Instruction Fuzzy Hash: E0317F31A003459FEB30AA3AD905F5777E5EF01315F11482FE895D7252DBB8BC448A18

Function 002F8A90 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 104sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0000000A), ref: 002F8B02
DestroyWindow.USER32(?), ref: 002F8B17

Strings

(0C, xrefs: 002F8B0E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DestroySleepWindow
String ID: (0C
API String ID: 3305115879-4186761363
Opcode ID: cc5af74faadcaee13600348827c267ed86438c5331a97f0584fb83065853cf83
Instruction ID: a6dcbbc56d873c5d2c65ccd39efd6f1292b7f8b0e78949542fd302bf55b07b23
Opcode Fuzzy Hash: cc5af74faadcaee13600348827c267ed86438c5331a97f0584fb83065853cf83
Instruction Fuzzy Hash: EE418130A50348EFCB11DF68DC45BEDBBB5AF09740F1440A9E909AB292CB745E04DBA1

Function 0045277F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,E8458D00), ref: 0045284F
__freea.LIBCMT ref: 0045285E

Part of subcall function 0044DC17: RtlAllocateHeap.NTDLL(00000000,00000000,0044D0E1,?,0044EE85,?,00000000,?,0043F625,00000000,0044D0E1,?,?,?,?,0044CEDB), ref: 0044DC49

Strings

`&+, xrefs: 00452781

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: AllocateHeapStringType__freea
String ID: `&+
API String ID: 4073780324-3639896150
Opcode ID: 5a52d66ab29f983f671ba40245352746cc87ab2d2ded0933e19252d6a24dbe08
Instruction ID: 8c1a90fd66e90fe9d51338e83850f6f567f061405b3f3b572fa639ec0173d275
Opcode Fuzzy Hash: 5a52d66ab29f983f671ba40245352746cc87ab2d2ded0933e19252d6a24dbe08
Instruction Fuzzy Hash: C531E171A0020AABCF20AFA5CC45EAF7BA5EF46711F04422BFC04A7252D778CC55C794

Function 003A73D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(000013FF,00000000,?,00000000,00000000,00000000,00000000,E48E37CD,004D9754), ref: 003A7428
LocalFree.KERNEL32(00000000,00000000,-00000002), ref: 003A7524

Part of subcall function 00399AC0: std::locale::_Init.LIBCPMT ref: 00399B9D

Part of subcall function 003972B0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00397385

Strings

Failed to get Windows error message [win32 error 0x, xrefs: 003A7446

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: FormatFreeInitIos_base_dtorLocalMessagestd::ios_base::_std::locale::_
String ID: Failed to get Windows error message [win32 error 0x
API String ID: 1983821583-3373098694
Opcode ID: 0efd0d20b30ebc20ad619e518589258679fa735843713d5f3591b730d267aa43
Instruction ID: b44742c02ca93191cba31a701e5d07770d6cc32e4da7460a9828f125c54df2fc
Opcode Fuzzy Hash: 0efd0d20b30ebc20ad619e518589258679fa735843713d5f3591b730d267aa43
Instruction Fuzzy Hash: 43418070A043099BDB11DF68CD59BAFBBF8FF05704F104669E455EB290D7B89A08CB91

Function 00315190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545CC8,Windows.UI.Xaml.Documents.Hyperlink,00000023,E48E37CD,00000004,000000FF,?,00545CC4,00466017,000000FF), ref: 00315268

Strings

Windows.UI.Xaml.Documents.Hyperlink, xrefs: 003151BA
PT1, xrefs: 00315270, 00315278

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: PT1$Windows.UI.Xaml.Documents.Hyperlink
API String ID: 4129690577-488487626
Opcode ID: 2195f3d690044b366d0d9550078324155aa2b84e61f2c57745891c3a73a0670a
Instruction ID: 3e41e74d78ebc539be8b0553f48e14b7eb751cf50a75f235fbd888bf995b4427
Opcode Fuzzy Hash: 2195f3d690044b366d0d9550078324155aa2b84e61f2c57745891c3a73a0670a
Instruction Fuzzy Hash: 03317771900619DBDB05CF98C986BEEBBB4FB54718F10442AE800AB381EBB45E49CBD1

Function 003F2050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

OpenEventW.KERNEL32(00000000,00000000,00000001,_pbl_evt,00000008,?,?,004DA350,00000001,E48E37CD,00000000), ref: 003F20FE
CreateEventW.KERNEL32(00000000,00000001,00000001,?), ref: 003F211B

Strings

_pbl_evt, xrefs: 003F20D2

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Event$CreateOpen
String ID: _pbl_evt
API String ID: 2335040897-4023232351
Opcode ID: 91222f0b724ae2618a7b94e13cfb780b2fbd2751ea59165fbbecd0eb803fade7
Instruction ID: d8d039068949a40b1d81e12b5085de7ba65ac9779620b059d5e1d0e31aeeee63
Opcode Fuzzy Hash: 91222f0b724ae2618a7b94e13cfb780b2fbd2751ea59165fbbecd0eb803fade7
Instruction Fuzzy Hash: B8311871D10208EFDB10DFA8CD55BEEB7B4EB15714F108119E911B7280DB746A09CFA5

Function 002AD640 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000002), ref: 002AD6CB
IsWindow.USER32(00000002), ref: 002AD6E2

Strings

H?L, xrefs: 002AD681

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window
String ID: H?L
API String ID: 2353593579-2793153261
Opcode ID: 6a9e0501638adbc858b164404b05620800661546854e9c8ea1bf455eee3d2b6c
Instruction ID: 57bcf4b88b1dcb53b2e3b4c95d6f25cbda40e7fff65cff50725eea5334ba5f06
Opcode Fuzzy Hash: 6a9e0501638adbc858b164404b05620800661546854e9c8ea1bf455eee3d2b6c
Instruction Fuzzy Hash: C72168346107059FCB28DF65D895F6BB7F9FF09B10F048A2DE46A87AA0CB35A914CB50

Function 00396870 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0039689B
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 003968FE

Strings

bad locale name, xrefs: 00396921

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 3988782225-1405518554
Opcode ID: 19bb1b77dc3aa81c4df6047e96261b1d4fe960ad05010f44dd6cf5c7d51b0157
Instruction ID: 47a12a30b167d0ba21c635e42d094d45d4534be139f8d4a4b37e7ae10793b203
Opcode Fuzzy Hash: 19bb1b77dc3aa81c4df6047e96261b1d4fe960ad05010f44dd6cf5c7d51b0157
Instruction Fuzzy Hash: EC210270605784DFDB20CF69C80575ABFF4AF15304F14869EE08587781D7B9AA04CB95

Function 003480F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 0034813A
DestroyWindow.USER32(00000000,?,?,?), ref: 00348147

Strings

{L, xrefs: 003481BB

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Destroy
String ID: {L
API String ID: 3707531092-1469069594
Opcode ID: f6f1068f8e7cfa43598785a2ba304b5fa0952c9bf70781ff8ea41df34db836b7
Instruction ID: 2716c141c286dab2805b3360630d5c9219b489b61f8a3769599323abdecdd806
Opcode Fuzzy Hash: f6f1068f8e7cfa43598785a2ba304b5fa0952c9bf70781ff8ea41df34db836b7
Instruction Fuzzy Hash: B331CB30804788EFCB00DF68C90479EFBF0BF11314F10829AE45497AD2CBB4AA18CB95

Function 002A9190 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00435A3D: EnterCriticalSection.KERNEL32(00544C5C,00000001,?,?,002A91C7,00000000,E48E37CD,00000001,?,?,?,-00000010,0045DD00,000000FF,?,002A93A0), ref: 00435A48
Part of subcall function 00435A3D: LeaveCriticalSection.KERNEL32(00544C5C,?,002A91C7,00000000,E48E37CD,00000001,?,?,?,-00000010,0045DD00,000000FF,?,002A93A0,?,00000001), ref: 00435A74

FindResourceExW.KERNEL32(00000000,00000006,?,00000000,00000000,E48E37CD,00000001,?,?,?,-00000010,0045DD00,000000FF,?,002A93A0,?), ref: 002A91E6

Part of subcall function 002A9250: LoadResource.KERNEL32(00000000,00000000,E48E37CD,00000001,00000000,?,00000000,0045D610,000000FF,?,002A91FC,?,?,?,-00000010,0045DD00), ref: 002A927B
Part of subcall function 002A9250: LockResource.KERNEL32(00000000,?,002A91FC,?,?,?,-00000010,0045DD00,000000FF,?,002A93A0,?,00000001,?,002B69F0,-00000010), ref: 002A9286
Part of subcall function 002A9250: SizeofResource.KERNEL32(00000000,00000000,?,002A91FC,?,?,?,-00000010,0045DD00,000000FF,?,002A93A0,?,00000001,?,002B69F0), ref: 002A9294

Strings

HLT, xrefs: 002A91BD
HLT, xrefs: 002A9204

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Resource$CriticalSection$EnterFindLeaveLoadLockSizeof
String ID: HLT$HLT
API String ID: 529824247-1049769609
Opcode ID: 4770d01078323c04acf472a3882ad7079e9633d0f92eab44646c5aad5a1c2efb
Instruction ID: b80dfb7cb3cf5980236ba4879ec285c59686b5b7a17fb5eb519f32b7a0de9b69
Opcode Fuzzy Hash: 4770d01078323c04acf472a3882ad7079e9633d0f92eab44646c5aad5a1c2efb
Instruction Fuzzy Hash: 67113A36F446146BD3248F5AAC82B7AF3E8E789B64F00027EEC09D3380EF359C008690

Function 004B66F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(?,?,?,?,?,?,E48E37CD,?,?,?,?,?,0045E74D,000000FF), ref: 004B673C

Strings

8bT, xrefs: 004B6759
,bT, xrefs: 004B674B

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: DirectoryRemove
String ID: ,bT$8bT
API String ID: 597925465-591092549
Opcode ID: 046d078f0c481c87f5cf7a66e368f8e100d6f6322cfef4c02bb7faec1dfaeaad
Instruction ID: 094d6dfc5502c31f85d3d6474dbb365073fe49a5c4e3fe57cf596d67152e2b32
Opcode Fuzzy Hash: 046d078f0c481c87f5cf7a66e368f8e100d6f6322cfef4c02bb7faec1dfaeaad
Instruction Fuzzy Hash: 3311C279904604EFCB10DF58DC41B9AF7B9FB0A724F10436AE464A7390DB796D04CBA4

Function 002C1200 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetParent.USER32(00000005), ref: 002C1274

Strings

d, xrefs: 002C1240
C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 002C1249

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3357045315
Opcode ID: 360726e7335e910e1bef1c73d1727830bec018f92044d46bf28d6f183253932f
Instruction ID: a53017b3eb273668b04e53fcf9d4783ca1c0e5ab2e216c54094aed277ed14ac5
Opcode Fuzzy Hash: 360726e7335e910e1bef1c73d1727830bec018f92044d46bf28d6f183253932f
Instruction Fuzzy Hash: 5F210474D15298EFDF00DFE4D958B8DBBB1BF15308F148098E405AB295CBB95A08CB81

Function 002AD329 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 002AD39A

Strings

C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 002AD375
d, xrefs: 002AD369

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 235941f399c0e145c0862068abfd010eb6f35e383133df0b0c3e3c046c5b9d9f
Instruction ID: 6388dbc9c17e385239fb50e1998b462e89a06874b0e70d93053f798ab2e58aaa
Opcode Fuzzy Hash: 235941f399c0e145c0862068abfd010eb6f35e383133df0b0c3e3c046c5b9d9f
Instruction Fuzzy Hash: 3B210274D15298EFDF01DFE4D898B8DBBB1BF15308F108099D001AB295DBB85A08CF81

Function 002ACF5D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 002ACFCB

Strings

C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 002ACFA6
d, xrefs: 002ACF9D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 10f0e7e29a6fe0a339b12fa4ab55b55028606bfc45102a1af488159515cd469c
Instruction ID: 4d53c99d7c627480a4b1c2cfcdf7028caee51bbee34f004469c64a1e4047e820
Opcode Fuzzy Hash: 10f0e7e29a6fe0a339b12fa4ab55b55028606bfc45102a1af488159515cd469c
Instruction Fuzzy Hash: BA211E78D15298EFDF01DFE0D898B9DBBB1BF15308F108099E001AB291DBB85A08CF95

Function 002C12CA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON

Download Yara Rule

APIs

GetParent.USER32(0000000D), ref: 002C133B

Strings

d, xrefs: 002C1305
C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 002C130E

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$d
API String ID: 975332729-3357045315
Opcode ID: a18f8f55b4df2a1b9c97f3295904db879a42aff67ec7273ead39778f1283a87a
Instruction ID: 809ab7bd81bf41dcda8ad31d00c081d39cbcbf2561789955d10540485ab42ee4
Opcode Fuzzy Hash: a18f8f55b4df2a1b9c97f3295904db879a42aff67ec7273ead39778f1283a87a
Instruction Fuzzy Hash: 40210F78D10288EFDF00DFE4D898B9DBBB1BF15308F108099E001AB296DBB95A08DB41

Function 002AD3F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 002AD460

Strings

C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 002AD439
d, xrefs: 002AD42D

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: 9a6f0525d62296496f12bebc9e1e5e161da4f3b5822b332ecb1e94b66bda8d8f
Instruction ID: 942ece7afa1c3a92467610e3c899eb7ff233d25147abb6d3408f700e72ece648
Opcode Fuzzy Hash: 9a6f0525d62296496f12bebc9e1e5e161da4f3b5822b332ecb1e94b66bda8d8f
Instruction Fuzzy Hash: 18213338D10288EBDF05DFE0D998BCDBBB1BF15308F208059E001AB295DBB85A08CF41

Function 002AD021 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 002AD08C

Strings

d, xrefs: 002AD05C
C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 002AD065

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$d
API String ID: 2558294473-4096264744
Opcode ID: ef9818f807cb6eb6d8be3961ed0bedfe12799106f3912589c44adb0620c4668c
Instruction ID: 2f73d14fd72fc4d38743a6abfeeadba8496ec3aa01274cc800b4f84a08238fc7
Opcode Fuzzy Hash: ef9818f807cb6eb6d8be3961ed0bedfe12799106f3912589c44adb0620c4668c
Instruction Fuzzy Hash: FC212F78D14288EBDF05DFE0D898BCDBBB1AF15308F108099E001AB281DBB90A08CF55

Function 003012B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0030130F
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,002FFDEC,00000000,E48E37CD,?,?), ref: 00301328

Strings

tooltips_class32, xrefs: 00301306

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Window$Create
String ID: tooltips_class32
API String ID: 870168347-1918224756
Opcode ID: 17e20d9bad03d2b88c6d4229bd4e40a506bd7b9af447cb30aef46eb381638ca0
Instruction ID: a69c00d920786af9cb64e6df892ba0833f0feae3278a5ebc97bc40949877942c
Opcode Fuzzy Hash: 17e20d9bad03d2b88c6d4229bd4e40a506bd7b9af447cb30aef46eb381638ca0
Instruction Fuzzy Hash: F701F0313C12127AF7248664DC5AFE23298D751B44F348329BB00FA0D0D6A6EA14DA08

Function 002C1391 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetParent.USER32(00000013), ref: 002C13C4

Strings

C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h, xrefs: 002C13A9
Unknown exception, xrefs: 002C1399

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: Parent
String ID: C:\JobRelease\stubs\setup\controls\generic\VisualStyleBorder.h$Unknown exception
API String ID: 975332729-2259502730
Opcode ID: bec26caa9affc059701b7320d97007d424009fdc1c92ae730792c118b7b9d86c
Instruction ID: 0841877117a7f16a5c07e3ebcd668a8a8be9347bde5ded7351d6d60868b48a11
Opcode Fuzzy Hash: bec26caa9affc059701b7320d97007d424009fdc1c92ae730792c118b7b9d86c
Instruction Fuzzy Hash: 6A012134D15248EFCF05DBE4C915BDDBBB1AF55304F548098D0016B396DBB95E08DB91

Function 002AD4B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 002AD4E8

Strings

C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 002AD4D3
Unknown exception, xrefs: 002AD4C0

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-452454139
Opcode ID: 7e0d5acedb825b21b29781f5107344404961c92b502a03135b8f8d15ad787a3f
Instruction ID: 2f796995f4701627db30d0272921472bfb15e55557fc766870d1a005bbf3bedf
Opcode Fuzzy Hash: 7e0d5acedb825b21b29781f5107344404961c92b502a03135b8f8d15ad787a3f
Instruction Fuzzy Hash: 44016D34D05288EBCF05EBE4CD15BDDBBB16F56304F248198D0016B386DBB45A08DB92

Function 002AD0E2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 002AD10F

Strings

C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp, xrefs: 002AD0FA
Unknown exception, xrefs: 002AD0EA

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: ActiveWindow
String ID: C:\JobRelease\platform\ui\controls\mshtml\GenericAxControl.cpp$Unknown exception
API String ID: 2558294473-452454139
Opcode ID: 3c06a7ab13c42ffe2cb13ab86f80829a6f36dd641d896c3885165a63fbe29871
Instruction ID: e3522309e1cbd6e03f1edb07522428ee13ee135225cfbd87ab42d977d1aa163b
Opcode Fuzzy Hash: 3c06a7ab13c42ffe2cb13ab86f80829a6f36dd641d896c3885165a63fbe29871
Instruction Fuzzy Hash: 76018034D15288EBCF05DBE4C9147DDBBB16F56304F148099D0016B386DBB45B08DB92

Function 0030BE85 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

InterlockedPushEntrySList.KERNEL32(00545968,00545C48), ref: 0030BEB6

Strings

@\T, xrefs: 0030BE97
D\T, xrefs: 0030BE85

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: EntryInterlockedListPush
String ID: @\T$D\T
API String ID: 4129690577-1299419456
Opcode ID: 8af4067acd202c45857628af924fa32533fa503ba2a378c9afc484980cec56ff
Instruction ID: dff8c44b2174a6e44f9dd0ea7b50e8bc25fe660ce9b38d1922f8b2be186ea0e6
Opcode Fuzzy Hash: 8af4067acd202c45857628af924fa32533fa503ba2a378c9afc484980cec56ff
Instruction Fuzzy Hash: F1018F31A01709DBCB06CFA4D981BEEFBB0FB56319F10445AD8056B382EB715A05EBC0

Function 00452DAC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMONLIBRARYCODE

Download Yara Rule

APIs

GetOEMCP.KERNEL32(00000000,?,?,?,00000104), ref: 00452DD7
GetACP.KERNEL32(00000000,?,?,?,00000104), ref: 00452DEE

Strings

`&+, xrefs: 00452DAE

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID:
String ID: `&+
API String ID: 0-3639896150
Opcode ID: db4eaf6639b0eebf6df3ef297d8ad16896119d69160f80b7682fb657232110e4
Instruction ID: 3df5194eb33503c3140cddf9700c79a655212287101b407eb01e4bd586bbcddf
Opcode Fuzzy Hash: db4eaf6639b0eebf6df3ef297d8ad16896119d69160f80b7682fb657232110e4
Instruction Fuzzy Hash: 16F0C830400904CFDB14EB58D9497AA77B0B71233EFA4035AE825861E3DBB54C4DC789

Function 0043598C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 002B3650: InitializeCriticalSectionAndSpinCount.KERNEL32(00544C5C,00000000,E48E37CD,002A0000,Function_001BD840,000000FF,?,004359BB,?,?,?,002A6438), ref: 002B3675
Part of subcall function 002B3650: GetLastError.KERNEL32(?,004359BB,?,?,?,002A6438), ref: 002B367F

IsDebuggerPresent.KERNEL32(?,?,?,002A6438), ref: 004359BF
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,002A6438), ref: 004359CE

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004359C9

Memory Dump Source

Source File: 00000005.00000002.1405822629.00000000002A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 002A0000, based on PE: true

Associated: 00000005.00000002.1405789535.00000000002A0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1405990433.00000000004B8000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406048502.000000000053E000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406071003.0000000000543000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406095340.0000000000544000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000547000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1406159021.0000000000566000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_2a0000_2c6HNWVywp.jbxd

Similarity

API ID: CountCriticalDebugDebuggerErrorInitializeLastOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 450123788-631824599
Opcode ID: 432d15e8538785d6fa9a776d11546437bd92312c5e992a6a18985925e39215f2
Instruction ID: dfd6b9c8e85e5c7bf63782afd32d1d0f849adf59d3915a57008b722ff12b0b39
Opcode Fuzzy Hash: 432d15e8538785d6fa9a776d11546437bd92312c5e992a6a18985925e39215f2
Instruction Fuzzy Hash: 5CE092B0201B10CFC3609F35E444782BBE8AF09718F118D2FE586C6781EBB8E804CBA5

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2c6HNWVywp.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\MSIFB63.tmp

C:\Users\user\AppData\Local\Temp\MSIFC10.tmp

C:\Users\user\AppData\Local\Temp\MSIff69.LOG

C:\Users\user\AppData\Local\Temp\shiFAD5.tmp

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\52455D3\Installer.msi

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\decoder.dll

C:\Users\user\AppData\Roaming\ConsolHQ LTD\ConsoleHQ 1.12.3\install\holder0.aiph

C:\Windows\Installer\50fd66.msi

C:\Windows\Installer\MSIFE6F.tmp

C:\Windows\Installer\MSIFECE.tmp

C:\Windows\Installer\MSIFEFE.tmp

C:\Windows\Installer\MSIFF2E.tmp

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
2c6HNWVywp.exe

Function 003DB350 Relevance: 21.6, APIs: 10, Strings: 2, Instructions: 551
COMMON

Function 003CEAB0 Relevance: 16.6, APIs: 11, Instructions: 117
memoryCOMMON

Function 003C4050 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 160
windowCOMMON

Function 003A2350 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 85
libraryloaderCOMMON

Function 003DA240 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 159
COMMON

Function 003A2BA0 Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 247
registrylibraryloaderCOMMON

Function 003C4960 Relevance: 44.0, APIs: 2, Strings: 23, Instructions: 220
COMMON

Function 003A2F80 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 220
registryCOMMON

Function 003B64D0 Relevance: 19.7, APIs: 8, Strings: 3, Instructions: 495
COMMON

Function 003DF7B0 Relevance: 17.5, APIs: 5, Strings: 5, Instructions: 43
libraryCOMMON

Function 0038DDA0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 96
registrylibraryloaderCOMMON

Function 00435A9F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 58
libraryCOMMON

Function 003C2810 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 224
fileCOMMON

Function 003E0BE0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135
fileCOMMON

Function 003DF2F0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
fileCOMMON