Edit tour

Windows Analysis Report
yDoZVwXSMG.exe

Overview

General Information

Sample name:	yDoZVwXSMG.exe renamed because original name is a hash value
Original sample name:	21922_224871481_da5669cb6c0e24e7679e4cce556acae9d1fabff38df9769fae96837617c38753_au_.exe
Analysis ID:	1559721
MD5:	a82c9640641c01795da7322ed1b2462f
SHA1:	af1c79055759a4c698220a22eff9cef97ac8209e
SHA256:	da5669cb6c0e24e7679e4cce556acae9d1fabff38df9769fae96837617c38753
Infos:

Detection

Score:	4
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Contains functionality for read data from the clipboard

Contains functionality to dynamically determine API calls

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Detected potential crypto function

Drops PE files

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

yDoZVwXSMG.exe (PID: 5032 cmdline: "C:\Users\user\Desktop\yDoZVwXSMG.exe" MD5: A82C9640641C01795DA7322ED1B2462F)

Au_.exe (PID: 3776 cmdline: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\user\Desktop\ MD5: A82C9640641C01795DA7322ED1B2462F)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: yDoZVwXSMG.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00406775 FindFirstFileA,FindClose,	0_2_00406775
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00402A84 FindFirstFileA,	0_2_00402A84
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00405B99 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405B99
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00406775 FindFirstFileA,FindClose,	2_2_00406775
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00405B99 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_00405B99
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00402A84 FindFirstFileA,	2_2_00402A84

Source: Au_.exe, Au_.exe, 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmp, Au_.exe, 00000002.00000000.2190560048.000000000040A000.00000008.00000001.01000000.00000004.sdmp, yDoZVwXSMG.exe, Au_.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: yDoZVwXSMG.exe, Au_.exe.0.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: yDoZVwXSMG.exe, 00000000.00000002.2191564328.00000000028C3000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191258259.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmp, Au_.exe, Au_.exe, 00000002.00000002.3439987828.0000000002828000.00000004.00000020.00020000.00000000.sdmp, Au_.exe, 00000002.00000002.3439724667.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Au_.exe, 00000002.00000002.3440578387.0000000010003000.00000004.00000001.01000000.00000007.sdmp, nsvC710.tmp.0.dr, nsqC8C5.tmp.2.dr	String found in binary or memory: https://www.gegridsolutions.com/multilin/
Source: yDoZVwXSMG.exe, 00000000.00000002.2191564328.00000000028C3000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191258259.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmp, Au_.exe, 00000002.00000002.3439987828.0000000002828000.00000004.00000020.00020000.00000000.sdmp, Au_.exe, 00000002.00000002.3439724667.000000000057E000.00000004.00000020.00020000.00000000.sdmp, nsvC710.tmp.0.dr, nsqC8C5.tmp.2.dr	String found in binary or memory: https://www.gegridsolutions.com/multilin/200Set

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

Code function: 0_2_00405683 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405683

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Code function: 2_2_03A11D4E GetDlgCtrlID,OpenClipboard,GetClipboardData,GlobalLock,lstrlenA,SendMessageA,GlobalUnlock,CloseClipboard,CallWindowProcA,

2_2_03A11D4E

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

Code function: 0_2_004048DE GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_004048DE

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_004036E7 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		0_2_004036E7
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_004036E7 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		2_2_004036E7

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00404E7A	0_2_00404E7A
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00406AB6	0_2_00406AB6
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00404E7A	2_2_00404E7A
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00406AB6	2_2_00406AB6

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: String function: 00406747 appears 58 times
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: String function: 00406747 appears 58 times

Source: yDoZVwXSMG.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: clean4.winEXE@3/11@0/0

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

0_2_004048DE

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

Code function: 0_2_004022F1 CoCreateInstance,MultiByteToWideChar,

0_2_004022F1

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

File created: C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp

Jump to behavior

Source: yDoZVwXSMG.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

File read: C:\Users\user\Desktop\yDoZVwXSMG.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\yDoZVwXSMG.exe "C:\Users\user\Desktop\yDoZVwXSMG.exe"
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Process created: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\user\Desktop\
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Process created: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\user\Desktop\	Jump to behavior

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Section loaded: msls31.dll	Jump to behavior

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

File written: C:\Users\user\AppData\Local\Temp\nslC943.tmp\ioSpecial.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Automated click: OK
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: yDoZVwXSMG.exe

Static file information: File size 2469638 > 1048576

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Code function: 2_2_039F4DB4 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_039F4DB4

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Code function: 2_2_039F3F10 push eax; ret

2_2_039F3F3E

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	File created: C:\Users\user\AppData\Local\Temp\nslC943.tmp\BrandingURL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	File created: C:\Users\user\AppData\Local\Temp\nslC943.tmp\FindProcDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	File created: C:\Users\user\AppData\Local\Temp\nslC943.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	File created: C:\Users\user\AppData\Local\Temp\nslC943.tmp\LogEx.dll	Jump to dropped file
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	File created: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	File created: C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Code function: 2_2_03A11410 wsprintfA,lstrcpyA,GetPrivateProfileStringA,lstrcpyA,CharNextA,

2_2_03A11410

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslC943.tmp\BrandingURL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslC943.tmp\FindProcDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslC943.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslC943.tmp\LogEx.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll	Jump to dropped file

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00406775 FindFirstFileA,FindClose,	0_2_00406775
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00402A84 FindFirstFileA,	0_2_00402A84
Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	Code function: 0_2_00405B99 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_00405B99
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00406775 FindFirstFileA,FindClose,	2_2_00406775
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00405B99 CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	2_2_00405B99
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	Code function: 2_2_00402A84 FindFirstFileA,	2_2_00402A84

Source: Au_.exe, 00000002.00000002.3439724667.000000000057E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe	API call chain: ExitProcess graph end node	graph_0-3581
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	API call chain: ExitProcess graph end node	graph_2-6481
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	API call chain: ExitProcess graph end node	graph_2-6280
Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe	API call chain: ExitProcess graph end node	graph_2-7616

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Code function: 2_2_039F4DB4 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_039F4DB4

Source: C:\Users\user\Desktop\yDoZVwXSMG.exe

Code function: 0_2_004036E7 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

0_2_004036E7

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 Process Injection	1 Process Injection	11 Input Capture	1 Security Software Discovery	Remote Services	11 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	2 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\nslC943.tmp\BrandingURL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslC943.tmp\FindProcDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslC943.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslC943.tmp\LogEx.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://www.gegridsolutions.com/multilin/	0%	Avira URL Cloud	safe
https://www.gegridsolutions.com/multilin/200Set	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.gegridsolutions.com/multilin/200Set	yDoZVwXSMG.exe, 00000000.00000002.2191564328.00000000028C3000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191258259.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmp, Au_.exe, 00000002.00000002.3439987828.0000000002828000.00000004.00000020.00020000.00000000.sdmp, Au_.exe, 00000002.00000002.3439724667.000000000057E000.00000004.00000020.00020000.00000000.sdmp, nsvC710.tmp.0.dr, nsqC8C5.tmp.2.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_Error	Au_.exe, Au_.exe, 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmp, Au_.exe, 00000002.00000000.2190560048.000000000040A000.00000008.00000001.01000000.00000004.sdmp, yDoZVwXSMG.exe, Au_.exe.0.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	yDoZVwXSMG.exe, Au_.exe.0.dr	false		high
https://www.gegridsolutions.com/multilin/	yDoZVwXSMG.exe, 00000000.00000002.2191564328.00000000028C3000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191258259.00000000005DE000.00000004.00000020.00020000.00000000.sdmp, yDoZVwXSMG.exe, 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmp, Au_.exe, Au_.exe, 00000002.00000002.3439987828.0000000002828000.00000004.00000020.00020000.00000000.sdmp, Au_.exe, 00000002.00000002.3439724667.000000000057E000.00000004.00000020.00020000.00000000.sdmp, Au_.exe, 00000002.00000002.3440578387.0000000010003000.00000004.00000001.01000000.00000007.sdmp, nsvC710.tmp.0.dr, nsqC8C5.tmp.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559721
Start date and time:	2024-11-20 21:14:38 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	yDoZVwXSMG.exe renamed because original name is a hash value
Original Sample Name:	21922_224871481_da5669cb6c0e24e7679e4cce556acae9d1fabff38df9769fae96837617c38753_au_.exe
Detection:	CLEAN
Classification:	clean4.winEXE@3/11@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 72 Number of non-executed functions: 108
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: yDoZVwXSMG.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\nslC943.tmp\BrandingURL.dll	Cursor Commander.exe	Get hash	malicious	Unknown	Browse
	Advanced.Installer-15.9.exe	Get hash	malicious	Unknown	Browse
	29#Uff09.exe	Get hash	malicious	Unknown	Browse
	myDHSBbmiQ30XWiQsvEZBgkKPOQqbPoH.exe	Get hash	malicious	Unknown	Browse
	2.3.11.210102.exe	Get hash	malicious	Unknown	Browse
	2.3.11.210102.exe	Get hash	malicious	Unknown	Browse
	TC-9.22a.2019.3.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Temp\nslC943.tmp\FindProcDLL.dll	https://icrealtime.com/downloads/2	Get hash	malicious	Unknown	Browse
	https://viture.com/windows	Get hash	malicious	Unknown	Browse
	https://www.zoominfo.com/pic/kirkham-insurance/354239330	Get hash	malicious	Unknown	Browse
	https://www.zoominfo.com/pic/kirkham-insurance/354239330	Get hash	malicious	Unknown	Browse
	VxJYz09IcU	Get hash	malicious	Unknown	Browse
	ZoomInfoContactContributor.exe	Get hash	malicious	Unknown	Browse
	General_Player_Eng_WIN32_V3.44.0.R.170421.exe	Get hash	malicious	Unknown	Browse
	v17achbl9y.exe	Get hash	malicious	Unknown	Browse
	bG4F5qPoGq.exe	Get hash	malicious	Unknown	Browse
	8Rc1CnrlKH.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nslC943.tmp\BrandingURL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.904876158695173
Encrypted:	false
SSDEEP:	48:qnMpjVitCGEuR+BrUtDQbfwz3Aa3MAAZHMAAJb/Jb9W/Boj:zAwDlUSbIz3Aa33AZH3A5BZW/Boj
MD5:	71C46B663BAA92AD941388D082AF97E7
SHA1:	5A9FCCE065366A526D75CC5DED9AADE7CADD6421
SHA-256:	BB2B9C272B8B66BC1B414675C2ACBA7AFAD03FFF66A63BABEE3EE57ED163D19E
SHA-512:	5965BD3F5369B9A1ED641C479F7B8A14AF27700D0C27D482AA8EB62ACC42F7B702B5947D82F9791B29BCBA4D46E1409244F0A8DDCE4EC75022B5E27F6D671BCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Cursor Commander.exe, Detection: malicious, Browse Filename: Advanced.Installer-15.9.exe, Detection: malicious, Browse Filename: 29#Uff09.exe, Detection: malicious, Browse Filename: myDHSBbmiQ30XWiQsvEZBgkKPOQqbPoH.exe, Detection: malicious, Browse Filename: 2.3.11.210102.exe, Detection: malicious, Browse Filename: 2.3.11.210102.exe, Detection: malicious, Browse Filename: TC-9.22a.2019.3.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............x...x...x...x...x...g...x..)g...x..)g...x..Rich.x..........................PE..L...KThF...........!................Q........ ...............................P......................................."..W...p ..d............................@....................................................... ..p............................text............................... ..`.rdata..G.... ......................@..@.data...P....0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslC943.tmp\FindProcDLL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31744
Entropy (8bit):	5.124320488199201
Encrypted:	false
SSDEEP:	384:1NWlNdqdAnhTKMLE2oIM05fnqCiWg3Yy9kflIinokN:1NWtqdihTKCldkYwkdpnoy
MD5:	83CD62EAB980E3D64C131799608C8371
SHA1:	5B57A6842A154997E31FAB573C5754B358F5DD1C
SHA-256:	A6122E80F1C51DC72770B4F56C7C482F7A9571143FBF83B19C4D141D0CB19294
SHA-512:	91CFBCC125600EC341F5571DCF1E4A814CF7673F82CF42F32155BD54791BBF32619F2BB14AE871D7996E9DDECDFCC5DB40CAA0979D6DFBA3E73CFE8E69C163C9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: , Detection: malicious, Browse Filename: VxJYz09IcU, Detection: malicious, Browse Filename: ZoomInfoContactContributor.exe, Detection: malicious, Browse Filename: General_Player_Eng_WIN32_V3.44.0.R.170421.exe, Detection: malicious, Browse Filename: v17achbl9y.exe, Detection: malicious, Browse Filename: bG4F5qPoGq.exe, Detection: malicious, Browse Filename: 8Rc1CnrlKH.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........QI,.0'..0'..0'../,..0'../-..0'..,)..0'../4..0'..0&..0'......0'.{.#..0'.Rich.0'.........PE..L...Kc.@...........!.....B...<......E........`......................................................................Ph..K...Hd..<....................................................................................`...............................text...nA.......B.................. ..`.rdata.......`.......F..............@..@.data...(*...p...&...P..............@....reloc..n............v..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.54762139570877
Encrypted:	false
SSDEEP:	192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
MD5:	D753362649AECD60FF434ADF171A4E7F
SHA1:	3B752AD064E06E21822C8958AE22E9A6BB8CF3D0
SHA-256:	8F24C6CF0B06D18F3C07E7BFCA4E92AFCE71834663746CFAA9DDF52A25D5C586
SHA-512:	41BF41ADD275867553FA3BD8835CD7E2A2A362A2D5670CCBFAD23700448BAD9FE0F577FB6EE9D4EB81DFC10D463B325B8A873FE5912EB580936D4AD96587AA6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L.p..q.,.q.,.q.,.q.,@q.,.~C,.q.,\R.,.q.,\R/,.q.,.w.,.q.,.Q.,.q.,Rich.q.,........................PE..L...T:.V...........!.........<.......).......0.......................................................................8..p...81.......p..........................@....................................................0..8............................text...@........................... ..`.rdata.......0....... ..............@..@.data... (...@.......*..............@....rsrc........p.......2..............@..@.reloc...............4..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslC943.tmp\LangDLL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.951555564830228
Encrypted:	false
SSDEEP:	48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
MD5:	9384F4007C492D4FA040924F31C00166
SHA1:	ABA37FAEF30D7C445584C688A0B5638F5DB31C7B
SHA-256:	60A964095AF1BE79F6A99B22212FEFE2D16F5A0AFD7E707D14394E4143E3F4F5
SHA-512:	68F158887E24302673227ADFFC688FD3EDABF097D7F5410F983E06C6B9C7344CA1D8A45C7FA05553ADCC5987993DF3A298763477168D4842E554C4EB93B9AAAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....................~..........z.....B....Rich..........PE..L......K...........!......................... ...............................`......................................p"..I...` ..P....@..`....................P....................................................... ..`............................text...l........................... ..`.rdata....... ......................@..@.data...l....0......................@....rsrc...`....@......................@..@.reloc..@....P......................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslC943.tmp\LogEx.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	4.447330642171801
Encrypted:	false
SSDEEP:	768:I+mRGgtvKEeTLD4GKx1oj+aYb7+ZDomgfHx:IbG27eTLcGP+N/0o3fR
MD5:	1C440EC84001C94327082ACA9BDBD0D1
SHA1:	4F35B29E8E1CA44368D15506C28A0873BED1C9F3
SHA-256:	F6D21EF2FA853B922C94D66D3ABD9277AD71BC1BE73A8D8418BC06635925A343
SHA-512:	32A2C9641D1390295249A52FAB38F8BC8379BE80395A9B27B4E157D37B66A1C1F9F49F940CCD24725C59F9DE9A585690292119E11FAEA3E93D4054D9DB00E93A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........Z.H.;...;...;.......;...'...;.......;...$...;...;...;.......;.......;..Rich.;..........................PE..L.....M...........!.....P...`......o........`.......................................................................k..s...8f..<....................................................................................`...............................text...vJ.......P.................. ..`.rdata..#....`.......`..............@..@.data...P1...p...0...p..............@....reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nslC943.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	Generic INItialization configuration [Field 1]
Category:	dropped
Size (bytes):	649
Entropy (8bit):	5.30762609292694
Encrypted:	false
SSDEEP:	12:lOu8VTsAgQRvAVagFhFa4gNhCfYqfPkmN4gND/hI0F4pVTt8oBdU/U:yTdRvAVacho1OwIBN1ZXaqoAs
MD5:	2786600C985A978FC6F62665B5003F8A
SHA1:	865CC9D09231D405335CE490E148EE1A0D056EDB
SHA-256:	AADBBEBA93D8D2C6EDC84C730AF8C09B8340A57C5657CE27912AD1E5A0A1EF46
SHA-512:	58CF08400120577B97A52EE8C77CA3D6FD12C21F933957EA10F6979AF82A519EA455D673848BDCD6A377C94C34E11D415D3EDF47A0DD2888EB34A5BE1D3867D2
Malicious:	false
Preview:	[Settings]..Rect=1044..NumFields=3..RTL=0..NextButtonText=..CancelEnabled=..State=0..[Field 1]..Type=bitmap..Left=0..Right=109..Top=0..Bottom=193..Flags=RESIZETOFIT..Text=C:\Users\user\AppData\Local\Temp\nslC943.tmp\modern-wizard.bmp..HWND=66634..[Field 2]..Type=label..Left=120..Right=315..Top=10..Text=Welcome to the LogicLinx 3.31 Uninstall Wizard..Bottom=38..HWND=66636..[Field 3]..Type=label..Left=120..Right=315..Top=45..Bottom=185..Text=This wizard will guide you through the uninstallation of LogicLinx 3.31.\r\n\r\nBefore starting the uninstallation, make sure LogicLinx 3.31 is not running.\r\n\r\nClick Next to continue...HWND=66638..

C:\Users\user\AppData\Local\Temp\nslC943.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	PC bitmap, Windows 3.x format, 245 x 468 x 24, image size 344448, resolution 3779 x 3779 px/m, cbSize 344502, bits offset 54
Category:	dropped
Size (bytes):	344502
Entropy (8bit):	7.44895003665144
Encrypted:	false
SSDEEP:	6144:VPmsu7BOZ6ML8yJ2H1TsLxRtqKGh+F09QyavhNH7jrsTuGVaaaaaaatCaXoIyoBI:VOsu7qjLvMVTsLxrqKGsa9zavXfUVaat
MD5:	F975665D00EC6F2A8F77A9508C3BF1EF
SHA1:	703F4369F98B031790B993EE776388D1BCECCB96
SHA-256:	CAD1C216716927D66A2C0D33929543358FE809CA7C593A9A14E0E688F698AA10
SHA-512:	182DD6C3487A83688B8FA14AE986549009FAAEF83A70561004263AEDFF2D6FE3750C1817A0F1A8652D01A94C885E4B1436995B95163F4C08B7FF6DDB07385276
Malicious:	false
Preview:	BM.A......6...(....................A....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsqC8C5.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
File Type:	data
Category:	dropped
Size (bytes):	515691
Entropy (8bit):	6.952834018950696
Encrypted:	false
SSDEEP:	12288:HCIzpOsu7qjLvMVTsLxrqKGsa9zavXfUVaaaaaaatCOoIyoBFV7fDpqd:HfzXjLvMVTsLpaskCXcVaaaaaaatCORW
MD5:	3B11E38AA0DDE65ABF4B0096116940AF
SHA1:	5609AA4B53583B1F5F2E98E115797ABB8FA2BCE6
SHA-256:	9F9A2994289AFC94FDB6DA0C0024840D180D40B98D247905A81EC131BCD23BAF
SHA-512:	75759C13DE0BEF6074C0BEC1290D84F706F25B1FD925D861C331062FAF5FBC3A45FDE4E5B003D784355AFFE4C8C1DE4B9D6ACBE384BAE56EDAABF436506D9A6A
Malicious:	false
Preview:	........,.......l...............@]......2..............................................................."...................c...L...................................................................................................................................................................5...C..._...................................................................k.......................\.......................................j.......................\.......................................................................................................................E.......\...............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsvC710.tmp

Download File

Process:	C:\Users\user\Desktop\yDoZVwXSMG.exe
File Type:	data
Category:	dropped
Size (bytes):	56848
Entropy (8bit):	5.109217127899667
Encrypted:	false
SSDEEP:	384:hwLFHRN6kkDAYxCZUPPhN8d6EJfIL7IoflpZRT28eVY/DEJS9Q6rI9gGUkJVztGP:KxN6FAfRJALdpZRVenJS91Q77S6qnYg
MD5:	60127AB791B30C30BBABBDAFD5396C99
SHA1:	0F7A08F5ACB059A98940E30617B4B4525D3C65E2
SHA-256:	0CF35BACFE6E3F387FF34B156C6CDE409DC97CB458193E40115D8AA3AF9891FC
SHA-512:	EB778FD5A80E8C9A645E476CC7777C27A833CDB7185C94C3DB5CBCE6372DA07661FD8CE6630FA79E69FEDD4F1844E794383FA6532FBD9E2D99A4C34A94EBA252
Malicious:	false
Preview:	........,.......l...............@]......2..............................................................."...................c...L...................................................................................................................................................................5...C..._...................................................................k.......................\.......................................j.......................\.......................................................................................................................E.......\...............................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

Download File

Process:	C:\Users\user\Desktop\yDoZVwXSMG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	2469638
Entropy (8bit):	7.980575297576846
Encrypted:	false
SSDEEP:	49152:ML1blinQ7Xi5JZtKg8+MI1PQoabl4WxLLfmfO7d5GsoAWn0FwdTf:ML1oAXirZm3b1hFW0i
MD5:	A82C9640641C01795DA7322ED1B2462F
SHA1:	AF1C79055759A4C698220A22EFF9CEF97AC8209E
SHA-256:	DA5669CB6C0E24E7679E4CCE556ACAE9D1FABFF38DF9769FAE96837617C38753
SHA-512:	5579B91F9A4C714733B3082B17604D8E888434A04750D6716866ACC441662EE5CC01E99DF73D9A1D9901075F36E078467D0874A23BDCB943282D516E9B6E6246
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9(..XF..XF..XF.W...XF..XG.rXF.W...XF.{v..XF..^@..XF.Rich.XF.........................PE..L....:.V.................d...........6............@..........................0.............................................. ........`...............................................................................................................text....c.......d.................. ..`.rdata...............h..............@..@.data................z..............@....ndata.......p...........................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\yDoZVwXSMG.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.980575297576846
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	yDoZVwXSMG.exe
File size:	2'469'638 bytes
MD5:	a82c9640641c01795da7322ed1b2462f
SHA1:	af1c79055759a4c698220a22eff9cef97ac8209e
SHA256:	da5669cb6c0e24e7679e4cce556acae9d1fabff38df9769fae96837617c38753
SHA512:	5579b91f9a4c714733b3082b17604d8e888434a04750d6716866acc441662ee5cc01e99df73d9a1d9901075f36e078467d0874a23bdcb943282d516e9b6e6246
SSDEEP:	49152:ML1blinQ7Xi5JZtKg8+MI1PQoabl4WxLLfmfO7d5GsoAWn0FwdTf:ML1oAXirZm3b1hFW0i
TLSH:	53B52346E3109B64CD1406794DB39CFE6D6FB0B29A61041FA68D3FB6CB62E1D487C34A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9(..XF..XF..XF.W...XF..XG.rXF.W...XF..{v..XF..^@..XF.Rich.XF.........................PE..L....:.V.................d.........

File Icon


Icon Hash:	aa9cbcccccc1c4b0

Static PE Info

General

Entrypoint:	0x4036e7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x56FF3AC3 [Sat Apr 2 03:21:39 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	16cdca0a54bf8076dc7e57fab55dbc5b

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+20h], ebx
mov dword ptr [esp+14h], 0040A7B0h
mov dword ptr [esp+1Ch], ebx
mov byte ptr [esp+18h], 00000020h
call dword ptr [004080B8h]
call dword ptr [004080B4h]
cmp ax, 00000006h
je 00007F9ED0D75993h
push ebx
call 00007F9ED0D78A6Ah
cmp eax, ebx
je 00007F9ED0D75989h
push 00000C00h
call eax
mov esi, 00408288h
push esi
call 00007F9ED0D789E6h
push esi
call dword ptr [004080B0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F9ED0D7596Dh
push 0000000Dh
call 00007F9ED0D78A3Eh
push 0000000Bh
call 00007F9ED0D78A37h
mov dword ptr [00426404h], eax
call dword ptr [00408034h]
push ebx
call dword ptr [00408278h]
mov dword ptr [004264B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 00420D98h
call dword ptr [0040815Ch]
push 0040A840h
push 00425C00h
call 00007F9ED0D784BDh
call dword ptr [004080ACh]
mov ebp, 0042C000h
push eax
push ebp
call 00007F9ED0D784ABh
push ebx
call dword ptr [00408148h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8420	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x1cb98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x288	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x63cd	0x6400	84473a4e5c03ea7b88acbd207137a3ed	False	0.668359375	data	6.455100510182752	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x11e2	0x1200	22a909d39528ffc909762b2fdbab6457	False	0.466796875	data	5.309380799178768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x1c4f8	0xe00	89faa5fd30ca437f0aae195560c38849	False	0.41824776785714285	data	4.963237061637593	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x27000	0xf000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x1cb98	0x1cc00	bd7fce5ba12105a97791533354aba8d1	False	0.19535495923913043	data	6.246001857169698	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x36910	0x666	Device independent bitmap graphic, 96 x 16 x 8, image size 1538, resolution 2868 x 2868 px/m, 15 important colors	English	United States	0.18192918192918192
RT_ICON	0x36f78	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 67584	English	United States	0.1308411214953271
RT_ICON	0x477a0	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.2702527161076996
RT_ICON	0x4b9c8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3780082987551867
RT_ICON	0x4df70	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.36843339587242024
RT_ICON	0x4f018	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.43073770491803276
RT_ICON	0x4f9a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.4308510638297872
RT_DIALOG	0x4fe08	0x120	data	English	United States	0.5138888888888888
RT_DIALOG	0x4ff28	0x158	data	English	United States	0.5290697674418605
RT_DIALOG	0x50080	0x202	data	English	United States	0.4085603112840467
RT_DIALOG	0x50288	0xf8	data	English	United States	0.6290322580645161
RT_DIALOG	0x50380	0xa0	data	English	United States	0.60625
RT_DIALOG	0x50420	0xf4	data	English	United States	0.5450819672131147
RT_DIALOG	0x50518	0xee	data	English	United States	0.6260504201680672
RT_DIALOG	0x50608	0x10c	data	English	United States	0.5111940298507462
RT_DIALOG	0x50718	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x50860	0x1ee	data	English	United States	0.3866396761133603
RT_DIALOG	0x50a50	0xe4	data	English	United States	0.6359649122807017
RT_DIALOG	0x50b38	0x8c	data	English	United States	0.5857142857142857
RT_DIALOG	0x50bc8	0xe0	data	English	United States	0.53125
RT_DIALOG	0x50ca8	0xda	data	English	United States	0.6376146788990825
RT_DIALOG	0x50d88	0x110	data	English	United States	0.5183823529411765
RT_DIALOG	0x50e98	0x148	data	English	United States	0.5274390243902439
RT_DIALOG	0x50fe0	0x1f2	data	English	United States	0.39759036144578314
RT_DIALOG	0x511d8	0xe8	data	English	United States	0.6508620689655172
RT_DIALOG	0x512c0	0x90	data	English	United States	0.6041666666666666
RT_DIALOG	0x51350	0xe4	data	English	United States	0.543859649122807
RT_DIALOG	0x51438	0xde	data	English	United States	0.6486486486486487
RT_DIALOG	0x51518	0x118	data	English	United States	0.5321428571428571
RT_DIALOG	0x51630	0x150	data	English	United States	0.5386904761904762
RT_DIALOG	0x51780	0x1fa	data	English	United States	0.40118577075098816
RT_DIALOG	0x51980	0xf0	data	English	United States	0.6666666666666666
RT_DIALOG	0x51a70	0x98	data	English	United States	0.625
RT_DIALOG	0x51b08	0xec	data	English	United States	0.559322033898305
RT_DIALOG	0x51bf8	0xe6	data	English	United States	0.6565217391304348
RT_DIALOG	0x51ce0	0x10c	data	English	United States	0.5111940298507462
RT_DIALOG	0x51df0	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x51f38	0x1ee	data	English	United States	0.38866396761133604
RT_DIALOG	0x52128	0xe4	data	English	United States	0.6447368421052632
RT_DIALOG	0x52210	0x8c	data	English	United States	0.5928571428571429
RT_DIALOG	0x522a0	0xe0	data	English	United States	0.5357142857142857
RT_DIALOG	0x52380	0xda	data	English	United States	0.6422018348623854
RT_GROUP_ICON	0x52460	0x5a	data	English	United States	0.7888888888888889
RT_VERSION	0x524c0	0x314	data			0.5076142131979695
RT_MANIFEST	0x527d8	0x3be	XML 1.0 document, ASCII text, with very long lines (958), with no line terminators	English	United States	0.5187891440501043

Imports

DLL	Import
KERNEL32.dll	GetShortPathNameA, GetFullPathNameA, MoveFileA, GetLastError, SetCurrentDirectoryA, GetFileAttributesA, SearchPathA, SetFileAttributesA, Sleep, GetTickCount, CreateFileA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetFileTime, CompareFileTime, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, GetTempFileNameA, lstrcatA, GetSystemDirectoryA, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetTempPathA, GetWindowsDirectoryA, GetProcAddress, DeleteFileA, FindFirstFileA, FindNextFileA, FindClose, SetFilePointer, ReadFile, WriteFile, GetPrivateProfileStringA, WritePrivateProfileStringA, MultiByteToWideChar, FreeLibrary, MulDiv, LoadLibraryExA, GetModuleHandleA
USER32.dll	GetWindowRect, EnableMenuItem, GetSystemMenu, ScreenToClient, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetAsyncKeyState, IsDlgButtonChecked, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SystemParametersInfoA, RegisterClassA, EndDialog, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, wvsprintfA, DispatchMessageA, PeekMessageA, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, SetTimer, OpenClipboard, SetWindowTextA, GetDC, LoadImageA, ShowWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, IsWindow, GetDlgItem, SetWindowLongA, SetClipboardData, EmptyClipboard, DestroyWindow, ExitWindowsEx, SetForegroundWindow, PostQuitMessage, CreateDialogParamA
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteValueA, SetFileSecurityA, RegOpenKeyExA, RegDeleteKeyA, RegEnumValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:15:35
Start date:	20/11/2024
Path:	C:\Users\user\Desktop\yDoZVwXSMG.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\yDoZVwXSMG.exe"
Imagebase:	0x400000
File size:	2'469'638 bytes
MD5 hash:	A82C9640641C01795DA7322ED1B2462F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:15:35
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\user\Desktop\
Imagebase:	0x400000
File size:	2'469'638 bytes
MD5 hash:	A82C9640641C01795DA7322ED1B2462F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.8%
Total number of Nodes:	1426
Total number of Limit Nodes:	13

Executed Functions

Function 004036E7 Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 317
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0040370D
GetVersion.KERNEL32 ref: 00403713
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373C
#17.COMCTL32(0000000B,0000000D), ref: 0040375D
OleInitialize.OLE32(00000000), ref: 00403764
SHGetFileInfoA.SHELL32(00420D98,00000000,?,00000160,00000000), ref: 00403780
GetCommandLineA.KERNEL32(00425C00,NSIS Error), ref: 00403795
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\yDoZVwXSMG.exe",00000000), ref: 004037A8
CharNextA.USER32(00000000,"C:\Users\user\Desktop\yDoZVwXSMG.exe",0040A7B0), ref: 004037D3
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,00000020), ref: 0040386A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,000003FB), ref: 0040387F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,\Temp), ref: 0040388B
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp), ref: 004038A2

Part of subcall function 0040680A: GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
Part of subcall function 0040680A: GetProcAddress.KERNEL32(00000000,?), ref: 00406837

ExitProcess.KERNEL32(00000020), ref: 00403925
CoUninitialize.COMBASE(00000020), ref: 0040392A
ExitProcess.KERNEL32 ref: 0040394A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,~nsu,"C:\Users\user\Desktop\yDoZVwXSMG.exe",00000000,00000020), ref: 0040395D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,0040A82C,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,~nsu,"C:\Users\user\Desktop\yDoZVwXSMG.exe",00000000,00000020), ref: 0040396C
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,~nsu,"C:\Users\user\Desktop\yDoZVwXSMG.exe",00000000,00000020), ref: 00403977
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\Desktop), ref: 00403983
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp), ref: 0040399F
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,?,00427000,?), ref: 004039E9
CopyFileA.KERNEL32(C:\Users\user\Desktop\yDoZVwXSMG.exe,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,00000001), ref: 004039FD
CloseHandle.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,00000000), ref: 00403A2A
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403A83
ExitWindowsEx.USER32(00000002,80040002), ref: 00403ADB
ExitProcess.KERNEL32 ref: 00403AFE

Strings

C:\Users\user\Desktop, xrefs: 0040397C, 00403981, 004039AD
~nsu, xrefs: 00403955
SeShutdownPrivilege, xrefs: 00403A95
, xrefs: 00403708
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 0040379B, 004037A1, 004038C2
C:\Users\user\Desktop\yDoZVwXSMG.exe, xrefs: 004039F8
NSIS Error, xrefs: 00403786
NCRC, xrefs: 00403815
_?=, xrefs: 004038CC
Error launching installer, xrefs: 004038DB
", xrefs: 004037F5
C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 0040385F, 00403864, 0040387E, 0040388A, 0040395A, 0040396B, 00403976, 00403982, 0040398F, 0040399E, 00403A3E
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036FC
/D=, xrefs: 0040382D
C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp, xrefs: 0040389D
.tmp, xrefs: 00403971
C:\Users\user\Desktop, xrefs: 00403855, 004038F5, 004039A5, 004039AE
UXTHEME, xrefs: 00403730, 00403735, 0040373B
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe, xrefs: 004039D2, 004039E2, 004039E8, 004039F7, 00403A08, 00403A19, 00403A1F
\Temp, xrefs: 00403885

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: ExitFileProcesslstrcat$Handle$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpilstrlen
String ID: $ /D=$ _?=$"$"C:\Users\user\Desktop\yDoZVwXSMG.exe"$.tmp$C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe$C:\Users\user\Desktop$C:\Users\user\Desktop$C:\Users\user\Desktop\yDoZVwXSMG.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$NCRC$NSIS Error$SeShutdownPrivilege$UXTHEME$\Temp$~nsu
API String ID: 1031542678-3182271799
Opcode ID: 31acf3797f5d253463644cb35ef2ae3e27a5e41f0dfd86ad2bdc06d43a08916d
Instruction ID: 5ceea3819846a486be4215ca695653b375cf8776205228b8cf71ce6426392153
Opcode Fuzzy Hash: 31acf3797f5d253463644cb35ef2ae3e27a5e41f0dfd86ad2bdc06d43a08916d
Instruction Fuzzy Hash: 69B1B271604340ABD7207F619D4AB2B7EACAF4170AF05447FF182B61D2CB7C89458B6E

Function 00406AB6 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c0cb152ca077a17e7f7cfd6049439835df5b56467184ace3d81a746cc5e8b0
Instruction ID: 2a9aa8917219c7ba8d85c1882f41a63cf1be2f3d7e8fd7c71b64c591a4991728
Opcode Fuzzy Hash: f8c0cb152ca077a17e7f7cfd6049439835df5b56467184ace3d81a746cc5e8b0
Instruction Fuzzy Hash: D5F16771D04229CBDF28CFA8C8946ADBBB0FF44305F15816ED856BB281D7386A86DF45

Function 0040601B Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040680A: GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
Part of subcall function 0040680A: GetProcAddress.KERNEL32(00000000,?), ref: 00406837

MoveFileExA.KERNEL32(00000000,?,00000005,00000002,?,00000000,?,?,00405DAA,?,00000000,000000F1,?), ref: 00406035
CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,00405DAA,?,00000000,000000F1,?), ref: 00406068
GetShortPathNameA.KERNEL32(?,00423F68,00000400), ref: 00406071
GetShortPathNameA.KERNEL32(00000000,004239E0,00000400), ref: 0040608E
wsprintfA.USER32 ref: 004060AC
GetFileSize.KERNEL32(00000000,00000000,004239E0,C0000000,00000004,004239E0,?,?,?,00000000,000000F1,?), ref: 004060E7
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004060F6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040610C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,004235E0,00000000,-0000000A,0040ABD4,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00406152
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00406164
GlobalFree.KERNEL32(00000000), ref: 0040616B
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00406172

Part of subcall function 00405F19: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F20
Part of subcall function 00405F19: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F50

Strings

9B, xrefs: 00406083
%s=%s, xrefs: 004060A2
h?B, xrefs: 00406056
[Rename], xrefs: 0040611C, 0040612E

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModuleMovePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]$h?B$9B
API String ID: 1872253872-2390523675
Opcode ID: 21917f923af837da55185abc71840ce9c4339cf9359ea08ee4b8cb6fcd80affc
Instruction ID: 6fab4b1a5264387afcbcbc9c20e197d89b1de9b9f4b2b97f427ae02aeeda734e
Opcode Fuzzy Hash: 21917f923af837da55185abc71840ce9c4339cf9359ea08ee4b8cb6fcd80affc
Instruction Fuzzy Hash: 884115712007167BD7206B619E49F6B3A7CDF85755F06003AF946FA2C2EA3CD824C6AD

Function 00403120 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403134
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\yDoZVwXSMG.exe,00000400), ref: 00403150

Part of subcall function 00405FA4: GetFileAttributesA.KERNELBASE(00000003,00403163,C:\Users\user\Desktop\yDoZVwXSMG.exe,80000000,00000003), ref: 00405FA8
Part of subcall function 00405FA4: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405FCA

GetFileSize.KERNEL32(00000000,00000000,0042E000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\yDoZVwXSMG.exe,C:\Users\user\Desktop\yDoZVwXSMG.exe,80000000,00000003), ref: 00403199
GlobalAlloc.KERNELBASE(00000040,?), ref: 004032E0

Strings

Null, xrefs: 00403219
C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 0040312D, 004032F8
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403329
C:\Users\user\Desktop, xrefs: 0040317B, 00403180, 00403186
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403377
soft, xrefs: 00403210
Inst, xrefs: 00403207
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 00403120
C:\Users\user\Desktop\yDoZVwXSMG.exe, xrefs: 0040313A, 00403149, 0040315D, 0040317A
Error launching installer, xrefs: 00403170

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\yDoZVwXSMG.exe"$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$C:\Users\user\Desktop$C:\Users\user\Desktop\yDoZVwXSMG.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2841956730
Opcode ID: 4cf895d843c1e51e5214ca8c183206d7589522ef64cf37b5abe811079b5ea464
Instruction ID: 96d146e497d990707c57d5b2e40503737fdf144c81fc00ef777e1dfa3ff37f12
Opcode Fuzzy Hash: 4cf895d843c1e51e5214ca8c183206d7589522ef64cf37b5abe811079b5ea464
Instruction Fuzzy Hash: 4661F671A00214ABDB20AF64DD85BAE7FACAB04316F61447FF940B72D1CB3C9A418B5D

Function 0040679C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004067B3
wsprintfA.USER32 ref: 004067EC
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406800

Strings

%s%s.dll, xrefs: 004067E6
\, xrefs: 004067C4
UXTHEME, xrefs: 004067A5

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 47418d738528084b0ee49106b6891bde69050c906b93663faea48a45202ea939
Instruction ID: 1df609921a5ab3350e05677d7081392002f03ef46e330c3fe87cf6dcec657825
Opcode Fuzzy Hash: 47418d738528084b0ee49106b6891bde69050c906b93663faea48a45202ea939
Instruction Fuzzy Hash: 9EF0F6305002196BEB159B64DD0DFEB376CEB08309F14047FA686F21C1EA78D9398B59

Function 00405FD3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405FE6
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00406000

Strings

C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00405FD6, 00405FDA
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 00405FD3
nsa, xrefs: 00405FDF

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\yDoZVwXSMG.exe"$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$nsa
API String ID: 1716503409-1848092218
Opcode ID: 1ccc6076cc6f692e90f1f6ac9548860c4ee378c8d524266ab38a343d99036947
Instruction ID: 4ac0bde53fcefe63c64b79b14273c973a9021de8d5de8166d4f532f707e8062d
Opcode Fuzzy Hash: 1ccc6076cc6f692e90f1f6ac9548860c4ee378c8d524266ab38a343d99036947
Instruction Fuzzy Hash: 80F0A7363482487AE7108F55DC04BDB7F5DDFD1760F14C03BFA449E280D6B0999897A4

Function 004033C6 Relevance: 7.6, APIs: 5, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,00403372,000000FF,00000000,00000000,?,?), ref: 004033ED
ReadFile.KERNELBASE(?,00000004,?,00000000,00000004,00000000,00000000,00000000,?,?,?,00403372,000000FF,00000000,00000000,?), ref: 0040341A
ReadFile.KERNEL32(00414980,00004000,?,00000000,?,?,00403372,000000FF,00000000,00000000,?,?), ref: 00403474
WriteFile.KERNEL32(00000000,00414980,?,000000FF,00000000,?,00403372,000000FF,00000000,00000000,?,?), ref: 0040348C

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID:
API String ID: 2113905535-0
Opcode ID: 112533716f36a3d83ab0f8b5c1aa6b6122a43ce20d09c48fb3034a37057bef72
Instruction ID: fa80a256ba8ad7dbbe951804ed4cdf19961f9577527713a1418254d24a88ff6f
Opcode Fuzzy Hash: 112533716f36a3d83ab0f8b5c1aa6b6122a43ce20d09c48fb3034a37057bef72
Instruction Fuzzy Hash: D0314831500209EBCB22CF95DE80AAE7FBCEB41365B24403AF504AA190D7399A90DB69

Function 004034F1 Relevance: 6.1, APIs: 4, Instructions: 108
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403506

Part of subcall function 0040369F: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040334B,?), ref: 004036AD

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,?,004033FC,00000004,00000000,00000000,00000000,?,?,?,00403372,000000FF,00000000), ref: 00403539
WriteFile.KERNELBASE(0040C980,00412790,00000000,00000000,00414980,00004000,?,00000000,?,004033FC,00000004,00000000,00000000,00000000,?,?), ref: 004035F3
SetFilePointer.KERNELBASE(0000C0BA,00000000,00000000,00414980,00004000,?,00000000,?,004033FC,00000004,00000000,00000000,00000000,?,?), ref: 00403645

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID:
API String ID: 2146148272-0
Opcode ID: 1d643077d58e843cc00f83a3fa99e53f6c2b0296ddedef6d0ab7d02d506ede07
Instruction ID: 26932a1e78feeb0b77edab523d175b5838434cf18410dc30452224d4f843c6ae
Opcode Fuzzy Hash: 1d643077d58e843cc00f83a3fa99e53f6c2b0296ddedef6d0ab7d02d506ede07
Instruction Fuzzy Hash: EB41CFB2501205EFDB20EF28EE848263BACF785356705463FE841B32A1D7355A468F9D

Function 00405A22 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(0000005C,00000000,00000000), ref: 00405A65
GetLastError.KERNEL32 ref: 00405A79
SetFileSecurityA.ADVAPI32(0000005C,80000007,00000001), ref: 00405A8E
GetLastError.KERNEL32 ref: 00405A98

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: b4292ae52da0fc50f84fd512a3e5f3cdca8938f352655cb7b0d8c38ac6c39cdd
Instruction ID: 8b3c49f02a17c259515d84f04faf51af5275248166455e8be91c75529944b3c1
Opcode Fuzzy Hash: b4292ae52da0fc50f84fd512a3e5f3cdca8938f352655cb7b0d8c38ac6c39cdd
Instruction Fuzzy Hash: 77010871D00619DADF009BA0D944BEFBBB8EB04344F00853AD545B6190D77896088F99

Function 00405AD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00423DE0,Error launching installer), ref: 00405AF9
CloseHandle.KERNEL32(?), ref: 00405B06

Strings

Error launching installer, xrefs: 00405AE7

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b66473eb4771c68d0353ea43fb647f521c8516ae3fc4b703c5bf4ba3abd35a8
Instruction ID: 1d70755ca8eb642d96ec23e61d28b209352ba4559abde40ea63553acab106949
Opcode Fuzzy Hash: 3b66473eb4771c68d0353ea43fb647f521c8516ae3fc4b703c5bf4ba3abd35a8
Instruction Fuzzy Hash: 1DE0ECB4610209ABDB10DF65ED09EAF7BBCEB00345F808435A915E2150E779E514CA68

Function 00406EEB Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684942fe2b15b730065f226559e9be9e555d3a3d5e7fc0d9885530a7e2266171
Instruction ID: 8000226e84d3b017bc6d44c3bedd15163eea413bd8593d328e7b0baad47f3587
Opcode Fuzzy Hash: 684942fe2b15b730065f226559e9be9e555d3a3d5e7fc0d9885530a7e2266171
Instruction Fuzzy Hash: 58A15371E04229CBDF28CFA8C8447ADBBB1FB44305F15806ED856BB281D7786A86DF45

Function 004070EC Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bde7381304b81b3e09b27403b539467510d0fe95a90e5b4d7cfee1ed51f2236
Instruction ID: 759a5e24e10d50352dbc8de058c790801aa45a8a44818c86e8f054c705910e48
Opcode Fuzzy Hash: 6bde7381304b81b3e09b27403b539467510d0fe95a90e5b4d7cfee1ed51f2236
Instruction Fuzzy Hash: 1F913470D04229CBEF28CF98C8447ADBBB1FB44305F15816ED856BB281C778AA86DF45

Function 00406E02 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39de615352b626232416b4053d525421749ef36ddd4b9844f136144ab3fe8ed
Instruction ID: 1b2002c04af769fb6654495406821102eaccec2ab4c63d4c1d8c12c5004552e8
Opcode Fuzzy Hash: e39de615352b626232416b4053d525421749ef36ddd4b9844f136144ab3fe8ed
Instruction Fuzzy Hash: B7815671E04228CFDF24CFA9C8447ADBBB1FB44305F25816AD856BB281C7389986DF55

Function 00406907 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509badd97ca0faa3f5d71b944ab43e2a447e2d4a76e4aeed0a6ea4a78de18d41
Instruction ID: 61fe4de2002a16c4612afb9d07323b890c67664fa2f3b9718a96419d1d375b0a
Opcode Fuzzy Hash: 509badd97ca0faa3f5d71b944ab43e2a447e2d4a76e4aeed0a6ea4a78de18d41
Instruction Fuzzy Hash: 42819971D04228DBEF24CFA9C8447ADBBB0FB44305F15816AD856BB2C1C778698ADF45

Function 00406D55 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234d8de6b1a4825162bd56f0f275484faa6be4a536daf5717bc33d46969e13ad
Instruction ID: 41aba942b39599c1692c10913d65046045a3e4a9d9b4861b7f06a8ff37ecbfc8
Opcode Fuzzy Hash: 234d8de6b1a4825162bd56f0f275484faa6be4a536daf5717bc33d46969e13ad
Instruction Fuzzy Hash: E0713471E04228CBDF24CFA9C8447ADBBB1FB44305F15806AD856BB281D738A986DF15

Function 00406E73 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9a1c794173ec10a6f2dd2a1ae7cf519846913fbb24b072de2017ae18864e5d
Instruction ID: dbd92b475a9d0607fb1399eb60c35f34c7c8d9ad23197981acbd8ddbf59fdd3c
Opcode Fuzzy Hash: cb9a1c794173ec10a6f2dd2a1ae7cf519846913fbb24b072de2017ae18864e5d
Instruction Fuzzy Hash: AD714671E04228CBEF28CFA9C8447ADBBB1FF44305F15806AD816BB281C7389986DF55

Function 00406DBF Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f551091bef97c8d90c96c086bb2fc810a191328d3c3cc4ee86ad8ead6d95e62
Instruction ID: 13446529a524af4b77d0006a34a1fb508395f1689c279074a8e075742fa5827d
Opcode Fuzzy Hash: 5f551091bef97c8d90c96c086bb2fc810a191328d3c3cc4ee86ad8ead6d95e62
Instruction Fuzzy Hash: CB715671E04229CBEF28CF99C8447ADBBB1FF44305F15806AD856BB281C738A986DF45

Function 0040680A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
GetProcAddress.KERNEL32(00000000,?), ref: 00406837

Part of subcall function 0040679C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004067B3
Part of subcall function 0040679C: wsprintfA.USER32 ref: 004067EC
Part of subcall function 0040679C: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406800

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 083705430d5324b24e59e10dde8fdff82b0167a66bb10dfc30ab61c16026ae4d
Instruction ID: 2e1db5b2244f9e248c95e3a508c771c14dc2457370c723657138356a2d20bfb7
Opcode Fuzzy Hash: 083705430d5324b24e59e10dde8fdff82b0167a66bb10dfc30ab61c16026ae4d
Instruction Fuzzy Hash: D0E086336052205AD6116B745D04D3772A8AED8640306483EF542F2040DB38AC32A769

Function 00405FA4 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00403163,C:\Users\user\Desktop\yDoZVwXSMG.exe,80000000,00000003), ref: 00405FA8
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405FCA

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 3674cab34e86c9bb6ed208021152f8156afda3d0a6d4448f29a7fe7eff01a41d
Instruction ID: 99f0ed0b6f71b5c4d8d0263110580a9bc7934fab7bfe8a8d35efac0e687f4850
Opcode Fuzzy Hash: 3674cab34e86c9bb6ed208021152f8156afda3d0a6d4448f29a7fe7eff01a41d
Instruction Fuzzy Hash: 92D09E31654301EFFF098F20DE1AF2E7AA2EB84B00F11952CB682941E0DA7158599B15

Function 00405A9F Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004036DA,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00405AA5
GetLastError.KERNEL32 ref: 00405AB3

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: c0568d1a9d7a863155f8f57caddbba729ce21e02ac4465172204c49bf694c3b9
Instruction ID: 6d60ce6c2c78029c12fb4c6437a0e11bbe6e9f07fee022c993a6326ceae282bd
Opcode Fuzzy Hash: c0568d1a9d7a863155f8f57caddbba729ce21e02ac4465172204c49bf694c3b9
Instruction Fuzzy Hash: 6FC04C30745A019AEA115B709F48B177960AB50781F15893A6146E11B1DA348455DD6D

Function 00403B04 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,?,0040392A,00000020), ref: 00403B16
CloseHandle.KERNEL32(FFFFFFFF,?,0040392A,00000020), ref: 00403B2A

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: d0050b2195ef2e819ffde977c11754b421d184e7c458b58060b124be02b59d7b
Instruction ID: e4df60f3e1548bc6cc995373602d7fd8356d13b4c50c2791bd9444f9ca37880a
Opcode Fuzzy Hash: d0050b2195ef2e819ffde977c11754b421d184e7c458b58060b124be02b59d7b
Instruction Fuzzy Hash: E1E0463090072056C510EB7CBE4A8063A3C5B0233A7280B26F1B8B24F2CA3968924A59

Function 0040366D Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,00000000,00000000,00414980,0040C980,00403572,00414980,00004000,?,00000000,?,004033FC,00000004,00000000,00000000), ref: 00403684

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4ccc4bbe2abcb677344719b3a5d559962fdee24b46b0939c7a596c127dcbc5e6
Instruction ID: ffaae792c95b3e74212be0c0ac91cf90d2f7abdb703311f5376c9916736d2436
Opcode Fuzzy Hash: 4ccc4bbe2abcb677344719b3a5d559962fdee24b46b0939c7a596c127dcbc5e6
Instruction Fuzzy Hash: 46E08631150119BBDF215E51DC04E973B5CDB05365F008433F945E6250D576D6119B94

Function 0040369F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040334B,?), ref: 004036AD

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 10ef837ee4804bf9d7f3e3ca6725328f0d2a1cf4c29bc69e4f563ca935bf008a
Instruction ID: bbe28819b9c1f708c1bc01410fff550cfc21c648a57af447a5397392da283f69
Opcode Fuzzy Hash: 10ef837ee4804bf9d7f3e3ca6725328f0d2a1cf4c29bc69e4f563ca935bf008a
Instruction Fuzzy Hash: 02B01271240300BFEA128B00DF0AF057B72AB64700F108434B3C8380F08A721031DB0D

Non-executed Functions

Function 00405683 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 286windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004056E2
GetDlgItem.USER32(?,000003EE), ref: 004056F1
GetClientRect.USER32(?,?), ref: 00405749
GetSystemMetrics.USER32(00000015), ref: 00405751
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405772
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405783
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405796
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004057A4
SendMessageA.USER32(?,00001024,00000000,?), ref: 004057B7
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004057D9
ShowWindow.USER32(?,00000008), ref: 004057ED
GetDlgItem.USER32(?,000003EC), ref: 0040580E
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040581E
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405837
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405843
GetDlgItem.USER32(?,000003F8), ref: 00405700

Part of subcall function 004044D5: SendMessageA.USER32(00000028,?,00000001,00404306), ref: 004044E3

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

GetDlgItem.USER32(?,000003EC), ref: 00405860
CreateThread.KERNEL32(00000000,00000000,Function_000055FD,00000000), ref: 0040586E
CloseHandle.KERNEL32(00000000), ref: 00405875
ShowWindow.USER32(00000000), ref: 00405899
ShowWindow.USER32(?,00000008), ref: 0040589E
ShowWindow.USER32(00000008), ref: 004058E5
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405917
CreatePopupMenu.USER32 ref: 00405928
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040593D
GetWindowRect.USER32(?,?), ref: 00405950
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405974
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004059AF
OpenClipboard.USER32(00000000), ref: 004059BF
EmptyClipboard.USER32 ref: 004059C5
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004059CE
GlobalLock.KERNEL32(00000000), ref: 004059D8
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004059EC
GlobalUnlock.KERNEL32(00000000), ref: 00405A04
SetClipboardData.USER32(00000001,00000000), ref: 00405A0F
CloseClipboard.USER32 ref: 00405A15

Strings

C:\Users\user\Desktop, xrefs: 0040571C
{, xrefs: 00405904
New install of "%s" to "%s", xrefs: 00405735

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlocklstrlenwvsprintf
String ID: C:\Users\user\Desktop$New install of "%s" to "%s"${
API String ID: 430598769-860047555
Opcode ID: 6e77eacb8004290fe6ed722c867037a8234ca31613d18bea79517b39ef928cc2
Instruction ID: 2fba88bd0456375d88f597e1db9ec2698228ff227e9935e042ad6112b8d1c173
Opcode Fuzzy Hash: 6e77eacb8004290fe6ed722c867037a8234ca31613d18bea79517b39ef928cc2
Instruction Fuzzy Hash: 3DB16AB1900608FFDB11AF60DD89EAE3F78EB04354F50803AFA45BA1A0CB755952DF68

Function 00404E7A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E91
GetDlgItem.USER32(?,00000408), ref: 00404E9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404EEA
LoadBitmapA.USER32(0000006E), ref: 00404EFD
SetWindowLongA.USER32(?,000000FC,0040547B), ref: 00404F17
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404F2B
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404F3F
SendMessageA.USER32(?,00001109,00000002), ref: 00404F54
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404F60
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F72
DeleteObject.GDI32(?), ref: 00404F77
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404FA2
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404FAE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00405043
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 0040506E
SendMessageA.USER32(?,00001100,00000000,?), ref: 00405082
GetWindowLongA.USER32(?,000000F0), ref: 004050B1
SetWindowLongA.USER32(?,000000F0,00000000), ref: 004050BF
ShowWindow.USER32(?,00000005), ref: 004050D0
SendMessageA.USER32(?,00000419,00000000,?), ref: 004051D3
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00405238
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040524D
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405271
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405297
ImageList_Destroy.COMCTL32(?), ref: 004052AC
GlobalFree.KERNEL32(?), ref: 004052BC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 0040532C
SendMessageA.USER32(?,00001102,00000410,?), ref: 004053D5
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004053E4
InvalidateRect.USER32(?,00000000,00000001), ref: 00405404
ShowWindow.USER32(?,00000000), ref: 00405452
GetDlgItem.USER32(?,000003FE), ref: 0040545D
ShowWindow.USER32(00000000), ref: 00405464

Strings

M, xrefs: 0040502A
, xrefs: 0040543C
N, xrefs: 0040510E

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: ad34ad8691b17b25a9ccd6bb964da61cb4def815d2f23b5d4b3dc1c834c130e8
Instruction ID: c6f49fae16b786c00443764c83c26e904ee8db6dc28079495487e9681e8e48f0
Opcode Fuzzy Hash: ad34ad8691b17b25a9ccd6bb964da61cb4def815d2f23b5d4b3dc1c834c130e8
Instruction Fuzzy Hash: CD029B70A00608EFDB209F55DD45AAF7BB5FB84314F10817AF611BA2E1D7798A81CF58

Function 00405B99 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 184filestringCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405BB7
lstrcatA.KERNEL32(00422DE0,\*.*,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405C01
lstrcatA.KERNEL32(?,0040A28C,?,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405C22
lstrlenA.KERNEL32(?,?,0040A28C,?,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405C28
FindFirstFileA.KERNEL32(00422DE0,?,?,?,0040A28C,?,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405C39
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405D18
FindClose.KERNEL32(?), ref: 00405D29

Strings

C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00405BA3
Delete: DeleteFile failed("%s"), xrefs: 00405CF3
Delete: DeleteFile("%s"), xrefs: 00405CB1
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 00405B99
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00405D8F
\*.*, xrefs: 00405BFB
RMDir: RemoveDirectory failed("%s"), xrefs: 00405DAC
-B, xrefs: 00405BEB
Delete: DeleteFile on Reboot("%s"), xrefs: 00405CD5
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00405D47
RMDir: RemoveDirectory("%s"), xrefs: 00405D6B

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\yDoZVwXSMG.exe"$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$-B
API String ID: 2035342205-2775081914
Opcode ID: d9e794bf4db949f9f167c4bc40a366908cc29f2bcc61605d68bee47b05557f6f
Instruction ID: 9491e254326f547fd3688dea50c8b6e7d0e4d1d5e1860c78739179a064ac5d31
Opcode Fuzzy Hash: d9e794bf4db949f9f167c4bc40a366908cc29f2bcc61605d68bee47b05557f6f
Instruction Fuzzy Hash: DE51E330508B4469EB216B219D4ABBF3B69CF42728F24803FF842751D2DB7C5981CE6E

Function 004048DE Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 303stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 0040492F
IsDlgButtonChecked.USER32(?,000003F0), ref: 0040493D
GetDlgItem.USER32(?,000003FB), ref: 0040495D
GetAsyncKeyState.USER32(00000010), ref: 00404964
GetDlgItem.USER32(?,000003F0), ref: 00404973
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404984
SetWindowTextA.USER32(?,?), ref: 004049B3
SHBrowseForFolderA.SHELL32(?,004219C0,?), ref: 00404A6A
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,00421DD8), ref: 00404AA7
lstrcatA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe), ref: 00404AB3
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404AC3
CoTaskMemFree.OLE32(00000000), ref: 00404A75

Part of subcall function 00405B19: GetDlgItemTextA.USER32(?,?,00000400,00404AF6), ref: 00405B2C

Part of subcall function 0040652F: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\yDoZVwXSMG.exe",C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,004036C2,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00406587
Part of subcall function 0040652F: CharNextA.USER32(?,?,?,00000000), ref: 00406594
Part of subcall function 0040652F: CharNextA.USER32(?,"C:\Users\user\Desktop\yDoZVwXSMG.exe",C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,004036C2,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00406599
Part of subcall function 0040652F: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,004036C2,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 004065A9

Part of subcall function 00403BF6: lstrcatA.KERNEL32(00000000,00000000,00424780,C:\Users\user\Desktop,install.log,00403D69,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003), ref: 00403C11

GetDiskFreeSpaceA.KERNEL32(004215B0,?,?,0000040F,?,004215B0,004215B0,?,00000001,004215B0,?,?,000003FB,?), ref: 00404B7C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404B97
SetDlgItemTextA.USER32(00000000,00000400,00420D98), ref: 00404C29

Part of subcall function 00404CF0: lstrlenA.KERNEL32(00421DD8,00421DD8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404C0B,000000DF,004215B0,00000400,00000000), ref: 00404D8E
Part of subcall function 00404CF0: wsprintfA.USER32 ref: 00404D96
Part of subcall function 00404CF0: SetDlgItemTextA.USER32(?,00421DD8), ref: 00404DA9

Strings

A, xrefs: 00404A63
C:\Users\user\Desktop, xrefs: 00404A90
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe, xrefs: 00404AA1, 00404AA6, 00404AB1

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Item$Text$Char$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTasklstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe$C:\Users\user\Desktop
API String ID: 323400435-2674471988
Opcode ID: 78c65bc590c1e235ef7a73e704ad4c428552a7094b56534d9291f6bd5556b852
Instruction ID: 53e1309a436ec8c8103ef3d9cb40cdd2e0d9dedad5aabb53aa7134592e3a1e93
Opcode Fuzzy Hash: 78c65bc590c1e235ef7a73e704ad4c428552a7094b56534d9291f6bd5556b852
Instruction Fuzzy Hash: B7B172B1A00218ABDB10AFA5CD85B9F7AB8EF84314F10843FF605B62D1D7789941CB6D

Function 004022F1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 150comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408400,?,00000001,004083F0,?), ref: 00402371
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040ACA8,00000400,?,00000001,004083F0,?), ref: 00402429

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402353

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 123533781-1377821865
Opcode ID: 54b1373629e2dc9903f390fa01b200151b173b83ed300e94aca67dfa06e08d4e
Instruction ID: 458830b68615384cc5dcfd7975f20282d1088c50676892df8a4bfa2d63e4f4ae
Opcode Fuzzy Hash: 54b1373629e2dc9903f390fa01b200151b173b83ed300e94aca67dfa06e08d4e
Instruction Fuzzy Hash: A2515D71A00105BFCB04DFA4CD88DAE7BB5EF44314B20416AF815EB2D1DBB99941CB64

Function 00406775 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,00423E28,004231E0,00405EE4,004231E0,004231E0,00000000,004231E0,004231E0,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00406780
FindClose.KERNEL32(00000000), ref: 0040678C

Strings

(>B, xrefs: 00406776

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: (>B
API String ID: 2295610775-269022603
Opcode ID: 831b1997f9f916c35f8a1434769a77bffab4373bf7aed33ff049e2637960da6e
Instruction ID: b63e9011ec8c2b29868c80016797e029c48760d48fef13a3cdc6f45c5aca086a
Opcode Fuzzy Hash: 831b1997f9f916c35f8a1434769a77bffab4373bf7aed33ff049e2637960da6e
Instruction Fuzzy Hash: 31D012315141306BC6505F386E0C84B7AD89F593363628B36F46AF61E0CB388C6286A9

Function 00402A84 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402A93

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: b25bffc5d1a8db0066b663ac743355f19798926255be00f41aca0f60a6b0e191
Instruction ID: 1c0e8fb98d7fe62c5c3da10d8ea296ad93fcee16e05e3a722bccc70f37f90231
Opcode Fuzzy Hash: b25bffc5d1a8db0066b663ac743355f19798926255be00f41aca0f60a6b0e191
Instruction Fuzzy Hash: 77F0A032544101AAD710EBA4EE499FEB7689F64328FA004BFE101F20C1D7BC49469A2E

Function 00401434 Relevance: 54.6, APIs: 13, Strings: 18, Instructions: 371sleepfilewindowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 004014D5
Sleep.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00401541
SetForegroundWindow.USER32(?), ref: 0040155A
ShowWindow.USER32(?), ref: 004015E1
ShowWindow.USER32(?), ref: 004015F5
SetFileAttributesA.KERNEL32(00000000,?,?,000000F0), ref: 0040161A
SetCurrentDirectoryA.KERNEL32(00000000,0042C800,00000000,000000E6,00000000,?,?,000000F0,?,000000F0), ref: 00401706
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 00401714
MoveFileA.KERNEL32(00000000,?), ref: 004017A6
GetFullPathNameA.KERNEL32(00000000,00000400,00000000,?,00000000,000000E3,?,00000000,00000000,00000000,0000005C,00000000,?,?,000000F0), ref: 00401806
GetShortPathNameA.KERNEL32(00000000,00000000,00000400), ref: 0040184C
SearchPathA.KERNEL32(00000000,00000000,00000000,00000400,00000000,?,000000FF,?,00000000,00000000,00000000,0000005C,00000000,?,?,000000F0), ref: 0040186B

Strings

SetFileAttributes failed., xrefs: 0040162F
Rename: %s, xrefs: 00401796
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 00401764
CreateDirectory: "%s" (%d), xrefs: 0040164B
Jump: %d, xrefs: 00401490
Rename on reboot: %s, xrefs: 004017D7
IfFileExists: file "%s" exists, jumping %d, xrefs: 0040174E
Call: %d, xrefs: 004014EA
Rename failed: %s, xrefs: 004017E9
SetFileAttributes: "%s":%08X, xrefs: 00401609
CreateDirectory: "%s" created, xrefs: 004016D4
CreateDirectory: can't create "%s" - a file already exists, xrefs: 004016C4
BringToFront, xrefs: 0040154C
Sleep(%d), xrefs: 0040152C
Aborting: "%s", xrefs: 004014AB
SetCurrentDirectory(%s) failed (%d), xrefs: 0040171C
detailprint: %s, xrefs: 00401509
CreateDirectory: can't create "%s" (err=%d), xrefs: 004016A6

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: PathWindow$FileNameShow$AttributesCurrentDirectoryErrorForegroundFullLastMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetCurrentDirectory(%s) failed (%d)$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 1463463071-1581295400
Opcode ID: a01a94291aaa17a9f8ddfe9b1d95d566d5442128b45f80725a0d66aef6891e2c
Instruction ID: cd94397812fa9254d581f5ff6aeb3ca49ce95be99e6962c7f7d93c7b36d86e40
Opcode Fuzzy Hash: a01a94291aaa17a9f8ddfe9b1d95d566d5442128b45f80725a0d66aef6891e2c
Instruction Fuzzy Hash: CBB11671904200BFDB146BA1DD4AEAF36B8AF08318B25053FF841B72D1DBBD5D418A6E

Function 00403FCD Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404009
ShowWindow.USER32(?), ref: 00404026
DestroyWindow.USER32 ref: 0040403A
SetWindowLongA.USER32(?,00000000,00000000), ref: 00404056
GetDlgItem.USER32(?,?), ref: 00404077
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 0040408B
IsWindowEnabled.USER32(00000000), ref: 00404092
GetDlgItem.USER32(?,00000001), ref: 00404140
GetDlgItem.USER32(?,00000002), ref: 0040414A
SetClassLongA.USER32(?,000000F2,?), ref: 00404164
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 004041B5
GetDlgItem.USER32(?,00000003), ref: 0040425B
ShowWindow.USER32(00000000,?), ref: 0040427C
EnableWindow.USER32(?,?), ref: 0040428E
EnableWindow.USER32(?,?), ref: 004042A9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042BF
EnableMenuItem.USER32(00000000), ref: 004042C6
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 004042DE
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 004042F1
lstrlenA.KERNEL32(00421DD8,?,00421DD8,00425C00), ref: 0040431A
SetWindowTextA.USER32(?,00421DD8), ref: 00404329
ShowWindow.USER32(?,0000000A), ref: 0040445D

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 0248ba45e7b493aff9bc460956d3901db11cdf52f63362b6396d5a0f8d5974e5
Instruction ID: e8b814be20905fb269ae5e5496c6b8f26aecf55a6b1e554940ad996ba5c5a090
Opcode Fuzzy Hash: 0248ba45e7b493aff9bc460956d3901db11cdf52f63362b6396d5a0f8d5974e5
Instruction Fuzzy Hash: 2CC1C3B1600704AFCB206F61EE45E2B3AA8FB94749F50453EF781B51F1CB3968529B1E

Function 00403C17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 221stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040680A: GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
Part of subcall function 0040680A: GetProcAddress.KERNEL32(00000000,?), ref: 00406837

lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,"C:\Users\user\Desktop\yDoZVwXSMG.exe",00000000), ref: 00403C88
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,?,?,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,00000000,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003,C:\Users\user\AppData\Local\Temp\~nsuA.tmp), ref: 00403CFD
lstrcmpiA.KERNEL32(?,.exe), ref: 00403D10
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe), ref: 00403D1B
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Desktop), ref: 00403D84

Part of subcall function 0040622B: wsprintfA.USER32 ref: 00406238

RegisterClassA.USER32 ref: 00403DCB
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403DE3
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1C
ShowWindow.USER32(00000005,00000000), ref: 00403E52
GetClassInfoA.USER32(00000000,RichEdit20A,00425BA0), ref: 00403E7E
GetClassInfoA.USER32(00000000,RichEdit,00425BA0), ref: 00403E8B
RegisterClassA.USER32(00425BA0), ref: 00403E94
DialogBoxParamA.USER32(?,00000000,00403FCD,00000000), ref: 00403EB3

Strings

_Nb, xrefs: 00403DDA, 00403DDF
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 00403C1B
.DEFAULT\Control Panel\International, xrefs: 00403C73
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe, xrefs: 00403CCB, 00403CD3, 00403CE0, 00403D2A, 00403D30
C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00403C23
.exe, xrefs: 00403D0A
C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp, xrefs: 00403C37, 00403C83
Control Panel\Desktop\ResourceLocale, xrefs: 00403C4B
RichEd20, xrefs: 00403E58
C:\Users\user\Desktop, xrefs: 00403C97, 00403C9F, 00403D37, 00403D3D, 00403D4D
RichEd32, xrefs: 00403E66
RichEdit20A, xrefs: 00403E76, 00403E7C
RichEdit, xrefs: 00403E85

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\yDoZVwXSMG.exe"$.DEFAULT\Control Panel\International$.exe$C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe$C:\Users\user\Desktop$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3911588168
Opcode ID: 219e44700a7c5464ba9c373261ae23bdec3dc5ef048ecac8b3c837362af8f259
Instruction ID: 7568602f95d19c6b689a3b08b652a15b96228f33c85fe1690cd6c01ac20bc482
Opcode Fuzzy Hash: 219e44700a7c5464ba9c373261ae23bdec3dc5ef048ecac8b3c837362af8f259
Instruction Fuzzy Hash: 0661B6702406406ED720BF659D45F3B3E6CEB4074AF85053FF981B62E2DB7CA9428A6D

Function 004045E8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404673
GetDlgItem.USER32(00000000,000003E8), ref: 00404687
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004046A5
GetSysColor.USER32(?), ref: 004046B6
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004046C5
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004046D4
lstrlenA.KERNEL32(?), ref: 004046DE
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004046EC
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004046FB
GetDlgItem.USER32(?,0000040A), ref: 0040475E
SendMessageA.USER32(00000000), ref: 00404761
GetDlgItem.USER32(?,000003E8), ref: 0040478C
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004047CC
LoadCursorA.USER32(00000000,00007F02), ref: 004047DB
SetCursor.USER32(00000000), ref: 004047E4
ShellExecuteA.SHELL32(0000070B,open,00424BA0,00000000,00000000,00000001), ref: 004047F7
LoadCursorA.USER32(00000000,00007F00), ref: 00404804
SetCursor.USER32(00000000), ref: 00404807
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404833
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404847

Strings

N, xrefs: 0040477A
open, xrefs: 004047EF
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe, xrefs: 004047B7

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe$N$open
API String ID: 3615053054-2634702824
Opcode ID: 4acb1e7f699876b9b080a19da7d3748d224994641b86eb42dea44ec3c9bac124
Instruction ID: 7ac1e07cf673726af58d7051cd64680cda6ca82f3b090425a6ea0e09ab9c8800
Opcode Fuzzy Hash: 4acb1e7f699876b9b080a19da7d3748d224994641b86eb42dea44ec3c9bac124
Instruction Fuzzy Hash: 0361C2B1A40208BFEB10AF60DD45F6A3768FB84714F10843AFB05BB1D1C7B8A951CB98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00425C00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 750255ee06490405d36d6d77af7e8d62f2e9bab9d2e9b601842e2a7d5fc750e5
Instruction ID: 1a047666a44e0bd53f927bcc358f11ad8581032b766642e5cfbbeb7700f4c1b8
Opcode Fuzzy Hash: 750255ee06490405d36d6d77af7e8d62f2e9bab9d2e9b601842e2a7d5fc750e5
Instruction Fuzzy Hash: A5418B71800219AFCF058F95DE459AF7BB9FF44314F00802AF5A1AA1A1CB38EA55DFA4

Function 00401899 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 189stringtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

lstrcatA.KERNEL32(00000000,00000000,0040B4B0,0042C800,00000000,00000000), ref: 004018F0
CompareFileTime.KERNEL32(-00000014,0040B4B0,0040B4B0,0040B4B0,00000000,00000000,0040B4B0,0042C800,00000000,00000000), ref: 0040191A

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,00425C00,NSIS Error), ref: 004062DA

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Strings

File: wrote %d to "%s", xrefs: 00401A42
File: error, user retry, xrefs: 004019BA
File: error, user abort, xrefs: 004019CD
File: skipped: "%s" (overwriteflag=%d), xrefs: 004019FB
File: error creating "%s", xrefs: 0040196A
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 004018B3
File: error, user cancel, xrefs: 00401A05

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"
API String ID: 4286501637-704903514
Opcode ID: b489c16bb3b7e1a2c5301dae30614d08274f10404859f7f5edba48aaa1734e73
Instruction ID: 17351c833ff884be99ebbe4ca3dd04e93fba0c18e006415c8e205a2e39f5817b
Opcode Fuzzy Hash: b489c16bb3b7e1a2c5301dae30614d08274f10404859f7f5edba48aaa1734e73
Instruction Fuzzy Hash: A251E871A14214BACF107BB5DC4AEAF3668DF05339B21423FF416B11E1DB7C49518A6E

Function 004062EF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00420DB0,00000000,00405563,00420DB0,00000000), ref: 00406397
GetSystemDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,00000400), ref: 00406412
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,00000400), ref: 00406425
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406461
SHGetPathFromIDListA.SHELL32(00000000,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe), ref: 0040646F
CoTaskMemFree.OLE32(00000000), ref: 0040647A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,\Microsoft\Internet Explorer\Quick Launch), ref: 0040649C
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe,?,00420DB0,00000000,00405563,00420DB0,00000000), ref: 004064EE

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063E1
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406496
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe, xrefs: 00406318, 004063DF, 004063FC, 00406411, 00406424, 00406440, 0040646B, 0040649B, 004064A1, 004064B9, 004064CC, 004064E7, 004064ED, 004064F8, 00406522

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Zu_.exe$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-460282004
Opcode ID: e70c36c15463e11e4d98769463c39d75202b1930655f9bc1c58c23aaa8b76e0f
Instruction ID: 5020ced7e0235193b8239b63b3ec8dced8004e66b88da715bb9c8bf5f7faf145
Opcode Fuzzy Hash: e70c36c15463e11e4d98769463c39d75202b1930655f9bc1c58c23aaa8b76e0f
Instruction Fuzzy Hash: F8510530A00210AEDF216F64DD8477E3BA4AB55724F12423FE953B62D1D73D8962DB4D

Function 00402689 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 127registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004026D7
lstrlenA.KERNEL32(0040BCB0,00000023,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004026FA

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

RegSetValueExA.ADVAPI32(?,?,?,?,0040BCB0,00000000), ref: 004027B0
RegCloseKey.ADVAPI32(?), ref: 004028C3

Strings

WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 00402724
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402712
WriteReg: error creating key "%s\%s", xrefs: 004027E3
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 00402797
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402750
WriteReg: error writing into "%s\%s" "%s", xrefs: 004027C8

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 3326b50684f42d6555f26c716621c72d8a630b4c615609b64f1a4946c695ced0
Instruction ID: 0d8f67e9f840f9fb8975a9187b81f617768a5146bfc4832fe9bc88b1c5f34d6b
Opcode Fuzzy Hash: 3326b50684f42d6555f26c716621c72d8a630b4c615609b64f1a4946c695ced0
Instruction Fuzzy Hash: 6D415BB2D00208BFDF11AFA1CD4AE9EBB78EF04348F11407AF505761D0D7BA4A619B69

Function 00402AC2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402B16
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402B32
GlobalFree.KERNEL32(?), ref: 00402B6B
WriteFile.KERNEL32(?,00000000,?,?), ref: 00402B7D
GlobalFree.KERNEL32(00000000), ref: 00402B84
CloseHandle.KERNEL32(?), ref: 00402B9C
DeleteFileA.KERNEL32(?), ref: 00402BC3

Strings

created uninstaller: %d, "%s", xrefs: 00402BA8

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: fcd8c44232e72c7a519ab1b54606f4df5990d39ba661982b9417052821f24287
Instruction ID: f039b0f35b450dc7ee41e930bae157162e8a347937c2952a3d4cbe63db110461
Opcode Fuzzy Hash: fcd8c44232e72c7a519ab1b54606f4df5990d39ba661982b9417052821f24287
Instruction Fuzzy Hash: C031BE71800128BBCF20AFA5CE49DAE7F78EF04324F10423AF914762E1DB795D419BA9

Function 004021E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00402214

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402225
GetProcAddress.KERNEL32(?,?), ref: 0040223C
FreeLibrary.KERNEL32(?,?), ref: 004022BC

Strings

Error registering DLL: Could not load %s, xrefs: 004022CF
Error registering DLL: Could not initialize OLE, xrefs: 004022E7
Error registering DLL: %s not found in %s, xrefs: 00402293

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSendlstrlen$Library$AddressFreeHandleLoadModuleProcTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 3271377537-945480824
Opcode ID: 95944be87c664a0b58439fc9e78eee2c4482eb363a37399056f384f006046da1
Instruction ID: c758e62e292b85024776478069b6dbefcb92a1905fe08cf12c5b39257b8ea98b
Opcode Fuzzy Hash: 95944be87c664a0b58439fc9e78eee2c4482eb363a37399056f384f006046da1
Instruction Fuzzy Hash: C221B132904205BBCF106FA1DE49B9E7A70AF08358F60417FF410B11E0DBBD4A919A2E

Function 0040652F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\yDoZVwXSMG.exe",C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,004036C2,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00406587
CharNextA.USER32(?,?,?,00000000), ref: 00406594
CharNextA.USER32(?,"C:\Users\user\Desktop\yDoZVwXSMG.exe",C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,004036C2,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00406599
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,004036C2,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 004065A9

Strings

C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00406530, 00406535
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 0040656B
*?|<>/":, xrefs: 00406577

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\yDoZVwXSMG.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\~nsuA.tmp
API String ID: 589700163-2691690906
Opcode ID: 8096d849d1c9ce41e0346831cb37685f4dd6d64b26888903e7438f7d863a7a62
Instruction ID: 24dd96064d5417bc72e67d0c60cfec8ce53d8243db2d456a42809f7a95db7985
Opcode Fuzzy Hash: 8096d849d1c9ce41e0346831cb37685f4dd6d64b26888903e7438f7d863a7a62
Instruction Fuzzy Hash: 981134A180479039EB3216386C44B777F894F5B7A0F1A047BE4C2322C6DA7C5D62826D

Function 00404507 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404524
GetSysColor.USER32(00000000), ref: 00404540
SetTextColor.GDI32(?,00000000), ref: 0040454C
SetBkMode.GDI32(?,?), ref: 00404558
GetSysColor.USER32(?), ref: 0040456B
SetBkColor.GDI32(?,?), ref: 0040457B
DeleteObject.GDI32(?), ref: 00404595
CreateBrushIndirect.GDI32(?), ref: 0040459F

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ff550e039535750ddee094f50c47ca332dcff401595c3ffc2c3d1fe0adab4e51
Instruction ID: 5129247060fdf99fe8797dcd9aa0072a42d6f3bc0e200a186bc0a46124ada848
Opcode Fuzzy Hash: ff550e039535750ddee094f50c47ca332dcff401595c3ffc2c3d1fe0adab4e51
Instruction Fuzzy Hash: 002142B1501704ABCB219F68DD08B5BBBF8AF41714F04892DFA96A26E0D738E9488B54

Function 0040552B Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: cb0f79ab979e13bb22370c5c0aa667bb76c3ef8d0eed0eb48269c6a4122cdca1
Instruction ID: b5f13368894abbd72d2ef9bcc5aed1bc168452b499d58a4623565611e2026dd0
Opcode Fuzzy Hash: cb0f79ab979e13bb22370c5c0aa667bb76c3ef8d0eed0eb48269c6a4122cdca1
Instruction Fuzzy Hash: 71218C71900118BBCF119FA5CD80ADFBFB9EF04354F04807AF944B6291C7388A419FA8

Function 00402076 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Part of subcall function 00405AD4: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00423DE0,Error launching installer), ref: 00405AF9
Part of subcall function 00405AD4: CloseHandle.KERNEL32(?), ref: 00405B06

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 004020C6
GetExitCodeProcess.KERNEL32(?,?), ref: 004020D6
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 004020FB

Strings

Exec: command="%s", xrefs: 0040207F
Exec: success ("%s"), xrefs: 004020A1
Exec: failed createprocess ("%s"), xrefs: 0040210D

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 4c0bf5a819c5cabc785e79fb82755261a9ca6965defa31031fc279229f133177
Instruction ID: f192cf5068fe721493c2ca47631b8fd5e11dfa55f6fb4389df25e9f95d382c2a
Opcode Fuzzy Hash: 4c0bf5a819c5cabc785e79fb82755261a9ca6965defa31031fc279229f133177
Instruction Fuzzy Hash: 96119031505214EADB25AF91DE899AE7B61EF01318F20403FF501750D1CBBD0991EB6E

Function 00403081 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403099
GetTickCount.KERNEL32 ref: 004030B7
wsprintfA.USER32 ref: 004030E5

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

CreateDialogParamA.USER32(0000006F,00000000,00402FE9,00000000), ref: 00403109
ShowWindow.USER32(00000000,00000005), ref: 00403117

Part of subcall function 00403065: MulDiv.KERNEL32(00000000,00000064,00000004), ref: 0040307A

Strings

... %d%%, xrefs: 004030DF

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: ce67bc7cccbabcfd3d998f218857b4b480decfb62087f9010a91ecd6a2638fba
Instruction ID: 8a56325a0c249c51aeddb8beeb044339652cd635e3f90c4b3db5a9aada2ba764
Opcode Fuzzy Hash: ce67bc7cccbabcfd3d998f218857b4b480decfb62087f9010a91ecd6a2638fba
Instruction Fuzzy Hash: 6C01C870502624DBCB217F60BD09AAA7F6CAB05B46B04803BF441B11D5DB784A45CF9E

Function 00404DFA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404E15
GetMessagePos.USER32 ref: 00404E1D
ScreenToClient.USER32(?,?), ref: 00404E37
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404E49
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404E6F

Strings

f, xrefs: 00404E4B

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2de7cdc7de5e6d73f2f496e999baad3857bc1053d919e802e93d4047082e1f51
Instruction ID: 577475e6f0e9fc61b494f9fa51c3945aaa03660cb513c050f00af2c753d98fa9
Opcode Fuzzy Hash: 2de7cdc7de5e6d73f2f496e999baad3857bc1053d919e802e93d4047082e1f51
Instruction Fuzzy Hash: 78015271D00219BADB00DBA4DD45FFEBBBCAF55B11F10012BBA50B61D1C7B459458B94

Function 00402FE9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00403004
wsprintfA.USER32 ref: 00403038
SetWindowTextA.USER32(?,?), ref: 00403048
SetDlgItemTextA.USER32(?,00000406,?), ref: 0040305A

Strings

unpacking data: %d%%, xrefs: 00403026, 00403036
verifying installer: %d%%, xrefs: 0040302D

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 34aea8c237d9a6b4262babc5d15cb9ea65e997ceb4a27ace1c078bd2d2e193bf
Instruction ID: 20546e6ba832e1b3fab4aa97257a5f65f69261077b3f880adcbb49229734dd85
Opcode Fuzzy Hash: 34aea8c237d9a6b4262babc5d15cb9ea65e997ceb4a27ace1c078bd2d2e193bf
Instruction Fuzzy Hash: 3AF0817050020CBBDF20AF60DD06BAE3BBCAB04345F00843AFA56B51D5DBB99A558F99

Function 00402EE4 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402F05
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402F41
RegCloseKey.ADVAPI32(?), ref: 00402F4A
RegCloseKey.ADVAPI32(?), ref: 00402F6F
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402F8D

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b028ecec1d78a200503dadcefe2bc22e0f6fb028ff25e3f61a2c7c57b1882060
Instruction ID: 1bd9878c7ef2e45ac55117cc9ab264197938e8746315a7d31758d375fefd0929
Opcode Fuzzy Hash: b028ecec1d78a200503dadcefe2bc22e0f6fb028ff25e3f61a2c7c57b1882060
Instruction Fuzzy Hash: 0E117C7150000AFFDF10AFA0DE48DAA3B7DEB44389B404036FA45B01E0D7B49E55BB69

Function 004065C8 Relevance: 7.6, APIs: 5, Instructions: 51stringfileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,?,?,00406773,00000000), ref: 004065DE
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00424780,40000000,00000004,?,?,00406773,00000000), ref: 00406626
lstrcatA.KERNEL32(004253A0,0040ABEC,004253A0,?,?,00406773,00000000), ref: 00406641
lstrlenA.KERNEL32(004253A0,?,00000000,004253A0,0040ABEC,004253A0,?,?,00406773,00000000), ref: 0040664C
WriteFile.KERNEL32(004253A0,00000000,004253A0,?,00000000,004253A0,0040ABEC,004253A0,?,?,00406773,00000000), ref: 00406659

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: File$CloseHandlePointerWritelstrcatlstrlen
String ID:
API String ID: 4073665932-0
Opcode ID: 6985dbf8a51587ff873b0807ef77b93063035b7dde659fa51b5ad4c8cc64aba6
Instruction ID: 8cb7850f754a91aea35530736be2dd68b046b28bd0b92714d99c360fc914dd09
Opcode Fuzzy Hash: 6985dbf8a51587ff873b0807ef77b93063035b7dde659fa51b5ad4c8cc64aba6
Instruction Fuzzy Hash: BD019671500306ABD720AF74BD85E573A5CDB01374B52433BF172B51E0C73998A29A5E

Function 00401EE8 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401EEC
GetClientRect.USER32(00000000,?), ref: 00401EF9
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401F1A
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401F28
DeleteObject.GDI32(00000000), ref: 00401F37

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 2b5ee9b79bc2e435364925ea92796c897a067646052ad9859a883ee0aa8a3ada
Instruction ID: 21f7915a8cdd7433989eb4cccbd80dcd7ad255e5dc09bc42d858887927c334f1
Opcode Fuzzy Hash: 2b5ee9b79bc2e435364925ea92796c897a067646052ad9859a883ee0aa8a3ada
Instruction Fuzzy Hash: 70F0ECB2500105AFD700EBA4EF88CAFB7BCEB48345B11447AF641F6191CA789D018B38

Function 00404CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00421DD8,00421DD8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404C0B,000000DF,004215B0,00000400,00000000), ref: 00404D8E
wsprintfA.USER32 ref: 00404D96
SetDlgItemTextA.USER32(?,00421DD8), ref: 00404DA9

Strings

%u.%u%s%s, xrefs: 00404D78

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: fb960496eb737e3345640ab9aa1b750d987e596b68fc784b6d450b4f24d22922
Instruction ID: fef6342639dcf3a39bf3010210a5e3f1a67f436211564216b1c935a3cd24951c
Opcode Fuzzy Hash: fb960496eb737e3345640ab9aa1b750d987e596b68fc784b6d450b4f24d22922
Instruction Fuzzy Hash: FA11B77360412827DB0065699C41EAE3298DF85775F25023BFA26F71D5E978DC1242A9

Function 00401DD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401E34
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401E4C

Strings

!, xrefs: 00401E08

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4dc8f70aa0e183750effb2cde1311245b6065c9c0ffff7879e43e580c0dc7d9c
Instruction ID: 183b73fb6a545bb1246e923ab68f4d664312321a500069d7f5b6b65c517e0d36
Opcode Fuzzy Hash: 4dc8f70aa0e183750effb2cde1311245b6065c9c0ffff7879e43e580c0dc7d9c
Instruction Fuzzy Hash: CC219071940149BFDF01AFB0C94AAAE7BB5EF44304F10407EFA41B61D1D7B84A41DB98

Function 004025F5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402FAE: RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402FD6

RegCloseKey.ADVAPI32(00000000), ref: 00402640
RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402620

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

Strings

DeleteRegValue: "%s\%s" "%s", xrefs: 00402632
DeleteRegKey: "%s\%s", xrefs: 00402655

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 02bdeb8d08911694a65d4586fa4c43738527b4bcc4f51e929d40f2f0180d0c71
Instruction ID: a5f9fdcf4292228b50cc97bbae3325fbb2d9f6784c2398e720f3cfd803d35b6f
Opcode Fuzzy Hash: 02bdeb8d08911694a65d4586fa4c43738527b4bcc4f51e929d40f2f0180d0c71
Instruction Fuzzy Hash: C411CE72A00210BBDB10AFA1DE4AEBE7A74EF44358F11043FF405B61C1DBBD49119AAE

Function 00402470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

Part of subcall function 00406775: FindFirstFileA.KERNEL32(?,00423E28,004231E0,00405EE4,004231E0,004231E0,00000000,004231E0,004231E0,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00406780
Part of subcall function 00406775: FindClose.KERNEL32(00000000), ref: 0040678C

lstrlenA.KERNEL32 ref: 004024BF
lstrlenA.KERNEL32(00000000), ref: 004024C9
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004024F1

Strings

CopyFiles "%s"->"%s", xrefs: 0040248A

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: 1287623eff98437f27fce682f7b588892205dee902ac4484e1de8504ad36e18e
Instruction ID: 0832a6020f1036a0726e8da95463cb7d6bb66b9f43395e8b0a18584e12aaf647
Opcode Fuzzy Hash: 1287623eff98437f27fce682f7b588892205dee902ac4484e1de8504ad36e18e
Instruction Fuzzy Hash: 06115171D04244BACB10EFF5DE49A8EBBB89F05318F10403BB405B72C1D6BCC9018769

Function 004066C9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040671D
lstrcatA.KERNEL32(00000000,...), ref: 00406740

Strings

%02x%c, xrefs: 00406715
..., xrefs: 00406738

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: daa42dd9d71092567bb90f5aa1bf8f8b213d546467a0c39d0d39aa66ca362de9
Instruction ID: d62a74e215861be07d80cfa2a74bb9186ec53be61cd52c9054fc739eae054529
Opcode Fuzzy Hash: daa42dd9d71092567bb90f5aa1bf8f8b213d546467a0c39d0d39aa66ca362de9
Instruction Fuzzy Hash: 5601F531904214AFD711DF99C985BDEBBE9EB84704F21413BF805F7280D3759EA087A8

Function 004055FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040560D

Part of subcall function 004044EC: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 004044FE

OleUninitialize.OLE32(00000404,00000000), ref: 0040565B

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

Strings

Section: "%s", xrefs: 0040562F
Skipping section: "%s", xrefs: 0040566B

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: c1e2c449bcc68b352cf79dcfb7db83265b1627727e3ad06e037315caf05dff02
Instruction ID: b6033417647ee4c6c9867fb094380a517277432fe9fbf8781098b48ebfeefd64
Opcode Fuzzy Hash: c1e2c449bcc68b352cf79dcfb7db83265b1627727e3ad06e037315caf05dff02
Instruction Fuzzy Hash: 4CF028732446009AE7243762AD0AF167794DF80324FA6443FFE88731E1CF7E48428A6D

Function 00405DC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,004036D4,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00405DC6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,004036D4,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00405DCF
lstrcatA.KERNEL32(?,0040A28C), ref: 00405DE0

Strings

C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00405DC0

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\~nsuA.tmp
API String ID: 2659869361-97582353
Opcode ID: 474ca4425f08dcfbce71dbb0ed893910abc24d850d6d34f35572f5f56a012a6b
Instruction ID: 0734be1ac4b4e6ef13ff8d97b6b7742c695e07c626293a3ddb6dea9da1bc223f
Opcode Fuzzy Hash: 474ca4425f08dcfbce71dbb0ed893910abc24d850d6d34f35572f5f56a012a6b
Instruction Fuzzy Hash: 88D0A7625019306AD10132555C09DCF1B089F0234170500BFF101B3191C77C4D5187FE

Function 00401D15 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,00425C00,NSIS Error), ref: 004062DA

GlobalFree.KERNEL32(00000000), ref: 00401D9C

Strings

Pop: stack empty, xrefs: 00401D7A
Exch: stack < %d elements, xrefs: 00401D34

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty
API String ID: 1459762280-1566736970
Opcode ID: c1cfcf0f631f3b5dd603a5b161242025d82f77c49408bd9f9c2f6b8be0c3e131
Instruction ID: 25a31974a44f7f3c9bc4a7fc565ada83b9efa98a6fb8f9df3e5ad5d088b76f6c
Opcode Fuzzy Hash: c1cfcf0f631f3b5dd603a5b161242025d82f77c49408bd9f9c2f6b8be0c3e131
Instruction Fuzzy Hash: CC21B3B2604141EBD710BF94DE85A5F73A4AF48319721493FF512B32D1EB7CA8119B2D

Function 00401F42 Relevance: 6.0, APIs: 4, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401F49
GetDeviceCaps.GDI32(00000000), ref: 00401F50
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401F5F
CreateFontIndirectA.GDI32(0040C8B4), ref: 00401FB1

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 291d0e57388edc1b08859d94a8efc30bfd93f616262f4cc1ff9ef029793b8a23
Instruction ID: b63daee5e4490fecacf728a327702699109581dcf8ad524f23a780e713d248c9
Opcode Fuzzy Hash: 291d0e57388edc1b08859d94a8efc30bfd93f616262f4cc1ff9ef029793b8a23
Instruction Fuzzy Hash: B1F04473954684EFE7017760AF9ABAA3FA4A715306F148579E5C1B61E3C6B80008972D

Function 00403F00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00425C00), ref: 00403F98

Strings

C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp, xrefs: 00403F04, 00403F0E, 00403F7F
"C:\Users\user\Desktop\yDoZVwXSMG.exe", xrefs: 00403F01

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\Desktop\yDoZVwXSMG.exe"$C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp
API String ID: 530164218-921192254
Opcode ID: 824abd7a98796db34fe8f0091d41f8f78567243a6a7f46d0f054108d974f342d
Instruction ID: c0cba1e1e52928c29bb6f4708aec44978d016cd28d93ecea9319bf13156573fa
Opcode Fuzzy Hash: 824abd7a98796db34fe8f0091d41f8f78567243a6a7f46d0f054108d974f342d
Instruction Fuzzy Hash: 0111C375F046129BC720AF15DC90A777BBCEB8975A369417FE801AB3A0C6399D02866C

Function 0040547B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004054B1
CallWindowProcA.USER32(?,00000200,?,?), ref: 0040551F

Part of subcall function 004044EC: SendMessageA.USER32(?,00000000,00000000,00000000), ref: 004044FE

Strings

, xrefs: 00405489

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a97747d4f20b58a5a8246378c350f1c08e6f5488a267fa018f0172030650b825
Instruction ID: 166d6715e7ab60c55adc75bb3d5397455d2db949af7a45014f951e8b9f02b12e
Opcode Fuzzy Hash: a97747d4f20b58a5a8246378c350f1c08e6f5488a267fa018f0172030650b825
Instruction Fuzzy Hash: 2C118C31200608BBDB216F52DC40A9B3B6AEF15365F00843BF609792A2C7788D51CFA9

Function 00401FFA Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,0042C800,?), ref: 00402040

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 0040204F
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402064

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: ExecuteShelllstrlenwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 2380004146-2180253247
Opcode ID: 7c1dea5b3ff3ade20b01131b07687108b99786545fcbf0ac971017966e44b1c4
Instruction ID: 9f4db21a6b6a14a70f0226e5947bfc74daeb421406b5451b347b61cec48b8855
Opcode Fuzzy Hash: 7c1dea5b3ff3ade20b01131b07687108b99786545fcbf0ac971017966e44b1c4
Instruction Fuzzy Hash: 7D01D4B1B442007EDB206AB6DD4EE6B6A68DF4575CB60043BF401F61C2DAFD8C119279

Function 00405EA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,00425C00,NSIS Error), ref: 004062DA

Part of subcall function 00405E54: CharNextA.USER32(00405BAD,?,004231E0,00000000,00405EB8,004231E0,004231E0,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405E62
Part of subcall function 00405E54: CharNextA.USER32(00000000), ref: 00405E67
Part of subcall function 00405E54: CharNextA.USER32(00000000), ref: 00405E76

lstrlenA.KERNEL32(004231E0,00000000,004231E0,004231E0,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405EF4
GetFileAttributesA.KERNEL32(004231E0,004231E0,004231E0,004231E0,004231E0,004231E0,00000000,004231E0,004231E0,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,76232EE0), ref: 00405F04

Strings

1B, xrefs: 00405EA7

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 1B
API String ID: 3248276644-3133059986
Opcode ID: dbfd0eb15a0aee7a56b9524eaabc91726594297034a6f990c90e67fba31c6c96
Instruction ID: 0a9ec8cc8701c190d5637e4eaeae3a47b1d3f29b87e2c858e077ece57a352d20
Opcode Fuzzy Hash: dbfd0eb15a0aee7a56b9524eaabc91726594297034a6f990c90e67fba31c6c96
Instruction Fuzzy Hash: 8DF0F435115D6116D622333A9C09AAF2A18CE82328716053FF8E2B22D1DB3C8B4389FD

Function 00402531 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,00425C00,NSIS Error), ref: 004062DA

WritePrivateProfileStringA.KERNEL32(?,?,?,00000000), ref: 004025AA

Strings

<RM>, xrefs: 00402536
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402593

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-2205282576
Opcode ID: 761816c344bc7c14fad519cf076e7676c334ba530189723ea92024271b26ca30
Instruction ID: 330d2e4d02b989cca60e921ba8ea68942becdf5f63010b794772c6dbbebc1385
Opcode Fuzzy Hash: 761816c344bc7c14fad519cf076e7676c334ba530189723ea92024271b26ca30
Instruction Fuzzy Hash: B6012C71D40259BACF04BFA18E499AF7974AF44354F10443FB515761C2C7BC0A50CBAD

Function 00401FBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401FE4

Part of subcall function 00406747: lstrlenA.KERNEL32(004253A0,?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,004253A0,?), ref: 00406766

EnableWindow.USER32(00000000,00000000), ref: 00401FEF

Strings

HideWindow, xrefs: 00401FD2

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 538e065fc1b70d76e8ca8ce03386398be470029bf36a18afe3fffe23a19aa57c
Instruction ID: f9bbae7df7fa4fde6100788e383a183b323f94d17af37d41b00e3582981cb5ce
Opcode Fuzzy Hash: 538e065fc1b70d76e8ca8ce03386398be470029bf36a18afe3fffe23a19aa57c
Instruction Fuzzy Hash: 93E09232600201DBCB10ABF5EE4999EB2B0AF44359B60043FE441F60D2DB7D8C41D67D

Function 00403B61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,00000000,76232EE0,00403B38,?,0040392A,00000020), ref: 00403B7B
GlobalFree.KERNEL32(00000000), ref: 00403B82

Strings

C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00403B73

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\~nsuA.tmp
API String ID: 1100898210-97582353
Opcode ID: 4a26028100cf0ca1eb7320d9d5861408e20f1dc8c6947a4482afe346d8307102
Instruction ID: fc000f3235394a2863270d4c988953181e2e652df1d5c43234967270b233dd50
Opcode Fuzzy Hash: 4a26028100cf0ca1eb7320d9d5861408e20f1dc8c6947a4482afe346d8307102
Instruction Fuzzy Hash: 2BE08C3352102097C6211F45A904B5AB7BCAF45B26F06853BE884772A287742C428BCC

Function 00405E07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,0040318C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\yDoZVwXSMG.exe,C:\Users\user\Desktop\yDoZVwXSMG.exe,80000000,00000003), ref: 00405E0D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040318C,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\yDoZVwXSMG.exe,C:\Users\user\Desktop\yDoZVwXSMG.exe,80000000,00000003), ref: 00405E1B

Strings

C:\Users\user\Desktop, xrefs: 00405E07

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 0e813410e8fe4af35f1e42066ab3310dcd072c640338dbde9885af6b97860c84
Instruction ID: 23fada268802dc59446a59c67ae78adf9070c91ebc4bc7db9eb0e03d7b787ba1
Opcode Fuzzy Hash: 0e813410e8fe4af35f1e42066ab3310dcd072c640338dbde9885af6b97860c84
Instruction Fuzzy Hash: A3D0A772408D701EE3036310DC04B8F6B48DF16300F0900A7F1C1AA1D0C6784D424BFD

Function 00403BF6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,00425C00,NSIS Error), ref: 004062DA

Part of subcall function 00405DC0: lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,004036D4,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00405DC6
Part of subcall function 00405DC0: CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,004036D4,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,?,00403875), ref: 00405DCF
Part of subcall function 00405DC0: lstrcatA.KERNEL32(?,0040A28C), ref: 00405DE0

lstrcatA.KERNEL32(00000000,00000000,00424780,C:\Users\user\Desktop,install.log,00403D69,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\nsfC6FF.tmp,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003), ref: 00403C11

Strings

C:\Users\user\Desktop, xrefs: 00403BFB
install.log, xrefs: 00403BF6

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: lstrcat$CharPrevlstrcpynlstrlen
String ID: C:\Users\user\Desktop$install.log
API String ID: 2126114531-2220312752
Opcode ID: 4b77a2e339eb68ff388b82575c8e29bbe101c667e65de6cbe57859233cde245b
Instruction ID: 573e70e16c7f3eccbdc253e2bea591d89099f51d3e6e710ae79217221ee15991
Opcode Fuzzy Hash: 4b77a2e339eb68ff388b82575c8e29bbe101c667e65de6cbe57859233cde245b
Instruction Fuzzy Hash: 27B00265BA075160D80436B32D5BF1E051C5C81B2C3F689BFB011710C259BCA065546D

Function 00405F19 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F20
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405F39
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405F47
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F50

Memory Dump Source

Source File: 00000000.00000002.2191013243.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2190998009.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191030062.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000040C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.0000000000424000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191048241.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2191138576.0000000000436000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_yDoZVwXSMG.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 799b41214dee5a3a207c986fb220c019988a50b8bc6b7bac04f470c9780bf706
Instruction ID: a929261b065623d84111eb1ef98f27e3caca39442dc5c5f552f944d16b5be969
Opcode Fuzzy Hash: 799b41214dee5a3a207c986fb220c019988a50b8bc6b7bac04f470c9780bf706
Instruction Fuzzy Hash: 84F0A736209D52ABC202AB355C04A6B6B94EF86315B14047EF041F2240D73A98259BBE

Analysis Process: Au_.exePID: 3776, Parent PID: 5032COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	39.4%
Signature Coverage:	2.3%
Total number of Nodes:	1420
Total number of Limit Nodes:	44

Executed Functions

Function 004036E7 Relevance: 82.6, APIs: 26, Strings: 21, Instructions: 317
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32 ref: 0040370D
GetVersion.KERNEL32 ref: 00403713
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040373C
#17.COMCTL32(0000000B,0000000D), ref: 0040375D
OleInitialize.OLE32(00000000), ref: 00403764
SHGetFileInfoA.SHELL32(00420D98,00000000,?,00000160,00000000), ref: 00403780
GetCommandLineA.KERNEL32(LogicLinx 3.31 Uninstall,NSIS Error), ref: 00403795
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,00000000), ref: 004037A8
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,0040A7B0), ref: 004037D3
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040386A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040387F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040388B
DeleteFileA.KERNEL32(1033), ref: 004038A2

Part of subcall function 0040680A: GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
Part of subcall function 0040680A: GetProcAddress.KERNEL32(00000000,?), ref: 00406837

OleUninitialize.OLE32(00000020), ref: 0040392A
ExitProcess.KERNEL32 ref: 0040394A
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,00000000,00000020), ref: 0040395D
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A82C,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,00000000,00000020), ref: 0040396C
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,00000000,00000020), ref: 00403977
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\~nsuA.tmp), ref: 00403983
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040399F
DeleteFileA.KERNEL32(00420998,00420998,?,00427000,?), ref: 004039E9
CopyFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,00420998,00000001), ref: 004039FD
CloseHandle.KERNEL32(00000000,00420998,00420998,?,00420998,00000000), ref: 00403A2A
GetCurrentProcess.KERNEL32(00000028,?,00000007,00000006,00000005), ref: 00403A83
ExitWindowsEx.USER32(00000002,80040002), ref: 00403ADB
ExitProcess.KERNEL32 ref: 00403AFE

Strings

1033, xrefs: 0040389D
/D=, xrefs: 0040382D
~nsu, xrefs: 00403955
\Temp, xrefs: 00403885
", xrefs: 004037F5
NCRC, xrefs: 00403815
C:\Users\user\Desktop\, xrefs: 00403855, 004038F5, 004039A5, 004039AE
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe, xrefs: 004039F8
.tmp, xrefs: 00403971
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004036FC
NSIS Error, xrefs: 00403786
, xrefs: 00403708
C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 0040397C, 00403981, 004039AD
SeShutdownPrivilege, xrefs: 00403A95
C:\Users\user\AppData\Local\Temp\, xrefs: 0040385F, 00403864, 0040387E, 0040388A, 0040395A, 0040396B, 00403976, 00403982, 0040398F, 0040399E, 00403A3E
LogicLinx 3.31 Uninstall, xrefs: 0040378B
_?=, xrefs: 004038CC
Error launching installer, xrefs: 004038DB
UXTHEME, xrefs: 00403730, 00403735, 0040373B
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 0040379B, 004037A1, 004038C2
C:\Users\user\Desktop\, xrefs: 00403900

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Filelstrcat$ExitHandleProcess$CurrentDeleteDirectoryModuleWindows$AddressCharCloseCommandCopyErrorInfoInitializeLineModeNextPathProcTempUninitializeVersionlstrcmpilstrlen
String ID: $ /D=$ _?=$"$"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe$C:\Users\user\Desktop\$C:\Users\user\Desktop\$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$LogicLinx 3.31 Uninstall$NCRC$NSIS Error$SeShutdownPrivilege$UXTHEME$\Temp$~nsu
API String ID: 3469842172-2379017375
Opcode ID: 2d1a2868c3e38152bc4e16b98a2c1fc03756dbe8ed38c61e5e719d0c04cd0c3d
Instruction ID: 5ceea3819846a486be4215ca695653b375cf8776205228b8cf71ce6426392153
Opcode Fuzzy Hash: 2d1a2868c3e38152bc4e16b98a2c1fc03756dbe8ed38c61e5e719d0c04cd0c3d
Instruction Fuzzy Hash: 69B1B271604340ABD7207F619D4AB2B7EACAF4170AF05447FF182B61D2CB7C89458B6E

Function 03A11410 Relevance: 66.7, APIs: 5, Strings: 33, Instructions: 236
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03A113F3: GetPrivateProfileIntA.KERNEL32(?,?,03A11467,NumFields), ref: 03A11407

wsprintfA.USER32 ref: 03A1152C
lstrcpyA.KERNEL32(00000000,All Files|*.*,00000002,ListItems,All Files|*.*,State,03A14098,All Files|*.*,Flags,03A14098,All Files|*.*,03A14008,All Files|*.*,TYPE,CancelButtonText,Title), ref: 03A115AF
GetPrivateProfileStringA.KERNEL32(03A16664,Filter,All Files|*.*,All Files|*.*,00002000,00000000), ref: 03A1161E
lstrcpyA.KERNEL32(00000000,All Files|*.*,-00000002), ref: 03A11638

Part of subcall function 03A11000: GlobalAlloc.KERNEL32(00000040,?,03A11030,00000001), ref: 03A11006

Strings

RIGHT, xrefs: 03A11675
..., xrefs: 03A116DE
All Files|*.*, xrefs: 03A1160F
Field %d, xrefs: 03A1151C
Settings, xrefs: 03A11413
Title, xrefs: 03A1141E
Filter, xrefs: 03A11614
CancelEnabled, xrefs: 03A1148E
BackEnabled, xrefs: 03A1147D
NumFields, xrefs: 03A1145D
LEFT, xrefs: 03A1165C
All Files|*.*, xrefs: 03A11504, 03A11545, 03A11560, 03A11574, 03A11588, 03A115AA, 03A1160E, 03A11633
TYPE, xrefs: 03A1153B
TEXT, xrefs: 03A115C4
HWND, xrefs: 03A11525
HWND2, xrefs: 03A11730
T, xrefs: 03A11745
ROOT, xrefs: 03A115E3
RTL, xrefs: 03A114AF
TxtColor, xrefs: 03A116B1
BackButtonText, xrefs: 03A11446
State, xrefs: 03A1157E
ListItems, xrefs: 03A1158E
MinLen, xrefs: 03A11691
MaxLen, xrefs: 03A1169F
NextButtonText, xrefs: 03A11437
ValidateText, xrefs: 03A115ED
CancelButtonText, xrefs: 03A11428
BOTTOM, xrefs: 03A11683
TOP, xrefs: 03A11667
Rect, xrefs: 03A1146C
Flags, xrefs: 03A11567
CancelShow, xrefs: 03A1149F

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: PrivateProfilelstrcpy$AllocGlobalStringwsprintf
String ID: ...$All Files|*.*$All Files|*.*$BOTTOM$BackButtonText$BackEnabled$CancelButtonText$CancelEnabled$CancelShow$Field %d$Filter$Flags$HWND$HWND2$LEFT$ListItems$MaxLen$MinLen$NextButtonText$NumFields$RIGHT$ROOT$RTL$Rect$Settings$State$T$TEXT$TOP$TYPE$Title$TxtColor$ValidateText
API String ID: 3510956051-2700349506
Opcode ID: 51095f3c621e1cf30d2a4e8b707c687bb94b1ec1f75fa15319709b439dcaa0b4
Instruction ID: d05ba7c5c94278219a0fbd4f19fe786ca21b9b160e7f4e3b31196a6dfc2a1a59
Opcode Fuzzy Hash: 51095f3c621e1cf30d2a4e8b707c687bb94b1ec1f75fa15319709b439dcaa0b4
Instruction Fuzzy Hash: 47919DB8904702AFC760EF6EDA4490ABBF4FB49710700091FE5A5DBB49EB78E425CB51

Function 00405B99 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 184
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405BB7
lstrcatA.KERNEL32(00422DE0,\*.*,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405C01
lstrcatA.KERNEL32(?,0040A28C,?,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405C22
lstrlenA.KERNEL32(?,?,0040A28C,?,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405C28
FindFirstFileA.KERNEL32(00422DE0,?,?,?,0040A28C,?,00422DE0,?,00000000,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405C39
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405D18
FindClose.KERNEL32(?), ref: 00405D29

Strings

RMDir: RemoveDirectory("%s"), xrefs: 00405D6B
-B, xrefs: 00405BEB
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BA3
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00405D47
Delete: DeleteFile on Reboot("%s"), xrefs: 00405CD5
RMDir: RemoveDirectory failed("%s"), xrefs: 00405DAC
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 00405B99
\*.*, xrefs: 00405BFB
Delete: DeleteFile failed("%s"), xrefs: 00405CF3
Delete: DeleteFile("%s"), xrefs: 00405CB1
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00405D8F

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $C:\Users\user\AppData\Local\Temp\$Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*$-B
API String ID: 2035342205-1903259898
Opcode ID: e8b37471e32341b68081867d0c9733b86c99145f8e8a5da0c5cf008019d44974
Instruction ID: 9491e254326f547fd3688dea50c8b6e7d0e4d1d5e1860c78739179a064ac5d31
Opcode Fuzzy Hash: e8b37471e32341b68081867d0c9733b86c99145f8e8a5da0c5cf008019d44974
Instruction Fuzzy Hash: DE51E330508B4469EB216B219D4ABBF3B69CF42728F24803FF842751D2DB7C5981CE6E

Function 00406775 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,00423E28,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00405EE4,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00406780
FindClose.KERNEL32(00000000), ref: 0040678C

Strings

(>B, xrefs: 00406776
C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 00406775

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: (>B$C:\Users\user\AppData\Local\Temp\nslC943.tmp
API String ID: 2295610775-1330780697
Opcode ID: 831b1997f9f916c35f8a1434769a77bffab4373bf7aed33ff049e2637960da6e
Instruction ID: b63e9011ec8c2b29868c80016797e029c48760d48fef13a3cdc6f45c5aca086a
Opcode Fuzzy Hash: 831b1997f9f916c35f8a1434769a77bffab4373bf7aed33ff049e2637960da6e
Instruction Fuzzy Hash: 31D012315141306BC6505F386E0C84B7AD89F593363628B36F46AF61E0CB388C6286A9

Function 00406AB6 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8c0cb152ca077a17e7f7cfd6049439835df5b56467184ace3d81a746cc5e8b0
Instruction ID: 2a9aa8917219c7ba8d85c1882f41a63cf1be2f3d7e8fd7c71b64c591a4991728
Opcode Fuzzy Hash: f8c0cb152ca077a17e7f7cfd6049439835df5b56467184ace3d81a746cc5e8b0
Instruction Fuzzy Hash: D5F16771D04229CBDF28CFA8C8946ADBBB0FF44305F15816ED856BB281D7386A86DF45

Function 03A11E2F Relevance: 107.5, APIs: 51, Strings: 10, Instructions: 714COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 03A11EB0

Part of subcall function 03A12ABB: lstrcpyA.KERNEL32(?,?,?,03A12720,00000000), ref: 03A12ADA
Part of subcall function 03A12ABB: GlobalFree.KERNEL32 ref: 03A12AEA

Strings

`#v, xrefs: 03A122D2
, xrefs: 03A12627
, xrefs: 03A12337
error finding mainwnd, xrefs: 03A11E5C
D, xrefs: 03A12140
(, xrefs: 03A1234F
Field %d, xrefs: 03A121EE
error finding childwnd, xrefs: 03A11EBF
error creating dialog, xrefs: 03A1270C
error finding config, xrefs: 03A12720

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: FreeGlobalItemlstrcpy
String ID: $ $($D$Field %d$`#v$error creating dialog$error finding childwnd$error finding config$error finding mainwnd
API String ID: 962754457-681165833
Opcode ID: dfd4174c2dae0a0198f5f24c6bd80b90a89f6baadf85558fbfb21aa521058c35
Instruction ID: 46ebe51d598b896251e3883bd364cbc682eefb18f651e5e10d68bea27ac984e5
Opcode Fuzzy Hash: dfd4174c2dae0a0198f5f24c6bd80b90a89f6baadf85558fbfb21aa521058c35
Instruction Fuzzy Hash: EE52DF75D00218AFDF21DFA4DD84BAEBBB9FF09310F14495AE914EA2A8D774C961CB10

Function 00403FCD Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00404009
ShowWindow.USER32(?), ref: 00404026
DestroyWindow.USER32 ref: 0040403A
SetWindowLongA.USER32(?,00000000,00000000), ref: 00404056
GetDlgItem.USER32(?,?), ref: 00404077
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 0040408B
IsWindowEnabled.USER32(00000000), ref: 00404092
GetDlgItem.USER32(?,00000001), ref: 00404140
GetDlgItem.USER32(?,00000002), ref: 0040414A
SetClassLongA.USER32(?,000000F2,?), ref: 00404164
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 004041B5
GetDlgItem.USER32(?,00000003), ref: 0040425B
ShowWindow.USER32(00000000,?), ref: 0040427C
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040428E
EnableWindow.USER32(?,?), ref: 004042A9
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042BF
EnableMenuItem.USER32(00000000), ref: 004042C6
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 004042DE
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 004042F1
lstrlenA.KERNEL32(00421DD8,?,00421DD8,LogicLinx 3.31 Uninstall), ref: 0040431A
SetWindowTextA.USER32(?,00421DD8), ref: 00404329
ShowWindow.USER32(?,0000000A), ref: 0040445D

Strings

LogicLinx 3.31 Uninstall, xrefs: 0040430B

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: LogicLinx 3.31 Uninstall
API String ID: 3282139019-2177277121
Opcode ID: 0248ba45e7b493aff9bc460956d3901db11cdf52f63362b6396d5a0f8d5974e5
Instruction ID: e8b814be20905fb269ae5e5496c6b8f26aecf55a6b1e554940ad996ba5c5a090
Opcode Fuzzy Hash: 0248ba45e7b493aff9bc460956d3901db11cdf52f63362b6396d5a0f8d5974e5
Instruction Fuzzy Hash: 2CC1C3B1600704AFCB206F61EE45E2B3AA8FB94749F50453EF781B51F1CB3968529B1E

Function 00401434 Relevance: 56.4, APIs: 13, Strings: 19, Instructions: 371
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 004014D5
Sleep.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00401541
SetForegroundWindow.USER32(?), ref: 0040155A
ShowWindow.USER32(00000000), ref: 004015E1
ShowWindow.USER32(00000000), ref: 004015F5
SetFileAttributesA.KERNEL32(00000000,?,?,000000F0), ref: 0040161A
SetCurrentDirectoryA.KERNEL32(00000000,C:\Users\user\Desktop\,00000000,000000E6,00000000,?,?,000000F0,?,000000F0), ref: 00401706
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 00401714
MoveFileA.KERNEL32(00000000,?), ref: 004017A6
GetFullPathNameA.KERNEL32(00000000,00000400,00000000,?,00000000,000000E3,?,00000000,00000000,00000000,0000005C,00000000,?,?,000000F0), ref: 00401806
GetShortPathNameA.KERNEL32(00000000,00000000,00000400), ref: 0040184C
SearchPathA.KERNEL32(00000000,00000000,00000000,00000400,00000000,?,000000FF,?,00000000,00000000,00000000,0000005C,00000000,?,?,000000F0), ref: 0040186B

Strings

Rename failed: %s, xrefs: 004017E9
Aborting: "%s", xrefs: 004014AB
Jump: %d, xrefs: 00401490
BringToFront, xrefs: 0040154C
Call: %d, xrefs: 004014EA
CreateDirectory: can't create "%s" (err=%d), xrefs: 004016A6
Rename: %s, xrefs: 00401796
SetCurrentDirectory(%s) failed (%d), xrefs: 0040171C
Sleep(%d), xrefs: 0040152C
IfFileExists: file "%s" exists, jumping %d, xrefs: 0040174E
detailprint: %s, xrefs: 00401509
CreateDirectory: "%s" created, xrefs: 004016D4
CreateDirectory: can't create "%s" - a file already exists, xrefs: 004016C4
C:\Users\user\Desktop\, xrefs: 004016FB
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 00401764
CreateDirectory: "%s" (%d), xrefs: 0040164B
SetFileAttributes failed., xrefs: 0040162F
SetFileAttributes: "%s":%08X, xrefs: 00401609
Rename on reboot: %s, xrefs: 004017D7

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: PathWindow$FileNameShow$AttributesCurrentDirectoryErrorForegroundFullLastMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$C:\Users\user\Desktop\$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetCurrentDirectory(%s) failed (%d)$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 1463463071-1213553954
Opcode ID: 4ea7baa423deea346482f081290d896363ffcc99c378c9c5ed3661cfa77155d3
Instruction ID: cd94397812fa9254d581f5ff6aeb3ca49ce95be99e6962c7f7d93c7b36d86e40
Opcode Fuzzy Hash: 4ea7baa423deea346482f081290d896363ffcc99c378c9c5ed3661cfa77155d3
Instruction Fuzzy Hash: CBB11671904200BFDB146BA1DD4AEAF36B8AF08318B25053FF841B72D1DBBD5D418A6E

Function 00403C17 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 221
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040680A: GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
Part of subcall function 0040680A: GetProcAddress.KERNEL32(00000000,?), ref: 00406837

lstrcatA.KERNEL32(1033,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003,C:\Users\user\AppData\Local\Temp\,?,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,00000000), ref: 00403C88
lstrlenA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,?,?,?,LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,00000000,C:\Users\user\Desktop\,1033,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003,C:\Users\user\AppData\Local\Temp\), ref: 00403CFD
lstrcmpiA.KERNEL32(?,.exe), ref: 00403D10
GetFileAttributesA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.), ref: 00403D1B
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\Desktop\), ref: 00403D84

Part of subcall function 0040622B: wsprintfA.USER32 ref: 00406238

RegisterClassA.USER32 ref: 00403DCB
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 00403DE3
CreateWindowExA.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E1C
ShowWindow.USER32(00000005,00000000), ref: 00403E52
GetClassInfoA.USER32(00000000,RichEdit20A,00425BA0), ref: 00403E7E
GetClassInfoA.USER32(00000000,RichEdit,00425BA0), ref: 00403E8B
RegisterClassA.USER32(00425BA0), ref: 00403E94
DialogBoxParamA.USER32(?,00000000,00403FCD,00000000), ref: 00403EB3

Strings

1033, xrefs: 00403C37, 00403C83
C:\Users\user\Desktop\, xrefs: 00403C97, 00403C9F, 00403D37, 00403D3D, 00403D4D
RichEdit20A, xrefs: 00403E76, 00403E7C
_Nb, xrefs: 00403DDA, 00403DDF
RichEdit, xrefs: 00403E85
Control Panel\Desktop\ResourceLocale, xrefs: 00403C4B
.DEFAULT\Control Panel\International, xrefs: 00403C73
LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation., xrefs: 00403CCB, 00403CD3, 00403CE0, 00403D2A, 00403D30
RichEd20, xrefs: 00403E58
RichEd32, xrefs: 00403E66
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C23
.exe, xrefs: 00403D0A
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 00403C1B

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop\$Control Panel\Desktop\ResourceLocale$LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-1783688793
Opcode ID: 05311a38aaea39ea47b31c922d26c1672691d2af13fd95cb2cc0faeab00d08b8
Instruction ID: 7568602f95d19c6b689a3b08b652a15b96228f33c85fe1690cd6c01ac20bc482
Opcode Fuzzy Hash: 05311a38aaea39ea47b31c922d26c1672691d2af13fd95cb2cc0faeab00d08b8
Instruction Fuzzy Hash: 0661B6702406406ED720BF659D45F3B3E6CEB4074AF85053FF981B62E2DB7CA9428A6D

Function 03A110DC Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 225
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03A11000: GlobalAlloc.KERNEL32(00000040,?,03A11030,00000001), ref: 03A11006

lstrlenA.KERNEL32(?,00002000), ref: 03A1115C
SendMessageA.USER32(?,0000018B,00000000,00000000), ref: 03A111A2
SendMessageA.USER32(?,00000187,00000000,00000000), ref: 03A111B8
lstrcatA.KERNEL32(00000000,03A144B8,?,00000187,00000000,00000000,?,0000018B,00000000,00000000,00002000), ref: 03A111CC
SendMessageA.USER32(?,00000189,00000000,00002000), ref: 03A111DD
lstrcatA.KERNEL32(00000000,00002000,?,00000189,00000000,00002000,?,00000187,00000000,00000000,?,0000018B,00000000,00000000,00002000), ref: 03A111E7
SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 03A11207
GetWindowTextA.USER32(00001FFF,00000001,00001FFF), ref: 03A1123A
CharNextA.USER32(00000000,00002000), ref: 03A1128F
lstrcpynA.KERNEL32(00000000,00000000,00000000), ref: 03A1129F
CharNextA.USER32(00000000,00002000), ref: 03A112BC
CharNextA.USER32(00000001), ref: 03A112C5
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 03A112EA
wsprintfA.USER32 ref: 03A112FC
wsprintfA.USER32 ref: 03A11314
WritePrivateProfileStringA.KERNEL32(03A16648,State,00000000), ref: 03A1132A
wsprintfA.USER32 ref: 03A11372
WritePrivateProfileStringA.KERNEL32(Settings,State,00000000), ref: 03A1138C

Strings

State, xrefs: 03A11324, 03A11382
T, xrefs: 03A1134D
Field %d, xrefs: 03A1130E
Settings, xrefs: 03A11387

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: MessageSend$CharNextwsprintf$PrivateProfileStringWritelstrcat$AllocGlobalTextWindowlstrcpynlstrlen
String ID: Field %d$Settings$State$T
API String ID: 1338839387-1936150994
Opcode ID: e4a1869b80794b52f886fac9510a855e7beef05e6e2245054ef6a093329c8fd4
Instruction ID: 5764951b533ca159595e5deff51a048ce18d33df3ac03906c0f6db5654fbb2f5
Opcode Fuzzy Hash: e4a1869b80794b52f886fac9510a855e7beef05e6e2245054ef6a093329c8fd4
Instruction Fuzzy Hash: CE712134504342BFCB51EF24D948A2FBBE9FF45740F08442EFA82DA246E774852687A2

Function 1000116D Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 135
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 100013A6: lstrcpyA.KERNEL32(?,?,https://www.gegridsolutions.com/multilin/,100011A2,https://www.gegridsolutions.com/multilin/), ref: 100013BE
Part of subcall function 100013A6: GlobalFree.KERNEL32(https://www.gegridsolutions.com/multilin/), ref: 100013CF

GetDlgItem.USER32(?,00000404), ref: 10001210
GetWindowLongA.USER32(00000000,000000F0), ref: 10001221
SetWindowLongA.USER32(00000000,000000F0,00000000), ref: 1000122E
SetPropA.USER32(00000000,_Plugin_Static_Hyperlink_,00000001), ref: 1000123C
SendMessageA.USER32(00000000,00000031,00000000,00000000), ref: 1000124D
GetObjectA.GDI32(00000000,0000003C,?), ref: 1000125B
CreateFontIndirectA.GDI32(?), ref: 10001269
SendMessageA.USER32(00000000,00000030,00000000,00000000), ref: 10001279
LoadImageA.USER32(00000000,00007F89,00000002,00000000,00000000,00008040), ref: 10001290
LoadImageA.USER32(00000000,00007F00,00000002,00000000,00000000,00008040), ref: 100012AA
EnableWindow.USER32(00000000,00000001), ref: 100012B4
SetWindowLongA.USER32(000000FC,10001000), ref: 100012CD
SetWindowLongA.USER32(00000000,000000FC,10001097), ref: 100012DC
RedrawWindow.USER32(00000000,00000000,00000000,00000105), ref: 100012EB

Strings

^s, xrefs: 100012EB
_Plugin_Static_Hyperlink_, xrefs: 10001236
https://www.gegridsolutions.com/multilin/, xrefs: 1000118C, 10001191, 100011A4, 100011B1, 100011BB, 100011C1, 100011CE, 100011D8, 100011DE, 100011ED, 10001216

Memory Dump Source

Source File: 00000002.00000002.3440554333.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3440542193.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440566258.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440578387.0000000010003000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440590369.0000000010004000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Au_.jbxd

Similarity

API ID: Window$Long$ImageLoadMessageSend$CreateEnableFontFreeGlobalIndirectItemObjectPropRedrawlstrcpy
String ID: _Plugin_Static_Hyperlink_$https://www.gegridsolutions.com/multilin/$^s
API String ID: 3906149694-822001222
Opcode ID: 8b0eb765e6e48039e4865cb80709fa49e1116976669fe2920b5731e1ce855353
Instruction ID: ca8671abe9f8f2495f193ae5b887a50235a0880a62267edce4059e6dc7c109c0
Opcode Fuzzy Hash: 8b0eb765e6e48039e4865cb80709fa49e1116976669fe2920b5731e1ce855353
Instruction Fuzzy Hash: A541B3B0905264BFF716DF658CD5FEB7BACEB097D0F00811AFA04A61A9CB745900CB64

Function 00401899 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 189
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

lstrcatA.KERNEL32(00000000,00000000,show,C:\Users\user\Desktop\,00000000,00000000), ref: 004018F0
CompareFileTime.KERNEL32(-00000014,?,show,show,00000000,00000000,show,C:\Users\user\Desktop\,00000000,00000000), ref: 0040191A

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,LogicLinx 3.31 Uninstall,NSIS Error), ref: 004062DA

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Strings

show, xrefs: 004018CD, 004018D6, 004018E3, 004018F5, 00401906, 0040193C, 00401952, 00401969, 00401981, 004019D8, 004019FA, 00401A40, 00401A85, 00401A8E, 00401A98, 00401A9E, 00401AB0
File: skipped: "%s" (overwriteflag=%d), xrefs: 004019FB
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 004018B3
File: error, user abort, xrefs: 004019CD
C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 004018FB, 0040197B, 00401999
C:\Users\user\Desktop\, xrefs: 004018DE
C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll, xrefs: 0040198F, 004019AB
File: wrote %d to "%s", xrefs: 00401A42
File: error, user cancel, xrefs: 00401A05
File: error, user retry, xrefs: 004019BA
File: error creating "%s", xrefs: 0040196A

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: C:\Users\user\AppData\Local\Temp\nslC943.tmp$C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll$C:\Users\user\Desktop\$File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$show
API String ID: 4286501637-1684548421
Opcode ID: 0724c35fb236221f4b574d59a3aecd957e911db8adaeec6d51cd7d9740fba54e
Instruction ID: 17351c833ff884be99ebbe4ca3dd04e93fba0c18e006415c8e205a2e39f5817b
Opcode Fuzzy Hash: 0724c35fb236221f4b574d59a3aecd957e911db8adaeec6d51cd7d9740fba54e
Instruction Fuzzy Hash: A251E871A14214BACF107BB5DC4AEAF3668DF05339B21423FF416B11E1DB7C49518A6E

Function 03A12732 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 122
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongA.USER32(00000004,Function_000019E7), ref: 03A1274C
SendMessageA.USER32(0000040D,00000000), ref: 03A12767
ShowWindow.USER32(00000008,0000040D,00000000), ref: 03A1277A
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 03A12796
IsDialogMessageA.USER32(?), ref: 03A127A7
IsDialogMessageA.USER32(?), ref: 03A127B8
TranslateMessage.USER32(?), ref: 03A127C3
DispatchMessageA.USER32(?), ref: 03A127CE
SetWindowLongA.USER32(00000004), ref: 03A127F7
DestroyWindow.USER32 ref: 03A127FF
ShowWindow.USER32(?), ref: 03A12821
DeleteObject.GDI32(?), ref: 03A12890
DestroyIcon.USER32(?,76937CE0), ref: 03A1289F

Strings

cancel, xrefs: 03A128BE
success, xrefs: 03A128D2
back, xrefs: 03A128CB, 03A128D7

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: MessageWindow$DestroyDialogLongShow$CallbackDeleteDispatchDispatcherIconObjectSendTranslateUser
String ID: back$cancel$success
API String ID: 90777642-2779835836
Opcode ID: a25e9aab8da46ee1436dea23841e526380fbbcc59830500a6ff8d176c5a64ab9
Instruction ID: c0ad0f0a4cd5099680cae0bb959f5d118ee94814f338f9b7e2409e8b031b8312
Opcode Fuzzy Hash: a25e9aab8da46ee1436dea23841e526380fbbcc59830500a6ff8d176c5a64ab9
Instruction Fuzzy Hash: 5941C136500349EFCB20FF65ED449167BBAFB46781B04092AFA51D6178C732D86ADF21

Function 00403120 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403134
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,00000400), ref: 00403150

Part of subcall function 00405FA4: GetFileAttributesA.KERNEL32(00000003,00403163,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,80000000,00000003), ref: 00405FA8
Part of subcall function 00405FA4: CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405FCA

GetFileSize.KERNEL32(00000000,00000000,0042E000,00000000,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,80000000,00000003), ref: 00403199
GlobalAlloc.KERNEL32(00000040,?), ref: 004032E0

Strings

Inst, xrefs: 00403207
soft, xrefs: 00403210
C:\Users\user\AppData\Local\Temp\, xrefs: 0040312D, 004032F8
Null, xrefs: 00403219
C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe, xrefs: 0040313A, 00403149, 0040315D, 0040317A
Error launching installer, xrefs: 00403170
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00403377
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 00403120
Error writing temporary file. Make sure your temp folder is valid., xrefs: 00403329
C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 0040317B, 00403180, 00403186

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\~nsuA.tmp$C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-3567043747
Opcode ID: 4cf895d843c1e51e5214ca8c183206d7589522ef64cf37b5abe811079b5ea464
Instruction ID: 96d146e497d990707c57d5b2e40503737fdf144c81fc00ef777e1dfa3ff37f12
Opcode Fuzzy Hash: 4cf895d843c1e51e5214ca8c183206d7589522ef64cf37b5abe811079b5ea464
Instruction Fuzzy Hash: 4661F671A00214ABDB20AF64DD85BAE7FACAB04316F61447FF940B72D1CB3C9A418B5D

Function 10001097 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 67
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCapture.USER32 ref: 100010B8
SendMessageA.USER32(?,00000030,00000000), ref: 100010CD
InvalidateRect.USER32(?,00000000,00000000), ref: 100010D8
SetCapture.USER32(?), ref: 100010DF
GetWindowRect.USER32(?,?), ref: 100010EC
ClientToScreen.USER32(?,?), ref: 10001107
PtInRect.USER32(?,?,?), ref: 10001117
SendDlgItemMessageA.USER32(?,00000030,00000000), ref: 1000112B
InvalidateRect.USER32(?,00000000,00000000), ref: 10001136
SetDlgItemTextA.USER32 ref: 1000113C
CallWindowProcA.USER32(?,00000200,?,?), ref: 10001152
SetCursor.USER32 ref: 10001161

Strings

, xrefs: 1000109D

Memory Dump Source

Source File: 00000002.00000002.3440554333.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3440542193.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440566258.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440578387.0000000010003000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440590369.0000000010004000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Au_.jbxd

Similarity

API ID: Rect$CaptureInvalidateItemMessageSendWindow$CallClientCursorProcScreenText
String ID:
API String ID: 3670556111-3916222277
Opcode ID: 8c2edf1ee4263d53ed0fbb4dc934b7f9fbb8ac039e1be9a10c550e2cb2bc73bd
Instruction ID: 3a2e42d8f5861b05cd0f484eca161aee98a157bdc6ba3a99a838d0896b5d053a
Opcode Fuzzy Hash: 8c2edf1ee4263d53ed0fbb4dc934b7f9fbb8ac039e1be9a10c550e2cb2bc73bd
Instruction Fuzzy Hash: 39210832501229FBFB16AFA0CD89BDE7BBDEF08781F108011FA01A5069C7749A55DFA5

Function 004021E9 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 84
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000001,000000F0), ref: 00402214

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

LoadLibraryExA.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402225
GetProcAddress.KERNEL32(?,?), ref: 0040223C
FreeLibrary.KERNEL32(?,?), ref: 004022BC

Strings

Error registering DLL: Could not load %s, xrefs: 004022CF
Error registering DLL: %s not found in %s, xrefs: 00402293
Error registering DLL: Could not initialize OLE, xrefs: 004022E7

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSendlstrlen$Library$AddressFreeHandleLoadModuleProcTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 3271377537-945480824
Opcode ID: 24048724a9ac06ccc5715d981e71ea74bcba6b6cb785788758c0bf0f3e52e316
Instruction ID: c758e62e292b85024776478069b6dbefcb92a1905fe08cf12c5b39257b8ea98b
Opcode Fuzzy Hash: 24048724a9ac06ccc5715d981e71ea74bcba6b6cb785788758c0bf0f3e52e316
Instruction Fuzzy Hash: C221B132904205BBCF106FA1DE49B9E7A70AF08358F60417FF410B11E0DBBD4A919A2E

Function 03A119E7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 03A11A2F
CallWindowProcA.USER32(?,?,?,?), ref: 03A11A7D
PostMessageA.USER32(00000010,00000000,00000000), ref: 03A11AB8
GetWindowTextA.USER32(?,00000400,?), ref: 03A11ADF
MessageBoxA.USER32(00000000,?,00000030), ref: 03A11AF7

Strings

x, xrefs: 03A11A9A

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: Message$Window$CallPostProcSendText
String ID: x
API String ID: 630778482-2363233923
Opcode ID: 7f1b1604d9be6b02784bffc1674ff0c521b1c4ced2b6d53bb2ffbb28b8395263
Instruction ID: ea39d0a4fd146e2bacb7fa06f63d2fa4d95fbccd28ac57debc2091fb1e81bf9c
Opcode Fuzzy Hash: 7f1b1604d9be6b02784bffc1674ff0c521b1c4ced2b6d53bb2ffbb28b8395263
Instruction Fuzzy Hash: 28318935600206EBCF21EF55EE40B69BBBAFB00755F18452EEB42A51A4C371A9A6CF50

Function 00402531 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,LogicLinx 3.31 Uninstall,NSIS Error), ref: 004062DA

WritePrivateProfileStringA.KERNEL32(?,?,?,00000000), ref: 004025AA

Strings

<RM>, xrefs: 00402536
show, xrefs: 0040258E
C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 0040254A, 00402550, 0040258C
C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll, xrefs: 00402531, 0040253B, 0040258D
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402593

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$C:\Users\user\AppData\Local\Temp\nslC943.tmp$C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll$WriteINIStr: wrote [%s] %s=%s in %s$show
API String ID: 247603264-2381417605
Opcode ID: 761816c344bc7c14fad519cf076e7676c334ba530189723ea92024271b26ca30
Instruction ID: 330d2e4d02b989cca60e921ba8ea68942becdf5f63010b794772c6dbbebc1385
Opcode Fuzzy Hash: 761816c344bc7c14fad519cf076e7676c334ba530189723ea92024271b26ca30
Instruction Fuzzy Hash: B6012C71D40259BACF04BFA18E499AF7974AF44354F10443FB515761C2C7BC0A50CBAD

Function 0040679C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004067B3
wsprintfA.USER32 ref: 004067EC
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 00406800

Strings

%s%s.dll, xrefs: 004067E6
\, xrefs: 004067C4
UXTHEME, xrefs: 004067A5

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 47418d738528084b0ee49106b6891bde69050c906b93663faea48a45202ea939
Instruction ID: 1df609921a5ab3350e05677d7081392002f03ef46e330c3fe87cf6dcec657825
Opcode Fuzzy Hash: 47418d738528084b0ee49106b6891bde69050c906b93663faea48a45202ea939
Instruction Fuzzy Hash: 9EF0F6305002196BEB159B64DD0DFEB376CEB08309F14047FA686F21C1EA78D9398B59

Function 00405FD3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405FE6
GetTempFileNameA.KERNEL32(?,0061736E,00000000,?), ref: 00406000

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405FD6, 00405FDA
nsa, xrefs: 00405FDF
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 00405FD3

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4273898395
Opcode ID: 1ccc6076cc6f692e90f1f6ac9548860c4ee378c8d524266ab38a343d99036947
Instruction ID: 4ac0bde53fcefe63c64b79b14273c973a9021de8d5de8166d4f532f707e8062d
Opcode Fuzzy Hash: 1ccc6076cc6f692e90f1f6ac9548860c4ee378c8d524266ab38a343d99036947
Instruction Fuzzy Hash: 80F0A7363482487AE7108F55DC04BDB7F5DDFD1760F14C03BFA449E280D6B0999897A4

Function 004033C6 Relevance: 7.6, APIs: 5, Instructions: 109fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,?,?,00403372,000000FF,00000000,00000000,?,?), ref: 004033ED
ReadFile.KERNEL32(?,00000004,?,00000000,00000004,00000000,00000000,00000000,?,?,?,00403372,000000FF,00000000,00000000,?), ref: 0040341A
ReadFile.KERNEL32(00414980,00004000,?,00000000,?,?,00403372,000000FF,00000000,00000000,?,?), ref: 00403474
WriteFile.KERNEL32(00000000,00414980,?,000000FF,00000000,?,00403372,000000FF,00000000,00000000,?,?), ref: 0040348C

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: File$Read$PointerWrite
String ID:
API String ID: 2113905535-0
Opcode ID: 112533716f36a3d83ab0f8b5c1aa6b6122a43ce20d09c48fb3034a37057bef72
Instruction ID: fa80a256ba8ad7dbbe951804ed4cdf19961f9577527713a1418254d24a88ff6f
Opcode Fuzzy Hash: 112533716f36a3d83ab0f8b5c1aa6b6122a43ce20d09c48fb3034a37057bef72
Instruction Fuzzy Hash: D0314831500209EBCB22CF95DE80AAE7FBCEB41365B24403AF504AA190D7399A90DB69

Function 00401DD4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401E34
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401E4C

Strings

!, xrefs: 00401E08

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 4dc8f70aa0e183750effb2cde1311245b6065c9c0ffff7879e43e580c0dc7d9c
Instruction ID: 183b73fb6a545bb1246e923ab68f4d664312321a500069d7f5b6b65c517e0d36
Opcode Fuzzy Hash: 4dc8f70aa0e183750effb2cde1311245b6065c9c0ffff7879e43e580c0dc7d9c
Instruction Fuzzy Hash: CC219071940149BFDF01AFB0C94AAAE7BB5EF44304F10407EFA41B61D1D7B84A41DB98

Function 004034F1 Relevance: 6.1, APIs: 4, Instructions: 108fileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403506

Part of subcall function 0040369F: SetFilePointer.KERNEL32(00000000,00000000,00000000,0040334B,?), ref: 004036AD

SetFilePointer.KERNEL32(00000000,00000000,?,00000000,?,004033FC,00000004,00000000,00000000,00000000,?,?,?,00403372,000000FF,00000000), ref: 00403539
WriteFile.KERNEL32(0040C980,0040E2C6,00000000,00000000,00414980,00004000,?,00000000,?,004033FC,00000004,00000000,00000000,00000000,?,?), ref: 004035F3
SetFilePointer.KERNEL32(0000FABE,00000000,00000000,00414980,00004000,?,00000000,?,004033FC,00000004,00000000,00000000,00000000,?,?), ref: 00403645

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: File$Pointer$CountTickWrite
String ID:
API String ID: 2146148272-0
Opcode ID: 1d643077d58e843cc00f83a3fa99e53f6c2b0296ddedef6d0ab7d02d506ede07
Instruction ID: 26932a1e78feeb0b77edab523d175b5838434cf18410dc30452224d4f843c6ae
Opcode Fuzzy Hash: 1d643077d58e843cc00f83a3fa99e53f6c2b0296ddedef6d0ab7d02d506ede07
Instruction Fuzzy Hash: EB41CFB2501205EFDB20EF28EE848263BACF785356705463FE841B32A1D7355A468F9D

Function 00405A22 Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(0000005C,00000000,00000000), ref: 00405A65
GetLastError.KERNEL32 ref: 00405A79
SetFileSecurityA.ADVAPI32(0000005C,80000007,00000001), ref: 00405A8E
GetLastError.KERNEL32 ref: 00405A98

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: b4292ae52da0fc50f84fd512a3e5f3cdca8938f352655cb7b0d8c38ac6c39cdd
Instruction ID: 8b3c49f02a17c259515d84f04faf51af5275248166455e8be91c75529944b3c1
Opcode Fuzzy Hash: b4292ae52da0fc50f84fd512a3e5f3cdca8938f352655cb7b0d8c38ac6c39cdd
Instruction Fuzzy Hash: 77010871D00619DADF009BA0D944BEFBBB8EB04344F00853AD545B6190D77896088F99

Function 00405EA1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,LogicLinx 3.31 Uninstall,NSIS Error), ref: 004062DA

Part of subcall function 00405E54: CharNextA.USER32(00405BAD,?,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000,00405EB8,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405E62
Part of subcall function 00405E54: CharNextA.USER32(00000000), ref: 00405E67
Part of subcall function 00405E54: CharNextA.USER32(00000000), ref: 00405E76

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405EF4
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405F04

Strings

C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 00405EA7, 00405EAC, 00405EB2, 00405EED, 00405EF3, 00405EFB, 00405F03

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslC943.tmp
API String ID: 3248276644-76981094
Opcode ID: dbfd0eb15a0aee7a56b9524eaabc91726594297034a6f990c90e67fba31c6c96
Instruction ID: 0a9ec8cc8701c190d5637e4eaeae3a47b1d3f29b87e2c858e077ece57a352d20
Opcode Fuzzy Hash: dbfd0eb15a0aee7a56b9524eaabc91726594297034a6f990c90e67fba31c6c96
Instruction Fuzzy Hash: 8DF0F435115D6116D622333A9C09AAF2A18CE82328716053FF8E2B22D1DB3C8B4389FD

Function 00401FBC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401FE4

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

EnableWindow.USER32(00000000,00000000), ref: 00401FEF

Strings

HideWindow, xrefs: 00401FD2

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: f0d48a8803fa8f0ca2c5ece0b97e20779280f43af8e2efb5e59398eeb2453848
Instruction ID: f9bbae7df7fa4fde6100788e383a183b323f94d17af37d41b00e3582981cb5ce
Opcode Fuzzy Hash: f0d48a8803fa8f0ca2c5ece0b97e20779280f43af8e2efb5e59398eeb2453848
Instruction Fuzzy Hash: 93E09232600201DBCB10ABF5EE4999EB2B0AF44359B60043FE441F60D2DB7D8C41D67D

Function 00406EEB Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 684942fe2b15b730065f226559e9be9e555d3a3d5e7fc0d9885530a7e2266171
Instruction ID: 8000226e84d3b017bc6d44c3bedd15163eea413bd8593d328e7b0baad47f3587
Opcode Fuzzy Hash: 684942fe2b15b730065f226559e9be9e555d3a3d5e7fc0d9885530a7e2266171
Instruction Fuzzy Hash: 58A15371E04229CBDF28CFA8C8447ADBBB1FB44305F15806ED856BB281D7786A86DF45

Function 004070EC Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bde7381304b81b3e09b27403b539467510d0fe95a90e5b4d7cfee1ed51f2236
Instruction ID: 759a5e24e10d50352dbc8de058c790801aa45a8a44818c86e8f054c705910e48
Opcode Fuzzy Hash: 6bde7381304b81b3e09b27403b539467510d0fe95a90e5b4d7cfee1ed51f2236
Instruction Fuzzy Hash: 1F913470D04229CBEF28CF98C8447ADBBB1FB44305F15816ED856BB281C778AA86DF45

Function 00406E02 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e39de615352b626232416b4053d525421749ef36ddd4b9844f136144ab3fe8ed
Instruction ID: 1b2002c04af769fb6654495406821102eaccec2ab4c63d4c1d8c12c5004552e8
Opcode Fuzzy Hash: e39de615352b626232416b4053d525421749ef36ddd4b9844f136144ab3fe8ed
Instruction Fuzzy Hash: B7815671E04228CFDF24CFA9C8447ADBBB1FB44305F25816AD856BB281C7389986DF55

Function 00406907 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509badd97ca0faa3f5d71b944ab43e2a447e2d4a76e4aeed0a6ea4a78de18d41
Instruction ID: 61fe4de2002a16c4612afb9d07323b890c67664fa2f3b9718a96419d1d375b0a
Opcode Fuzzy Hash: 509badd97ca0faa3f5d71b944ab43e2a447e2d4a76e4aeed0a6ea4a78de18d41
Instruction Fuzzy Hash: 42819971D04228DBEF24CFA9C8447ADBBB0FB44305F15816AD856BB2C1C778698ADF45

Function 00406D55 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 234d8de6b1a4825162bd56f0f275484faa6be4a536daf5717bc33d46969e13ad
Instruction ID: 41aba942b39599c1692c10913d65046045a3e4a9d9b4861b7f06a8ff37ecbfc8
Opcode Fuzzy Hash: 234d8de6b1a4825162bd56f0f275484faa6be4a536daf5717bc33d46969e13ad
Instruction Fuzzy Hash: E0713471E04228CBDF24CFA9C8447ADBBB1FB44305F15806AD856BB281D738A986DF15

Function 00406E73 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9a1c794173ec10a6f2dd2a1ae7cf519846913fbb24b072de2017ae18864e5d
Instruction ID: dbd92b475a9d0607fb1399eb60c35f34c7c8d9ad23197981acbd8ddbf59fdd3c
Opcode Fuzzy Hash: cb9a1c794173ec10a6f2dd2a1ae7cf519846913fbb24b072de2017ae18864e5d
Instruction Fuzzy Hash: AD714671E04228CBEF28CFA9C8447ADBBB1FF44305F15806AD816BB281C7389986DF55

Function 00406DBF Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f551091bef97c8d90c96c086bb2fc810a191328d3c3cc4ee86ad8ead6d95e62
Instruction ID: 13446529a524af4b77d0006a34a1fb508395f1689c279074a8e075742fa5827d
Opcode Fuzzy Hash: 5f551091bef97c8d90c96c086bb2fc810a191328d3c3cc4ee86ad8ead6d95e62
Instruction Fuzzy Hash: CB715671E04229CBEF28CF99C8447ADBBB1FF44305F15806AD856BB281C738A986DF45

Function 00404479 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000408,?,00000000,004040DB), ref: 00404497

Strings

x, xrefs: 00404479

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 612983b6fd4e749bcc0da6ef45d44fb209fd6786f015263cae2c46ce03c0a988
Instruction ID: d9b7b3ad1dfe9f77e15bdbe809bc3705bce75bff37a43b44b75ed23140966660
Opcode Fuzzy Hash: 612983b6fd4e749bcc0da6ef45d44fb209fd6786f015263cae2c46ce03c0a988
Instruction Fuzzy Hash: 30C012B1240201AECB209B00DE00F1A7A30ABA0702F12803DF390240B286301463EF1C

Function 03A113A6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetPrivateProfileStringA.KERNEL32(03A113DE,03A16810,All Files|*.*,00002000,03A113DE,?), ref: 03A113CC

Strings

All Files|*.*, xrefs: 03A113AC, 03A113B8

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: PrivateProfileString
String ID: All Files|*.*
API String ID: 1096422788-1532680088
Opcode ID: d59bd1c9f41b6467fea3bbfb9850ee891fcbd1acf369eea0f7fbbed9d47872a7
Instruction ID: d0c11f014d1499dcc6a0a03b62b5e2af4bdc6c1bc8118ee56fc4bac49535a3a3
Opcode Fuzzy Hash: d59bd1c9f41b6467fea3bbfb9850ee891fcbd1acf369eea0f7fbbed9d47872a7
Instruction Fuzzy Hash: 15C012362A6340BEDE12EB08AE0AF083A72F315B04F250011B560A10BEC2A61036DA0D

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(00000020,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7668a4d104ee1e2660c2ade1f6a10461a08722824d04ec9df0da986e75ba1465
Instruction ID: 051d78f4f0b23444636c6ddd93e04e83276043679bc5e2b6ed60bb1dfd359a8a
Opcode Fuzzy Hash: 7668a4d104ee1e2660c2ade1f6a10461a08722824d04ec9df0da986e75ba1465
Instruction Fuzzy Hash: 3701F4317242109BE7195B389D04B2A369CE710719F54423FF951FA1F1D678DC039B4C

Function 039F2C8F Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,039F19B5,00000001), ref: 039F2CA0

Part of subcall function 039F2B47: GetVersionExA.KERNEL32 ref: 039F2B66

HeapDestroy.KERNEL32 ref: 039F2CDF

Part of subcall function 039F3F3F: HeapAlloc.KERNEL32(00000000,00000140,039F2CC8,000003F8), ref: 039F3F4C

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: d00cc4959bfba22ac72c214bab8bdfea3c15f807f3022958f0b0d5a4fc032cd5
Instruction ID: 71e54c2076f44eefdab88a507c01d595cd1ca3bfb0c2f6f5de441f6098b06728
Opcode Fuzzy Hash: d00cc4959bfba22ac72c214bab8bdfea3c15f807f3022958f0b0d5a4fc032cd5
Instruction Fuzzy Hash: 78F065795683029FDF10AB31AC8576935ACEF857D2F244CA6F752CC194EB6180809712

Function 0040680A Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
GetProcAddress.KERNEL32(00000000,?), ref: 00406837

Part of subcall function 0040679C: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 004067B3
Part of subcall function 0040679C: wsprintfA.USER32 ref: 004067EC
Part of subcall function 0040679C: LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 00406800

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: b387fddabcf67a220080d0a2e2d4b4e20bddb47d888f7d8368649e6ab8387ea4
Instruction ID: 2e1db5b2244f9e248c95e3a508c771c14dc2457370c723657138356a2d20bfb7
Opcode Fuzzy Hash: b387fddabcf67a220080d0a2e2d4b4e20bddb47d888f7d8368649e6ab8387ea4
Instruction Fuzzy Hash: D0E086336052205AD6116B745D04D3772A8AED8640306483EF542F2040DB38AC32A769

Function 00402D11 Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000B,?), ref: 00402D1F
InvalidateRect.USER32(?), ref: 00402D2F

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: InvalidateMessageRectSend
String ID:
API String ID: 909852535-0
Opcode ID: 3c558f002e1f829953c4b9d9db2aa1ce726d5ef6208d2313b11a8e15a0fcc23c
Instruction ID: 7cbb0f2f2d3e60d22c3356138c9f84147da2cf220a65b694f43baffd426c5e81
Opcode Fuzzy Hash: 3c558f002e1f829953c4b9d9db2aa1ce726d5ef6208d2313b11a8e15a0fcc23c
Instruction Fuzzy Hash: 74E0B672A00105AFDB119B98EE8999E77B9EB44259B504436E111E1061D7744D51AA2C

Function 00405FA4 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000003,00403163,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,80000000,00000003), ref: 00405FA8
CreateFileA.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00405FCA

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 3674cab34e86c9bb6ed208021152f8156afda3d0a6d4448f29a7fe7eff01a41d
Instruction ID: 99f0ed0b6f71b5c4d8d0263110580a9bc7934fab7bfe8a8d35efac0e687f4850
Opcode Fuzzy Hash: 3674cab34e86c9bb6ed208021152f8156afda3d0a6d4448f29a7fe7eff01a41d
Instruction Fuzzy Hash: 92D09E31654301EFFF098F20DE1AF2E7AA2EB84B00F11952CB682941E0DA7158599B15

Function 00405F85 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,00405D7D,?,?,?), ref: 00405F89
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405F9B

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: cab7027fe2f956e0cd714395d170ca4fa9830a0a0b9133fa410bfdf6c3ed988f
Instruction ID: 1c5f7441953791c5fa01a3ea396afadd277b1a60dedbaed694642c210a643b3b
Opcode Fuzzy Hash: cab7027fe2f956e0cd714395d170ca4fa9830a0a0b9133fa410bfdf6c3ed988f
Instruction Fuzzy Hash: CEC04CB1404505AFD6015B24DF0DC1F7B66EB50321B168A39F4A9E10F0CB354CAADA19

Function 00405A9F Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(?,00000000,004036DA,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00405AA5
GetLastError.KERNEL32 ref: 00405AB3

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: c0568d1a9d7a863155f8f57caddbba729ce21e02ac4465172204c49bf694c3b9
Instruction ID: 6d60ce6c2c78029c12fb4c6437a0e11bbe6e9f07fee022c993a6326ceae282bd
Opcode Fuzzy Hash: c0568d1a9d7a863155f8f57caddbba729ce21e02ac4465172204c49bf694c3b9
Instruction Fuzzy Hash: 6FC04C30745A019AEA115B709F48B177960AB50781F15893A6146E11B1DA348455DD6D

Function 039F3047 Relevance: 1.6, APIs: 1, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,039F221D,00000000,00000000,00000000), ref: 039F312E

Part of subcall function 039F1BD4: InitializeCriticalSection.KERNEL32(00000000,00000000,039F221D,?,039F3624,00000009,00000000,00000000,00000000,039F6480,000000FF,?,039F221D,00000001,00000074), ref: 039F1C11
Part of subcall function 039F1BD4: EnterCriticalSection.KERNEL32(039F221D,039F221D,?,039F3624,00000009,00000000,00000000,00000000,039F6480,000000FF,?,039F221D,00000001,00000074), ref: 039F1C2C

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 1f8745883c4b874f68d6da99212b7efbd301401d330d6d276372d60f5e4faf6d
Instruction ID: 2a991fcb36e1a045dd0254430a305fc3f34b76127b6969b03bc6eb8022c47720
Opcode Fuzzy Hash: 1f8745883c4b874f68d6da99212b7efbd301401d330d6d276372d60f5e4faf6d
Instruction Fuzzy Hash: B821A43AA04205AFDB10FB65DC82B9EB7B8EB407A4F194516F621EF2C0D77895418B54

Function 00404897 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 004044A0: SetDlgItemTextA.USER32(?,?,00000000), ref: 004044BA

SetDlgItemTextA.USER32(?,000003E8,?), ref: 004048C8

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 261af79fab5b7dc8ce2f068e557d5768f56cb9665393e9999d5f27405f65598d
Instruction ID: a843ded51a6d09cdbb9593c4ca8cdf79baec121f013089212d5c9024a8b59cbf
Opcode Fuzzy Hash: 261af79fab5b7dc8ce2f068e557d5768f56cb9665393e9999d5f27405f65598d
Instruction Fuzzy Hash: AFE06D72110218BBCB127E05EC01E9B3BA9EB44324F408426BA08654A1C379BA209B98

Function 0040366D Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000000,00000000,00000000,00414980,0040C980,00403572,00414980,00004000,?,00000000,?,004033FC,00000004,00000000,00000000), ref: 00403684

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4ccc4bbe2abcb677344719b3a5d559962fdee24b46b0939c7a596c127dcbc5e6
Instruction ID: ffaae792c95b3e74212be0c0ac91cf90d2f7abdb703311f5376c9916736d2436
Opcode Fuzzy Hash: 4ccc4bbe2abcb677344719b3a5d559962fdee24b46b0939c7a596c127dcbc5e6
Instruction Fuzzy Hash: 46E08631150119BBDF215E51DC04E973B5CDB05365F008433F945E6250D576D6119B94

Function 004044A0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextA.USER32(?,?,00000000), ref: 004044BA

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 0174db2d486c6bfae7298393e48cda5e15ab66f8026a1248b7333c230636131e
Instruction ID: abe3e604c5d728e86064822905ceb5988e74e83f7cf7314a4c8b33ebf5fa6c64
Opcode Fuzzy Hash: 0174db2d486c6bfae7298393e48cda5e15ab66f8026a1248b7333c230636131e
Instruction Fuzzy Hash: C1C08C31108200BFD382B704CC02F0FB3E8EFA0316F00C82EB05CA00E1CA34D4208A2A

Function 004044D5 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000028,?,00000001,00404306), ref: 004044E3

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d090b695d6fb44a0cd3dacef707cbd21b2d05341d3268158e4e0eb8174100e81
Instruction ID: e8f24a2486c8cffb54426fc4b4ca7ca2a644e4b9ad51e628b7f9c73253747f55
Opcode Fuzzy Hash: d090b695d6fb44a0cd3dacef707cbd21b2d05341d3268158e4e0eb8174100e81
Instruction Fuzzy Hash: 85B09235280201AADE215B00DE09F857E62AB64701F028034B280680B2CAB200A2EB1C

Function 0040369F Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000000,00000000,00000000,0040334B,?), ref: 004036AD

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 10ef837ee4804bf9d7f3e3ca6725328f0d2a1cf4c29bc69e4f563ca935bf008a
Instruction ID: bbe28819b9c1f708c1bc01410fff550cfc21c648a57af447a5397392da283f69
Opcode Fuzzy Hash: 10ef837ee4804bf9d7f3e3ca6725328f0d2a1cf4c29bc69e4f563ca935bf008a
Instruction Fuzzy Hash: 02B01271240300BFEA128B00DF0AF057B72AB64700F108434B3C8380F08A721031DB0D

Function 03A113F3 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetPrivateProfileIntA.KERNEL32(?,?,03A11467,NumFields), ref: 03A11407

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: PrivateProfile
String ID:
API String ID: 1469295129-0
Opcode ID: fa1fae5972494f7cdc33c4511c99e42deb06b7da0d30c5bf72d02e9e9e9acdbc
Instruction ID: 8a08fcef0f5e76f68f747b7f801a8bf103b60a0399845afa0570436a10ce159f
Opcode Fuzzy Hash: fa1fae5972494f7cdc33c4511c99e42deb06b7da0d30c5bf72d02e9e9e9acdbc
Instruction Fuzzy Hash: 39C0483B005100AFCF026F80EA0480ABBB2FB99350B018408B6988003CC2328136EB01

Non-executed Functions

Function 00404E7A Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 478windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404E91
GetDlgItem.USER32(?,00000408), ref: 00404E9E
GlobalAlloc.KERNEL32(00000040,?), ref: 00404EEA
LoadBitmapA.USER32(0000006E), ref: 00404EFD
SetWindowLongA.USER32(?,000000FC,0040547B), ref: 00404F17
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404F2B
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404F3F
SendMessageA.USER32(?,00001109,00000002), ref: 00404F54
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404F60
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404F72
DeleteObject.GDI32(?), ref: 00404F77
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404FA2
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404FAE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00405043
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 0040506E
SendMessageA.USER32(?,00001100,00000000,?), ref: 00405082
GetWindowLongA.USER32(?,000000F0), ref: 004050B1
SetWindowLongA.USER32(?,000000F0,00000000), ref: 004050BF
ShowWindow.USER32(?,00000005), ref: 004050D0
SendMessageA.USER32(?,00000419,00000000,?), ref: 004051D3
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00405238
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040524D
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00405271
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00405297
ImageList_Destroy.COMCTL32(?), ref: 004052AC
GlobalFree.KERNEL32(?), ref: 004052BC
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 0040532C
SendMessageA.USER32(?,00001102,00000410,?), ref: 004053D5
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 004053E4
InvalidateRect.USER32(?,00000000,00000001), ref: 00405404
ShowWindow.USER32(?,00000000), ref: 00405452
GetDlgItem.USER32(?,000003FE), ref: 0040545D
ShowWindow.USER32(00000000), ref: 00405464

Strings

N, xrefs: 0040510E
M, xrefs: 0040502A
, xrefs: 0040543C

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: ad34ad8691b17b25a9ccd6bb964da61cb4def815d2f23b5d4b3dc1c834c130e8
Instruction ID: c6f49fae16b786c00443764c83c26e904ee8db6dc28079495487e9681e8e48f0
Opcode Fuzzy Hash: ad34ad8691b17b25a9ccd6bb964da61cb4def815d2f23b5d4b3dc1c834c130e8
Instruction Fuzzy Hash: CD029B70A00608EFDB209F55DD45AAF7BB5FB84314F10817AF611BA2E1D7798A81CF58

Function 039F4DB4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,039F2EF1,?,Microsoft Visual C++ Runtime Library,00012010,?,039F6390,?,039F63E0,?,?,?,Runtime Error!Program: ), ref: 039F4DC6
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 039F4DDE
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 039F4DEF
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 039F4DFC

Strings

GetActiveWindow, xrefs: 039F4DE9
GetLastActivePopup, xrefs: 039F4DF1
MessageBoxA, xrefs: 039F4DD8
user32.dll, xrefs: 039F4DC1

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: 61d7683526776bef657726efbb6c637817ae3e18f562229bed7dbf9cee40e86a
Instruction ID: 13f057febd5df48c8d57b39ff6e213993920ef61b79420c4ae5d570711602e5b
Opcode Fuzzy Hash: 61d7683526776bef657726efbb6c637817ae3e18f562229bed7dbf9cee40e86a
Instruction Fuzzy Hash: 32014F31708711AFC711FFBAACC0A6B7EECEAE96993080429A70DD6105DF748401CB60

Function 03A11D4E Relevance: 13.6, APIs: 9, Instructions: 79clipboardstringwindowCOMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 03A11D55
OpenClipboard.USER32(?), ref: 03A11D87
GetClipboardData.USER32(00000001), ref: 03A11D98
GlobalLock.KERNEL32(00000000), ref: 03A11DA6
lstrlenA.KERNEL32(00000000), ref: 03A11DB4
SendMessageA.USER32(?,000000C2,00000001,00000000), ref: 03A11DF4
GlobalUnlock.KERNEL32(?), ref: 03A11E03
CloseClipboard.USER32 ref: 03A11E0A

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: Clipboard$Global$CloseCtrlDataLockMessageOpenSendUnlocklstrlen
String ID:
API String ID: 639725540-0
Opcode ID: 85d45d65a31aca153514c4012ae039a2d23540a4a3481f35ec759691836e1664
Instruction ID: 4cff455d88e8ba6748f466a9a0fb62ff09988293bc1626c741ca9f7e7f9ebf04
Opcode Fuzzy Hash: 85d45d65a31aca153514c4012ae039a2d23540a4a3481f35ec759691836e1664
Instruction Fuzzy Hash: 58212939600205BBDF21EFB5DC08AAB7FAAFF44781B04412AFA46C9195DB75C9228B50

Function 00405683 Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 286windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004056E2
GetDlgItem.USER32(?,000003EE), ref: 004056F1
GetClientRect.USER32(?,?), ref: 00405749
GetSystemMetrics.USER32(00000015), ref: 00405751
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00405772
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405783
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00405796
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 004057A4
SendMessageA.USER32(?,00001024,00000000,?), ref: 004057B7
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 004057D9
ShowWindow.USER32(?,00000008), ref: 004057ED
GetDlgItem.USER32(?,000003EC), ref: 0040580E
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 0040581E
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405837
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 00405843
GetDlgItem.USER32(?,000003F8), ref: 00405700

Part of subcall function 004044D5: SendMessageA.USER32(00000028,?,00000001,00404306), ref: 004044E3

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

GetDlgItem.USER32(?,000003EC), ref: 00405860
CreateThread.KERNEL32(00000000,00000000,Function_000055FD,00000000), ref: 0040586E
CloseHandle.KERNEL32(00000000), ref: 00405875
ShowWindow.USER32(00000000), ref: 00405899
ShowWindow.USER32(00000000,00000008), ref: 0040589E
ShowWindow.USER32(00000008), ref: 004058E5
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405917
CreatePopupMenu.USER32 ref: 00405928
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 0040593D
GetWindowRect.USER32(00000000,?), ref: 00405950
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405974
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004059AF
OpenClipboard.USER32(00000000), ref: 004059BF
EmptyClipboard.USER32 ref: 004059C5
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004059CE
GlobalLock.KERNEL32(00000000), ref: 004059D8
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004059EC
GlobalUnlock.KERNEL32(00000000), ref: 00405A04
SetClipboardData.USER32(00000001,00000000), ref: 00405A0F
CloseClipboard.USER32 ref: 00405A15

Strings

New install of "%s" to "%s", xrefs: 00405735
C:\Users\user\Desktop\, xrefs: 0040571C
{, xrefs: 00405904

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlocklstrlenwvsprintf
String ID: C:\Users\user\Desktop\$New install of "%s" to "%s"${
API String ID: 430598769-1793259906
Opcode ID: 6e77eacb8004290fe6ed722c867037a8234ca31613d18bea79517b39ef928cc2
Instruction ID: 2fba88bd0456375d88f597e1db9ec2698228ff227e9935e042ad6112b8d1c173
Opcode Fuzzy Hash: 6e77eacb8004290fe6ed722c867037a8234ca31613d18bea79517b39ef928cc2
Instruction Fuzzy Hash: 3DB16AB1900608FFDB11AF60DD89EAE3F78EB04354F50803AFA45BA1A0CB755952DF68

Function 004045E8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00404673
GetDlgItem.USER32(00000000,000003E8), ref: 00404687
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004046A5
GetSysColor.USER32(?), ref: 004046B6
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004046C5
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004046D4
lstrlenA.KERNEL32(?), ref: 004046DE
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004046EC
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004046FB
GetDlgItem.USER32(?,0000040A), ref: 0040475E
SendMessageA.USER32(00000000), ref: 00404761
GetDlgItem.USER32(?,000003E8), ref: 0040478C
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004047CC
LoadCursorA.USER32(00000000,00007F02), ref: 004047DB
SetCursor.USER32(00000000), ref: 004047E4
ShellExecuteA.SHELL32(0000070B,open,00424BA0,00000000,00000000,00000001), ref: 004047F7
LoadCursorA.USER32(00000000,00007F00), ref: 00404804
SetCursor.USER32(00000000), ref: 00404807
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404833
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404847

Strings

N, xrefs: 0040477A
open, xrefs: 004047EF
LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation., xrefs: 004047B7

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.$N$open
API String ID: 3615053054-1862747438
Opcode ID: 4acb1e7f699876b9b080a19da7d3748d224994641b86eb42dea44ec3c9bac124
Instruction ID: 7ac1e07cf673726af58d7051cd64680cda6ca82f3b090425a6ea0e09ab9c8800
Opcode Fuzzy Hash: 4acb1e7f699876b9b080a19da7d3748d224994641b86eb42dea44ec3c9bac124
Instruction Fuzzy Hash: 0361C2B1A40208BFEB10AF60DD45F6A3768FB84714F10843AFB05BB1D1C7B8A951CB98

Function 004048DE Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 303stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 0040492F
IsDlgButtonChecked.USER32(?,000003F0), ref: 0040493D
GetDlgItem.USER32(?,000003FB), ref: 0040495D
GetAsyncKeyState.USER32(00000010), ref: 00404964
GetDlgItem.USER32(?,000003F0), ref: 00404973
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404984
SetWindowTextA.USER32(?,?), ref: 004049B3
SHBrowseForFolderA.SHELL32(?,004219C0,?), ref: 00404A6A
lstrcmpiA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,00421DD8), ref: 00404AA7
lstrcatA.KERNEL32(?,LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.), ref: 00404AB3
SetDlgItemTextA.USER32(?,000003FB,?), ref: 00404AC3
CoTaskMemFree.OLE32(00000000), ref: 00404A75

Part of subcall function 00405B19: GetDlgItemTextA.USER32(?,?,00000400,00404AF6), ref: 00405B2C

Part of subcall function 0040652F: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004036C2,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00406587
Part of subcall function 0040652F: CharNextA.USER32(?,?,?,00000000), ref: 00406594
Part of subcall function 0040652F: CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004036C2,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00406599
Part of subcall function 0040652F: CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004036C2,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 004065A9

Part of subcall function 00403BF6: lstrcatA.KERNEL32(00000000,00000000,00424780,C:\Users\user\Desktop\,install.log,00403D69,C:\Users\user\Desktop\,C:\Users\user\Desktop\,1033,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003), ref: 00403C11

GetDiskFreeSpaceA.KERNEL32(004215B0,?,?,0000040F,?,004215B0,004215B0,?,00000001,004215B0,?,?,000003FB,?), ref: 00404B7C
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404B97
SetDlgItemTextA.USER32(00000000,00000400,00420D98), ref: 00404C29

Part of subcall function 00404CF0: lstrlenA.KERNEL32(00421DD8,00421DD8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404C0B,000000DF,004215B0,00000400,00000000), ref: 00404D8E
Part of subcall function 00404CF0: wsprintfA.USER32 ref: 00404D96
Part of subcall function 00404CF0: SetDlgItemTextA.USER32(?,00421DD8), ref: 00404DA9

Strings

A, xrefs: 00404A63
C:\Users\user\Desktop\, xrefs: 00404A90
LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation., xrefs: 00404AA1, 00404AA6, 00404AB1

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Item$Text$Char$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTasklstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\Desktop\$LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.
API String ID: 323400435-3599253505
Opcode ID: 78c65bc590c1e235ef7a73e704ad4c428552a7094b56534d9291f6bd5556b852
Instruction ID: 53e1309a436ec8c8103ef3d9cb40cdd2e0d9dedad5aabb53aa7134592e3a1e93
Opcode Fuzzy Hash: 78c65bc590c1e235ef7a73e704ad4c428552a7094b56534d9291f6bd5556b852
Instruction Fuzzy Hash: B7B172B1A00218ABDB10AFA5CD85B9F7AB8EF84314F10843FF605B62D1D7789941CB6D

Function 03A1176B Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,?,?), ref: 03A11853
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000002,00000002,?,?,?), ref: 03A11870
SHGetDesktopFolder.SHELL32(00000045,?,?,?), ref: 03A1187A
SHBrowseForFolderA.SHELL32(?,?,?,?), ref: 03A118B6
SHGetPathFromIDListA.SHELL32(00000000,?,?,?,?), ref: 03A118CE
CoTaskMemFree.OLE32(00000000,?,?,?), ref: 03A118E8
GetWindowTextA.USER32(?,?,00000104), ref: 03A1193A
GetCurrentDirectoryA.KERNEL32(00002000,All Files|*.*,?,?,?), ref: 03A1194B
GetSaveFileNameA.COMDLG32(0000004C,?,?,?), ref: 03A1195B
GetOpenFileNameA.COMDLG32(0000004C,?,?,?), ref: 03A11963
CommDlgExtendedError.COMDLG32(?,?,?), ref: 03A11975
SetCurrentDirectoryA.KERNEL32(All Files|*.*,?,?,?,?,?), ref: 03A1199B
ShellExecuteA.SHELL32(00000000,?,00000000,00000000,0000000A), ref: 03A119B7
SendMessageA.USER32(00000408,00000001,00000000,?), ref: 03A119DB

Strings

All Files|*.*, xrefs: 03A11940, 03A11945, 03A1199A
E, xrefs: 03A1183C
L, xrefs: 03A1192D

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: CurrentDirectoryFileFolderName$BrowseByteCharCommDesktopErrorExecuteExtendedFreeFromListMessageMultiOpenPathSaveSendShellTaskTextWideWindowlstrlen
String ID: All Files|*.*$E$L
API String ID: 3574472847-3122172703
Opcode ID: 161e49557bffaf3247dfcd08f238f1e7a13874bc2a2b7f43b776749af8c1ca2c
Instruction ID: db33d7fa9ded2ebc14a875a7848a9e6c1073b6489926acecfa557e46c44f95f0
Opcode Fuzzy Hash: 161e49557bffaf3247dfcd08f238f1e7a13874bc2a2b7f43b776749af8c1ca2c
Instruction Fuzzy Hash: FB71CE75900208AFDF20DFA5C988EAEBBF8FB49304F24456EE656E7290D7309951CF21

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,LogicLinx 3.31 Uninstall,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

LogicLinx 3.31 Uninstall, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$LogicLinx 3.31 Uninstall
API String ID: 941294808-1031558758
Opcode ID: 750255ee06490405d36d6d77af7e8d62f2e9bab9d2e9b601842e2a7d5fc750e5
Instruction ID: 1a047666a44e0bd53f927bcc358f11ad8581032b766642e5cfbbeb7700f4c1b8
Opcode Fuzzy Hash: 750255ee06490405d36d6d77af7e8d62f2e9bab9d2e9b601842e2a7d5fc750e5
Instruction Fuzzy Hash: A5418B71800219AFCF058F95DE459AF7BB9FF44314F00802AF5A1AA1A1CB38EA55DFA4

Function 0040601B Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 144filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040680A: GetModuleHandleA.KERNEL32(?,?,?,00403751,0000000D), ref: 0040681C
Part of subcall function 0040680A: GetProcAddress.KERNEL32(00000000,?), ref: 00406837

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000002,?,00000000,?,?,00405DAA,?,00000000,000000F1,?), ref: 00406068
GetShortPathNameA.KERNEL32(?,00423F68,00000400), ref: 00406071
GetShortPathNameA.KERNEL32(00000000,004239E0,00000400), ref: 0040608E
wsprintfA.USER32 ref: 004060AC
GetFileSize.KERNEL32(00000000,00000000,004239E0,C0000000,00000004,004239E0,?,?,?,00000000,000000F1,?), ref: 004060E7
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 004060F6
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040610C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,004235E0,00000000,-0000000A,0040ABD4,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00406152
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00406164
GlobalFree.KERNEL32(00000000), ref: 0040616B
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00406172

Part of subcall function 00405F19: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F20
Part of subcall function 00405F19: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F50

Strings

[Rename], xrefs: 0040611C, 0040612E
%s=%s, xrefs: 004060A2
h?B, xrefs: 00406056
9B, xrefs: 00406083

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]$h?B$9B
API String ID: 3445103937-2390523675
Opcode ID: 21917f923af837da55185abc71840ce9c4339cf9359ea08ee4b8cb6fcd80affc
Instruction ID: 6fab4b1a5264387afcbcbc9c20e197d89b1de9b9f4b2b97f427ae02aeeda734e
Opcode Fuzzy Hash: 21917f923af837da55185abc71840ce9c4339cf9359ea08ee4b8cb6fcd80affc
Instruction Fuzzy Hash: 884115712007167BD7206B619E49F6B3A7CDF85755F06003AF946FA2C2EA3CD824C6AD

Function 039F11D0 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 201windowmemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 039F120A

Part of subcall function 039F1770: lstrcpyA.KERNEL32(?,?,?,039F1068,?), ref: 039F178F
Part of subcall function 039F1770: GlobalFree.KERNEL32 ref: 039F179F

FindWindowExA.USER32(?,00000000,#32770,039F9A68), ref: 039F1357
GetDlgItem.USER32(00000000,000003F8), ref: 039F1363
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 039F137B
SendMessageA.USER32 ref: 039F13AC
SendMessageA.USER32(00000000,00001013,00000000,00000000), ref: 039F13B7
FindWindowExA.USER32(?,00000000,#32770,039F9A68), ref: 039F13D6
GetDlgItem.USER32(00000000,000003EE), ref: 039F13E2
SetWindowTextA.USER32(00000000,00000000), ref: 039F13EA
GlobalFree.KERNEL32(00000000), ref: 039F13F1

Strings

#32770, xrefs: 039F134F, 039F13CE
false, xrefs: 039F12AB, 039F12E5
true, xrefs: 039F1222, 039F126B

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: GlobalMessageSendWindow$FindFreeItem$AllocTextlstrcpy
String ID: #32770$false$true
API String ID: 1355337150-3820989678
Opcode ID: 3247d3d2e338542242fb4cc9665d4bb678d6e082809c7302c72768e61bc8d4c9
Instruction ID: d03352dfb3c4f42bd6df6d3001a42a80c0d47a47931eb147cab551f4cfd2a17e
Opcode Fuzzy Hash: 3247d3d2e338542242fb4cc9665d4bb678d6e082809c7302c72768e61bc8d4c9
Instruction Fuzzy Hash: 7351C435A48340AFD3109E798C60AABBBED9F9B680F1C4954FBD5DB381E267D4088790

Function 004062EF Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00420DB0,00000000,00405563,00420DB0,00000000), ref: 00406397
GetSystemDirectoryA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,00000400), ref: 00406412
GetWindowsDirectoryA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,00000400), ref: 00406425
SHGetSpecialFolderLocation.SHELL32(?,00000000), ref: 00406461
SHGetPathFromIDListA.SHELL32(00000000,LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.), ref: 0040646F
CoTaskMemFree.OLE32(00000000), ref: 0040647A
lstrcatA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,\Microsoft\Internet Explorer\Quick Launch), ref: 0040649C
lstrlenA.KERNEL32(LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.,?,00420DB0,00000000,00405563,00420DB0,00000000), ref: 004064EE

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406496
Software\Microsoft\Windows\CurrentVersion, xrefs: 004063E1
LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation., xrefs: 00406318, 004063DF, 004063FC, 00406411, 00406424, 00406440, 0040646B, 0040649B, 004064A1, 004064B9, 004064CC, 004064E7, 004064ED, 004064F8, 00406522

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: LogicLinx 3.31 will be uninstalled from the following folder. Click Uninstall to start the uninstallation.$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1008386496
Opcode ID: e70c36c15463e11e4d98769463c39d75202b1930655f9bc1c58c23aaa8b76e0f
Instruction ID: 5020ced7e0235193b8239b63b3ec8dced8004e66b88da715bb9c8bf5f7faf145
Opcode Fuzzy Hash: e70c36c15463e11e4d98769463c39d75202b1930655f9bc1c58c23aaa8b76e0f
Instruction Fuzzy Hash: F8510530A00210AEDF216F64DD8477E3BA4AB55724F12423FE953B62D1D73D8962DB4D

Function 00402689 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 127registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004026D7
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000023,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004026FA

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000), ref: 004027B0
RegCloseKey.ADVAPI32(?), ref: 004028C3

Strings

WriteReg: error creating key "%s\%s", xrefs: 004027E3
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 00402724
C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 004026EB, 004026F9, 004026FF, 00402740, 00402768, 0040277B, 004027A5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004027C8
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402712
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402750
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 00402797

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: C:\Users\user\AppData\Local\Temp\nslC943.tmp$WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-1397765597
Opcode ID: 0157898554790d50b0bdb3d9b809ae9a58bf82a69b619a8b99a66bf8be8ddc53
Instruction ID: 0d8f67e9f840f9fb8975a9187b81f617768a5146bfc4832fe9bc88b1c5f34d6b
Opcode Fuzzy Hash: 0157898554790d50b0bdb3d9b809ae9a58bf82a69b619a8b99a66bf8be8ddc53
Instruction Fuzzy Hash: 6D415BB2D00208BFDF11AFA1CD4AE9EBB78EF04348F11407AF505761D0D7BA4A619B69

Function 00402AC2 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402B16
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 00402B32
GlobalFree.KERNEL32(?), ref: 00402B6B
WriteFile.KERNEL32(?,00000000,?,?), ref: 00402B7D
GlobalFree.KERNEL32(00000000), ref: 00402B84
CloseHandle.KERNEL32(?), ref: 00402B9C
DeleteFileA.KERNEL32(?), ref: 00402BC3

Strings

created uninstaller: %d, "%s", xrefs: 00402BA8

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: fcd8c44232e72c7a519ab1b54606f4df5990d39ba661982b9417052821f24287
Instruction ID: f039b0f35b450dc7ee41e930bae157162e8a347937c2952a3d4cbe63db110461
Opcode Fuzzy Hash: fcd8c44232e72c7a519ab1b54606f4df5990d39ba661982b9417052821f24287
Instruction Fuzzy Hash: C031BE71800128BBCF20AFA5CE49DAE7F78EF04324F10423AF914762E1DB795D419BA9

Function 10001000 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

GetPropA.USER32(?,_Plugin_Static_Hyperlink_), ref: 1000101A
CallWindowProcA.USER32(?,00000138,?,?), ref: 10001039
SetTextColor.GDI32(?), ref: 1000104A
ShellExecuteA.SHELL32(?,open,https://www.gegridsolutions.com/multilin/,00000000,00000000,00000001), ref: 10001070
CallWindowProcA.USER32(?,?,00000404,?), ref: 1000108D

Strings

open, xrefs: 10001068
_Plugin_Static_Hyperlink_, xrefs: 10001012
https://www.gegridsolutions.com/multilin/, xrefs: 10001063

Memory Dump Source

Source File: 00000002.00000002.3440554333.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000002.00000002.3440542193.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440566258.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440578387.0000000010003000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000002.00000002.3440590369.0000000010004000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10000000_Au_.jbxd

Similarity

API ID: CallProcWindow$ColorExecutePropShellText
String ID: _Plugin_Static_Hyperlink_$https://www.gegridsolutions.com/multilin/$open
API String ID: 336401315-593685993
Opcode ID: 902a60f43574fc8f765310f7a5a76097104947cc1a10f21921816571d1e45bd3
Instruction ID: 0c11c9d3a527daeec412f6f73a2044742557c87160cf49b8973faa6a56da489a
Opcode Fuzzy Hash: 902a60f43574fc8f765310f7a5a76097104947cc1a10f21921816571d1e45bd3
Instruction Fuzzy Hash: 90019732540259BBFF229F64DD99BDA7B66FB087D1F008410FB05650A9C7B299A0EB50

Function 039F1400 Relevance: 13.8, APIs: 9, Instructions: 257filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 039F1770: lstrcpyA.KERNEL32(?,?,?,039F1068,?), ref: 039F178F
Part of subcall function 039F1770: GlobalFree.KERNEL32 ref: 039F179F

CreateFileA.KERNEL32(?,00000001,00000000,00000000,00000003,00000080,00000000,00000000,00000000,?), ref: 039F159F
GetFileSize.KERNEL32(00000000,00000000), ref: 039F15DA
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 039F15F3
ReadFile.KERNEL32(00000000,00000000,00000000,00000001,00000000), ref: 039F1605
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 039F1682
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 039F16A0
WriteFile.KERNEL32(00000000,039F7048,00000002,?,00000000,?,?,00000000), ref: 039F16B6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 039F16E6
CloseHandle.KERNEL32(00000000), ref: 039F16ED

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: File$Write$FreeVirtual$AllocCloseCreateGlobalHandleReadSizelstrcpy
String ID:
API String ID: 3062248370-0
Opcode ID: e35988c3c1564eb8218af2e019a20f8efb816799c9243242145cdb71437573f2
Instruction ID: 8631f63734d77928462751e0ca11c3266448ab5ea7d1a0ec27ded7bdd1b65007
Opcode Fuzzy Hash: e35988c3c1564eb8218af2e019a20f8efb816799c9243242145cdb71437573f2
Instruction Fuzzy Hash: EF81D4756083409FC324DF249C80B6BBBD9ABC9394F2C0A1DF6999B290DB75D948CBD1

Function 039F318A Relevance: 13.7, APIs: 9, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,039F6454,00000001,00000000,00000000,7622E860,039F9DD8,?,00000003,00000000,00000001,00000000,?,?,039F51E2), ref: 039F31CC
LCMapStringA.KERNEL32(00000000,00000100,039F6450,00000001,00000000,00000000,?,?,039F51E2,?), ref: 039F31E8
LCMapStringA.KERNEL32(?,?,00000000,00000001,00000000,00000003,7622E860,039F9DD8,?,00000003,00000000,00000001,00000000,?,?,039F51E2), ref: 039F3231
MultiByteToWideChar.KERNEL32(?,039F9DD9,00000000,00000001,00000000,00000000,7622E860,039F9DD8,?,00000003,00000000,00000001,00000000,?,?,039F51E2), ref: 039F3269
MultiByteToWideChar.KERNEL32(00000001,00000001,00000000,?,?,00000000), ref: 039F32C1
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000), ref: 039F32D7
LCMapStringW.KERNEL32(?,?,?,00000000,?,?), ref: 039F330A
LCMapStringW.KERNEL32(?,?,?,?,?,00000000), ref: 039F3372

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID:
API String ID: 352835431-0
Opcode ID: 4b476631254ff97df6c5c317b2b244e701fa4f3156b6d3609afb8031a10cb541
Instruction ID: 891da9ed2cd325fe7debe22a406005e6d1bcfa2293e6c9a8acae85e12e6902c9
Opcode Fuzzy Hash: 4b476631254ff97df6c5c317b2b244e701fa4f3156b6d3609afb8031a10cb541
Instruction Fuzzy Hash: 37516C35900209FFCF22EF55CC84ADE7FB9FB89750F184119FA14A6154C77A8910DBA0

Function 039F2DCD Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,039F221D), ref: 039F2E3A
GetStdHandle.KERNEL32(000000F4,039F6390,00000000,00000000,00000000,039F221D), ref: 039F2F10
WriteFile.KERNEL32(00000000), ref: 039F2F17

Strings

Microsoft Visual C++ Runtime Library, xrefs: 039F2EE6
Runtime Error!Program: , xrefs: 039F2EA0
..., xrefs: 039F2E8C
<program name unknown>, xrefs: 039F2E4A

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 9034b3be83abd20a7facd4f6f9ad44b5ef2d6e589d7e905a50e0a4fdae734d94
Instruction ID: 33fbe98b2dd7386abd9adbb4f7ca1cc723ecf9e3b12eb131b9ddadf0bbdded27
Opcode Fuzzy Hash: 9034b3be83abd20a7facd4f6f9ad44b5ef2d6e589d7e905a50e0a4fdae734d94
Instruction Fuzzy Hash: 4B31B07AA003186FDF20EBA0CC85F9E77ADEB85340F640856F794DA140D7B4E5848B22

Function 0040652F Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004036C2,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00406587
CharNextA.USER32(?,?,?,00000000), ref: 00406594
CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" ,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004036C2,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00406599
CharPrevA.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,004036C2,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 004065A9

Strings

*?|<>/":, xrefs: 00406577
C:\Users\user\AppData\Local\Temp\, xrefs: 00406530, 00406535
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 0040656B

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1738386367
Opcode ID: 8096d849d1c9ce41e0346831cb37685f4dd6d64b26888903e7438f7d863a7a62
Instruction ID: 24dd96064d5417bc72e67d0c60cfec8ce53d8243db2d456a42809f7a95db7985
Opcode Fuzzy Hash: 8096d849d1c9ce41e0346831cb37685f4dd6d64b26888903e7438f7d863a7a62
Instruction Fuzzy Hash: 981134A180479039EB3216386C44B777F894F5B7A0F1A047BE4C2322C6DA7C5D62826D

Function 039F29E8 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,039F1A0A), ref: 039F2A03
GetEnvironmentStrings.KERNEL32(?,?,?,?,039F1A0A), ref: 039F2A17
GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,039F1A0A), ref: 039F2A43
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,?,?,?,?,?,039F1A0A), ref: 039F2A7B
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,039F1A0A), ref: 039F2A9D
FreeEnvironmentStringsW.KERNEL32(00000000,?,?,?,?,039F1A0A), ref: 039F2AB6
GetEnvironmentStrings.KERNEL32(?,?,?,?,?,?,039F1A0A), ref: 039F2AC9
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 039F2B07

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 3a7a73a17a8973559d50079f47b909aced0a657a50d04517abd0bb6b44a38174
Instruction ID: 4df64560301971457fd66f48c0241861a91e7a069d3b3608d7f786647710bcc7
Opcode Fuzzy Hash: 3a7a73a17a8973559d50079f47b909aced0a657a50d04517abd0bb6b44a38174
Instruction Fuzzy Hash: EB31F2BA5083156FE730FF795C84A3BBB9CE64A29471D0E69FBD6C3180EA21CC418361

Function 00404507 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00404524
GetSysColor.USER32(00000000), ref: 00404540
SetTextColor.GDI32(?,00000000), ref: 0040454C
SetBkMode.GDI32(?,?), ref: 00404558
GetSysColor.USER32(?), ref: 0040456B
SetBkColor.GDI32(?,?), ref: 0040457B
DeleteObject.GDI32(?), ref: 00404595
CreateBrushIndirect.GDI32(?), ref: 0040459F

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ff550e039535750ddee094f50c47ca332dcff401595c3ffc2c3d1fe0adab4e51
Instruction ID: 5129247060fdf99fe8797dcd9aa0072a42d6f3bc0e200a186bc0a46124ada848
Opcode Fuzzy Hash: ff550e039535750ddee094f50c47ca332dcff401595c3ffc2c3d1fe0adab4e51
Instruction Fuzzy Hash: 002142B1501704ABCB219F68DD08B5BBBF8AF41714F04892DFA96A26E0D738E9488B54

Function 0040552B Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: cb0f79ab979e13bb22370c5c0aa667bb76c3ef8d0eed0eb48269c6a4122cdca1
Instruction ID: b5f13368894abbd72d2ef9bcc5aed1bc168452b499d58a4623565611e2026dd0
Opcode Fuzzy Hash: cb0f79ab979e13bb22370c5c0aa667bb76c3ef8d0eed0eb48269c6a4122cdca1
Instruction Fuzzy Hash: 71218C71900118BBCF119FA5CD80ADFBFB9EF04354F04807AF944B6291C7388A419FA8

Function 00402076 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

Part of subcall function 00405AD4: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00423DE0,Error launching installer), ref: 00405AF9
Part of subcall function 00405AD4: CloseHandle.KERNEL32(?), ref: 00405B06

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 004020C6
GetExitCodeProcess.KERNEL32(?,?), ref: 004020D6
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 004020FB

Strings

Exec: command="%s", xrefs: 0040207F
Exec: failed createprocess ("%s"), xrefs: 0040210D
Exec: success ("%s"), xrefs: 004020A1

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: cca3606ec2a77bb65dba5fcbdc20c5e0c7bca9831c84fe7d89b340ff56de6e2e
Instruction ID: f192cf5068fe721493c2ca47631b8fd5e11dfa55f6fb4389df25e9f95d382c2a
Opcode Fuzzy Hash: cca3606ec2a77bb65dba5fcbdc20c5e0c7bca9831c84fe7d89b340ff56de6e2e
Instruction Fuzzy Hash: 96119031505214EADB25AF91DE899AE7B61EF01318F20403FF501750D1CBBD0991EB6E

Function 004065C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51stringfileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,?,?,00406773,00000000), ref: 004065DE
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,00424780,40000000,00000004,?,?,00406773,00000000), ref: 00406626
lstrcatA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),0040ABEC,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00406773,00000000), ref: 00406641
lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),0040ABEC,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00406773,00000000), ref: 0040664C
WriteFile.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),0040ABEC,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00406773,00000000), ref: 00406659

Strings

File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1), xrefs: 00406635, 00406636, 00406640, 0040664B, 00406652

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: File$CloseHandlePointerWritelstrcatlstrlen
String ID: File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1)
API String ID: 4073665932-1688853826
Opcode ID: 6985dbf8a51587ff873b0807ef77b93063035b7dde659fa51b5ad4c8cc64aba6
Instruction ID: 8cb7850f754a91aea35530736be2dd68b046b28bd0b92714d99c360fc914dd09
Opcode Fuzzy Hash: 6985dbf8a51587ff873b0807ef77b93063035b7dde659fa51b5ad4c8cc64aba6
Instruction Fuzzy Hash: BD019671500306ABD720AF74BD85E573A5CDB01374B52433BF172B51E0C73998A29A5E

Function 00403081 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00403099
GetTickCount.KERNEL32 ref: 004030B7
wsprintfA.USER32 ref: 004030E5

Part of subcall function 0040552B: lstrlenA.KERNEL32(00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000,?), ref: 00405564
Part of subcall function 0040552B: lstrlenA.KERNEL32(004030F8,00420DB0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,004030F8,00000000), ref: 00405574
Part of subcall function 0040552B: lstrcatA.KERNEL32(00420DB0,004030F8,004030F8,00420DB0,00000000,00000000,00000000), ref: 00405587
Part of subcall function 0040552B: SetWindowTextA.USER32(00420DB0,00420DB0), ref: 00405599
Part of subcall function 0040552B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004055BF
Part of subcall function 0040552B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004055D9
Part of subcall function 0040552B: SendMessageA.USER32(?,00001013,?,00000000), ref: 004055E7

CreateDialogParamA.USER32(0000006F,00000000,00402FE9,00000000), ref: 00403109
ShowWindow.USER32(00000000,00000005), ref: 00403117

Part of subcall function 00403065: MulDiv.KERNEL32(00010000,00000064,00004E36), ref: 0040307A

Strings

... %d%%, xrefs: 004030DF

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: ce67bc7cccbabcfd3d998f218857b4b480decfb62087f9010a91ecd6a2638fba
Instruction ID: 8a56325a0c249c51aeddb8beeb044339652cd635e3f90c4b3db5a9aada2ba764
Opcode Fuzzy Hash: ce67bc7cccbabcfd3d998f218857b4b480decfb62087f9010a91ecd6a2638fba
Instruction Fuzzy Hash: 6C01C870502624DBCB217F60BD09AAA7F6CAB05B46B04803BF441B11D5DB784A45CF9E

Function 00404DFA Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404E15
GetMessagePos.USER32 ref: 00404E1D
ScreenToClient.USER32(?,?), ref: 00404E37
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404E49
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404E6F

Strings

f, xrefs: 00404E4B

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2de7cdc7de5e6d73f2f496e999baad3857bc1053d919e802e93d4047082e1f51
Instruction ID: 577475e6f0e9fc61b494f9fa51c3945aaa03660cb513c050f00af2c753d98fa9
Opcode Fuzzy Hash: 2de7cdc7de5e6d73f2f496e999baad3857bc1053d919e802e93d4047082e1f51
Instruction Fuzzy Hash: 78015271D00219BADB00DBA4DD45FFEBBBCAF55B11F10012BBA50B61D1C7B459458B94

Function 00402FE9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00403004
wsprintfA.USER32 ref: 00403038
SetWindowTextA.USER32(?,?), ref: 00403048
SetDlgItemTextA.USER32(?,00000406,?), ref: 0040305A

Strings

verifying installer: %d%%, xrefs: 0040302D, 00403036
unpacking data: %d%%, xrefs: 00403026

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 34aea8c237d9a6b4262babc5d15cb9ea65e997ceb4a27ace1c078bd2d2e193bf
Instruction ID: 20546e6ba832e1b3fab4aa97257a5f65f69261077b3f880adcbb49229734dd85
Opcode Fuzzy Hash: 34aea8c237d9a6b4262babc5d15cb9ea65e997ceb4a27ace1c078bd2d2e193bf
Instruction Fuzzy Hash: 3AF0817050020CBBDF20AF60DD06BAE3BBCAB04345F00843AFA56B51D5DBB99A558F99

Function 039F33D9 Relevance: 9.1, APIs: 6, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,039F6454,00000001,039F701C,?,039F704C,039F701C,?,?), ref: 039F3418
GetStringTypeA.KERNEL32(00000000,00000001,039F6450,00000001,?,?,?), ref: 039F3432
GetStringTypeA.KERNEL32(039F701C,?,?,?,?,?,039F704C,039F701C,?,?), ref: 039F3466
MultiByteToWideChar.KERNEL32(?,039F704D,?,?,00000000,00000000,?,039F704C,039F701C,?,?), ref: 039F349E
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?), ref: 039F34F4
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?), ref: 039F3506

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID:
API String ID: 3852931651-0
Opcode ID: ed237b998f0ab5e46f534bc47d6fad6f9fa81bf308b08204e9c31c87edb7cc15
Instruction ID: b47a0d6ed1037aaa15c50f8f86ae18037e18154c2279d7dbc45b578f1116cf4e
Opcode Fuzzy Hash: ed237b998f0ab5e46f534bc47d6fad6f9fa81bf308b08204e9c31c87edb7cc15
Instruction Fuzzy Hash: 5141CCB6600219AFCF22EF95CC85EEE7FB9EB05790F240425FA15E6250C339C9548BA0

Function 03A11B09 Relevance: 9.1, APIs: 6, Instructions: 114windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?), ref: 03A11B49
DrawTextA.USER32(?,-03A16804,000000FF,?,00000414), ref: 03A11BB0
GetWindowLongA.USER32(?,000000EB), ref: 03A11BE4
SetTextColor.GDI32(?,?), ref: 03A11BF7
DrawTextA.USER32(?,?,000000FF,?,?), ref: 03A11C1C
DrawFocusRect.USER32(?,00000010), ref: 03A11C37

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: DrawText$ColorFocusLongMessageRectSendWindow
String ID:
API String ID: 491839470-0
Opcode ID: 88cb6f57c1afaa3477d95774c926e4640fc98f473b9c8c1c22232ffce145b155
Instruction ID: d5a3cb5f599fb8f00700b97cecd732e31734429bd926751e013e7884500e1a33
Opcode Fuzzy Hash: 88cb6f57c1afaa3477d95774c926e4640fc98f473b9c8c1c22232ffce145b155
Instruction Fuzzy Hash: E041BA3560020AAFCF05DF68CD84AAB7BB6FB05300F08455AFE10DA2A6D375D962CB50

Function 03A11C53 Relevance: 9.1, APIs: 6, Instructions: 91COMMON

Download Yara Rule

APIs

GetDlgCtrlID.USER32(?), ref: 03A11C5E
CallWindowProcA.USER32(?,?,?,?,?), ref: 03A11CC3
MapWindowPoints.USER32(00000000,?,?,00000001), ref: 03A11D00
PtInRect.USER32(-03A16828,?,?), ref: 03A11D10
LoadCursorA.USER32(00000000,00007F89), ref: 03A11D31
SetCursor.USER32(00000000), ref: 03A11D40

Memory Dump Source

Source File: 00000002.00000002.3440450729.0000000003A11000.00000020.00000001.01000000.0000000B.sdmp, Offset: 03A10000, based on PE: true

Associated: 00000002.00000002.3440439222.0000000003A10000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440462301.0000000003A13000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440473932.0000000003A14000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.3440486457.0000000003A18000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3a10000_Au_.jbxd

Similarity

API ID: CursorWindow$CallCtrlLoadPointsProcRect
String ID:
API String ID: 3496465773-0
Opcode ID: e4a25fa3759ba5b63ba4a36dd80ac7c71a90371c5c1054f84bf1390d4f4533ef
Instruction ID: 9c8144d6d4a210a2823ee756a2019d7bb90f31b51296b648632d203bc0dd6de2
Opcode Fuzzy Hash: e4a25fa3759ba5b63ba4a36dd80ac7c71a90371c5c1054f84bf1390d4f4533ef
Instruction Fuzzy Hash: FF21D076900216ABDF21CFB5DE4EBEA7BF8EB05240F04061AF742D6284E275D9628751

Function 039F2CEC Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(0000000C,00100000,00004000,?,?,?,?,039F1A5B,039F1AAF,?,?,?), ref: 039F2D24
VirtualFree.KERNEL32(0000000C,00000000,00008000,?,?,?,?,039F1A5B,039F1AAF,?,?,?), ref: 039F2D2F
HeapFree.KERNEL32(00000000,?,?,?,?,?,039F1A5B,039F1AAF,?,?,?), ref: 039F2D3C
HeapFree.KERNEL32(00000000,?,?,?,?,039F1A5B,039F1AAF,?,?,?), ref: 039F2D58
VirtualFree.KERNEL32(FFFFFFFF,00000000,00008000,?,?,039F1A5B,039F1AAF,?,?,?), ref: 039F2D79
HeapDestroy.KERNEL32(?,?,039F1A5B,039F1AAF,?,?,?), ref: 039F2D8B

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: Free$HeapVirtual$Destroy
String ID:
API String ID: 716807051-0
Opcode ID: 501e5bfdcfe1891c56ae77246e45a4aa14b94d1087ba58515aeefeddd0adbf3b
Instruction ID: 4494731d563b16a153e37c374173246e417c2aeb6f313ceac241b8b27658756e
Opcode Fuzzy Hash: 501e5bfdcfe1891c56ae77246e45a4aa14b94d1087ba58515aeefeddd0adbf3b
Instruction Fuzzy Hash: 65118E3B244205AFDB31EB10EC82F55B769FF85794F3A4814F7926B098C771A811DB54

Function 039F1000 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 123fileCOMMON

Download Yara Rule

APIs

Part of subcall function 039F1770: lstrcpyA.KERNEL32(?,?,?,039F1068,?), ref: 039F178F
Part of subcall function 039F1770: GlobalFree.KERNEL32 ref: 039F179F

CreateFileA.KERNEL32(00000002,00000002,00000001,00000000,00000002,00000080,00000000,?,?), ref: 039F10C0
CreateFileA.KERNEL32(00000000,00000004,00000001,00000000,00000003,00000080,00000000,?), ref: 039F1133
CreateFileA.KERNEL32(00000001,00000002,00000001,00000000,00000002,00000080,00000000), ref: 039F1153

Strings

false, xrefs: 039F10D5
true, xrefs: 039F1068

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: CreateFile$FreeGloballstrcpy
String ID: false$true
API String ID: 989768725-2658103896
Opcode ID: 087edaea3e3113eec94ef68e226293b270f326cecbb18225e3e50ced93bc87b3
Instruction ID: 4067de020874099cfe4e9419048f2eec3872c64da8015f37e52b3a9ec99fad4c
Opcode Fuzzy Hash: 087edaea3e3113eec94ef68e226293b270f326cecbb18225e3e50ced93bc87b3
Instruction Fuzzy Hash: 6541C475648340AFD320DA349CA2FA677EDAB89750F5C8959FBD49B3C0E2769008C781

Function 039F2B47 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 039F2B66
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 039F2B9B
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 039F2BFB

Strings

__MSVCRT_HEAP_SELECT, xrefs: 039F2B96
__GLOBAL_HEAP_SELECTED, xrefs: 039F2BD5

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: bc4e84340e7fe6736aa1dbb804ec2d9d0169f5da77007b3b37cda2f84b413d9b
Instruction ID: 847dfa3eb248c67b2097fcd4937bdaed90551d677e65fb9da2db3823894a8f24
Opcode Fuzzy Hash: bc4e84340e7fe6736aa1dbb804ec2d9d0169f5da77007b3b37cda2f84b413d9b
Instruction Fuzzy Hash: F631243D90634A6EEB35DBB06C85BED776C9B02384F1C0CD9D3C5DA042E6328AC98B11

Function 004025F5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402FAE: RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00000022,00000000,?,?), ref: 00402FD6

RegCloseKey.ADVAPI32(00000000), ref: 00402640
RegDeleteValueA.ADVAPI32(00000000,00000000,00000033), ref: 00402620

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

Strings

C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 00402627
DeleteRegKey: "%s\%s", xrefs: 00402655
DeleteRegValue: "%s\%s" "%s", xrefs: 00402632

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: C:\Users\user\AppData\Local\Temp\nslC943.tmp$DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-43562286
Opcode ID: 51c68090e8a67a56892b3820ab81a8b8f22f375d76c0b7748482eb46e543d4f7
Instruction ID: a5f9fdcf4292228b50cc97bbae3325fbb2d9f6784c2398e720f3cfd803d35b6f
Opcode Fuzzy Hash: 51c68090e8a67a56892b3820ab81a8b8f22f375d76c0b7748482eb46e543d4f7
Instruction Fuzzy Hash: C411CE72A00210BBDB10AFA1DE4AEBE7A74EF44358F11043FF405B61C1DBBD49119AAE

Function 00401F42 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401F49
GetDeviceCaps.GDI32(00000000), ref: 00401F50
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401F5F
CreateFontIndirectA.GDI32(0040C8B4), ref: 00401FB1

Strings

MS Shell Dlg, xrefs: 00401F97

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID: MS Shell Dlg
API String ID: 3272661963-76309092
Opcode ID: 291d0e57388edc1b08859d94a8efc30bfd93f616262f4cc1ff9ef029793b8a23
Instruction ID: b63daee5e4490fecacf728a327702699109581dcf8ad524f23a780e713d248c9
Opcode Fuzzy Hash: 291d0e57388edc1b08859d94a8efc30bfd93f616262f4cc1ff9ef029793b8a23
Instruction Fuzzy Hash: B1F04473954684EFE7017760AF9ABAA3FA4A715306F148579E5C1B61E3C6B80008972D

Function 039F24D2 Relevance: 7.6, APIs: 5, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 039F2530
GetFileType.KERNEL32(00000480), ref: 039F25DB
GetStdHandle.KERNEL32(-000000F6), ref: 039F263E
GetFileType.KERNEL32(00000000), ref: 039F264C
SetHandleCount.KERNEL32 ref: 039F2683

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: 9b1335927ab92d6f7c3e3c44a3ead95a105f340aa5c9d3a88f980fcd30653ee8
Instruction ID: 3044133fc504ff35ebfb7003894147cd6d67fab0b0ff0d97821b25fcdbb9c534
Opcode Fuzzy Hash: 9b1335927ab92d6f7c3e3c44a3ead95a105f340aa5c9d3a88f980fcd30653ee8
Instruction Fuzzy Hash: 7451E2795043018FC720EB78D498B697BE8FB41768F2D8E69D6E28F2E4DB309805CB50

Function 00401D15 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,LogicLinx 3.31 Uninstall,NSIS Error), ref: 004062DA

GlobalFree.KERNEL32(00000000), ref: 00401D9C

Strings

show, xrefs: 00401D48, 00401D4E, 00401D68
Pop: stack empty, xrefs: 00401D7A
Exch: stack < %d elements, xrefs: 00401D34

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$show
API String ID: 1459762280-4034689739
Opcode ID: cf8f085dc2dfd7742efe7c5db672cc57a5990e017400db5c87f51672aee65fbc
Instruction ID: 25a31974a44f7f3c9bc4a7fc565ada83b9efa98a6fb8f9df3e5ad5d088b76f6c
Opcode Fuzzy Hash: cf8f085dc2dfd7742efe7c5db672cc57a5990e017400db5c87f51672aee65fbc
Instruction Fuzzy Hash: CC21B3B2604141EBD710BF94DE85A5F73A4AF48319721493FF512B32D1EB7CA8119B2D

Function 00402EE4 Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402F05
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402F41
RegCloseKey.ADVAPI32(?), ref: 00402F4A
RegCloseKey.ADVAPI32(?), ref: 00402F6F
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402F8D

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: b028ecec1d78a200503dadcefe2bc22e0f6fb028ff25e3f61a2c7c57b1882060
Instruction ID: 1bd9878c7ef2e45ac55117cc9ab264197938e8746315a7d31758d375fefd0929
Opcode Fuzzy Hash: b028ecec1d78a200503dadcefe2bc22e0f6fb028ff25e3f61a2c7c57b1882060
Instruction Fuzzy Hash: 0E117C7150000AFFDF10AFA0DE48DAA3B7DEB44389B404036FA45B01E0D7B49E55BB69

Function 00401EE8 Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401EEC
GetClientRect.USER32(00000000,?), ref: 00401EF9
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401F1A
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401F28
DeleteObject.GDI32(00000000), ref: 00401F37

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 191427d0f54b16ed138330cd81feea0b1476f265f1ad51fa5151b3207bd7eed6
Instruction ID: 21f7915a8cdd7433989eb4cccbd80dcd7ad255e5dc09bc42d858887927c334f1
Opcode Fuzzy Hash: 191427d0f54b16ed138330cd81feea0b1476f265f1ad51fa5151b3207bd7eed6
Instruction Fuzzy Hash: 70F0ECB2500105AFD700EBA4EF88CAFB7BCEB48345B11447AF641F6191CA789D018B38

Function 039F21F8 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,039F186D,00000000,00000000,00000000), ref: 039F21FA
TlsGetValue.KERNEL32 ref: 039F2208
SetLastError.KERNEL32(00000000), ref: 039F2254

Part of subcall function 039F356E: HeapAlloc.KERNEL32(00000008,039F221D,00000000,00000000,00000000,039F6480,000000FF,?,039F221D,00000001,00000074), ref: 039F3664

TlsSetValue.KERNEL32(00000000), ref: 039F222C
GetCurrentThreadId.KERNEL32 ref: 039F223D

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: 86165a4d255d9bd0f4b9d78483dbdfc6cffccdfe9b70cf484a3ff7af82649bde
Instruction ID: 2de70cf33cdf45a906f9d97b7df1ca44df67288b2381ca1ade5b49ee960fe68a
Opcode Fuzzy Hash: 86165a4d255d9bd0f4b9d78483dbdfc6cffccdfe9b70cf484a3ff7af82649bde
Instruction Fuzzy Hash: DFF0903AA057219FC7357B65B809B9A3F64FF817A1B284D14F7869E198CB64C80187A0

Function 039F1B68 Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,?,?,039F21CC,039F1A56,039F1AAF,?,?,?), ref: 039F1B9C

Part of subcall function 039F2F20: HeapFree.KERNEL32(00000000,00000000,00000000,039F221D,00000000,?,039F3624,00000009,00000000,00000000,00000000,039F6480,000000FF,?,039F221D,00000001), ref: 039F2FF4

DeleteCriticalSection.KERNEL32(?,?,039F21CC,039F1A56,039F1AAF,?,?,?), ref: 039F1BB7
DeleteCriticalSection.KERNEL32 ref: 039F1BBF
DeleteCriticalSection.KERNEL32 ref: 039F1BC7
DeleteCriticalSection.KERNEL32 ref: 039F1BCF

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: CriticalDeleteSection$FreeHeap
String ID:
API String ID: 447823528-0
Opcode ID: 2f7f872b6afa661d57212c0c7e5d3e0fee7fa7385115d433c0c776d7a1bddd60
Instruction ID: 91b8d4618d95553ad11a8b0d1a32cd8e51b0bdd5dabb51ff1906b961dc97e9df
Opcode Fuzzy Hash: 2f7f872b6afa661d57212c0c7e5d3e0fee7fa7385115d433c0c776d7a1bddd60
Instruction Fuzzy Hash: 36F05436C04151DF8B31FA69EC48D59AA99DEC47E130E003DDF586616895318CA98BD0

Function 004022F1 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00408400,?,00000001,004083F0,?), ref: 00402371
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,0040ACA8,00000400,?,00000001,004083F0,?), ref: 00402429

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402353
C:\Users\user\Desktop\, xrefs: 004023AB

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\Desktop\$CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 123533781-1442144967
Opcode ID: ad980c83200af27b32296972477564cb0cbea8762c98e87083d2b3fbecaef2c0
Instruction ID: 458830b68615384cc5dcfd7975f20282d1088c50676892df8a4bfa2d63e4f4ae
Opcode Fuzzy Hash: ad980c83200af27b32296972477564cb0cbea8762c98e87083d2b3fbecaef2c0
Instruction Fuzzy Hash: A2515D71A00105BFCB04DFA4CD88DAE7BB5EF44314B20416AF815EB2D1DBB99941CB64

Function 00404CF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00421DD8,00421DD8,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404C0B,000000DF,004215B0,00000400,00000000), ref: 00404D8E
wsprintfA.USER32 ref: 00404D96
SetDlgItemTextA.USER32(?,00421DD8), ref: 00404DA9

Strings

%u.%u%s%s, xrefs: 00404D78

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: fb960496eb737e3345640ab9aa1b750d987e596b68fc784b6d450b4f24d22922
Instruction ID: fef6342639dcf3a39bf3010210a5e3f1a67f436211564216b1c935a3cd24951c
Opcode Fuzzy Hash: fb960496eb737e3345640ab9aa1b750d987e596b68fc784b6d450b4f24d22922
Instruction Fuzzy Hash: FA11B77360412827DB0065699C41EAE3298DF85775F25023BFA26F71D5E978DC1242A9

Function 00403F00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,LogicLinx 3.31 Uninstall), ref: 00403F98

Strings

1033, xrefs: 00403F04, 00403F0E, 00403F7F
LogicLinx 3.31 Uninstall, xrefs: 00403F87
"C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" , xrefs: 00403F01

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe" $1033$LogicLinx 3.31 Uninstall
API String ID: 530164218-2959590292
Opcode ID: 824abd7a98796db34fe8f0091d41f8f78567243a6a7f46d0f054108d974f342d
Instruction ID: c0cba1e1e52928c29bb6f4708aec44978d016cd28d93ecea9319bf13156573fa
Opcode Fuzzy Hash: 824abd7a98796db34fe8f0091d41f8f78567243a6a7f46d0f054108d974f342d
Instruction Fuzzy Hash: 0111C375F046129BC720AF15DC90A777BBCEB8975A369417FE801AB3A0C6399D02866C

Function 00402470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

Part of subcall function 00406775: FindFirstFileA.KERNEL32(?,00423E28,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00405EE4,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00406780
Part of subcall function 00406775: FindClose.KERNEL32(00000000), ref: 0040678C

lstrlenA.KERNEL32 ref: 004024BF
lstrlenA.KERNEL32(00000000), ref: 004024C9
SHFileOperationA.SHELL32(?,?,?,00000000), ref: 004024F1

Strings

CopyFiles "%s"->"%s", xrefs: 0040248A

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: dbd2ce84fe86277a7fe77c547b3350a30209b166dd41be93e3949f7943bff834
Instruction ID: 0832a6020f1036a0726e8da95463cb7d6bb66b9f43395e8b0a18584e12aaf647
Opcode Fuzzy Hash: dbd2ce84fe86277a7fe77c547b3350a30209b166dd41be93e3949f7943bff834
Instruction Fuzzy Hash: 06115171D04244BACB10EFF5DE49A8EBBB89F05318F10403BB405B72C1D6BCC9018769

Function 00401FFA Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(?,00000000,00000000,00000000,C:\Users\user\Desktop\,?), ref: 00402040

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

Strings

ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402064
C:\Users\user\Desktop\, xrefs: 0040202B
ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 0040204F

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: ExecuteShelllstrlenwvsprintf
String ID: C:\Users\user\Desktop\$ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 2380004146-1697473297
Opcode ID: 4331fc396d1e37fc14f55263f28b15bc948bf85afbb856549c2d96993d882713
Instruction ID: 9f4db21a6b6a14a70f0226e5947bfc74daeb421406b5451b347b61cec48b8855
Opcode Fuzzy Hash: 4331fc396d1e37fc14f55263f28b15bc948bf85afbb856549c2d96993d882713
Instruction Fuzzy Hash: 7D01D4B1B442007EDB206AB6DD4EE6B6A68DF4575CB60043BF401F61C2DAFD8C119279

Function 004066C9 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040671D
lstrcatA.KERNEL32(00000000,...), ref: 00406740

Strings

..., xrefs: 00406738
%02x%c, xrefs: 00406715

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: daa42dd9d71092567bb90f5aa1bf8f8b213d546467a0c39d0d39aa66ca362de9
Instruction ID: d62a74e215861be07d80cfa2a74bb9186ec53be61cd52c9054fc739eae054529
Opcode Fuzzy Hash: daa42dd9d71092567bb90f5aa1bf8f8b213d546467a0c39d0d39aa66ca362de9
Instruction Fuzzy Hash: 5601F531904214AFD711DF99C985BDEBBE9EB84704F21413BF805F7280D3759EA087A8

Function 004055FD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0040560D

Part of subcall function 004044EC: SendMessageA.USER32(00020448,00000000,00000000,00000000), ref: 004044FE

OleUninitialize.OLE32(00000404,00000000), ref: 0040565B

Part of subcall function 00406747: lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
Part of subcall function 00406747: wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

Strings

Section: "%s", xrefs: 0040562F
Skipping section: "%s", xrefs: 0040566B

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: c1e2c449bcc68b352cf79dcfb7db83265b1627727e3ad06e037315caf05dff02
Instruction ID: b6033417647ee4c6c9867fb094380a517277432fe9fbf8781098b48ebfeefd64
Opcode Fuzzy Hash: c1e2c449bcc68b352cf79dcfb7db83265b1627727e3ad06e037315caf05dff02
Instruction Fuzzy Hash: 4CF028732446009AE7243762AD0AF167794DF80324FA6443FFE88731E1CF7E48428A6D

Function 00405DC0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004036D4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00405DC6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004036D4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00405DCF
lstrcatA.KERNEL32(?,0040A28C), ref: 00405DE0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DC0

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: 474ca4425f08dcfbce71dbb0ed893910abc24d850d6d34f35572f5f56a012a6b
Instruction ID: 0734be1ac4b4e6ef13ff8d97b6b7742c695e07c626293a3ddb6dea9da1bc223f
Opcode Fuzzy Hash: 474ca4425f08dcfbce71dbb0ed893910abc24d850d6d34f35572f5f56a012a6b
Instruction Fuzzy Hash: 88D0A7625019306AD10132555C09DCF1B089F0234170500BFF101B3191C77C4D5187FE

Function 039F4790 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,039F7580,039F7580,?,039F221D,039F4C5C,00000000,00000010,00000000,00000009,00000009,?,039F30F3,00000010,00000000), ref: 039F47B1
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,039F221D,039F4C5C,00000000,00000010,00000000,00000009,00000009,?,039F30F3,00000010,00000000), ref: 039F47D5
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,039F221D,039F4C5C,00000000,00000010,00000000,00000009,00000009,?,039F30F3,00000010,00000000), ref: 039F47EF
VirtualFree.KERNEL32(00000000,00000000,00008000,?,039F221D,039F4C5C,00000000,00000010,00000000,00000009,00000009,?,039F30F3,00000010,00000000,039F221D), ref: 039F48B0
HeapFree.KERNEL32(00000000,00000000,?,039F221D,039F4C5C,00000000,00000010,00000000,00000009,00000009,?,039F30F3,00000010,00000000,039F221D,00000000), ref: 039F48C7

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 841162fd37570d5723168c34153a442d330586308f20f0f90dbcbeb80b190b2e
Instruction ID: 995631548e15780f416f3cc2ebce4ae3341e762fa6890c1b9e664a9dfe23dd6c
Opcode Fuzzy Hash: 841162fd37570d5723168c34153a442d330586308f20f0f90dbcbeb80b190b2e
Instruction Fuzzy Hash: 3D310471A447019FD330DF2ADC40B32B7E8EB857A4F144639E76A9B2C4E770A444CB44

Function 00405E54 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CharNextA.USER32(00405BAD,?,C:\Users\user\AppData\Local\Temp\nslC943.tmp,00000000,00405EB8,C:\Users\user\AppData\Local\Temp\nslC943.tmp,C:\Users\user\AppData\Local\Temp\nslC943.tmp,?,?,76232EE0,00405BAD,?,C:\Users\user\AppData\Local\Temp\,76232EE0), ref: 00405E62
CharNextA.USER32(00000000), ref: 00405E67
CharNextA.USER32(00000000), ref: 00405E76

Strings

C:\Users\user\AppData\Local\Temp\nslC943.tmp, xrefs: 00405E55

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nslC943.tmp
API String ID: 3213498283-76981094
Opcode ID: 54424ee5da26782a37665bbc102068cc15b5f81190ee1e33e4b0b968b8303093
Instruction ID: 11a343e31c9d60752f54db4d23f309ce601ad8d6a71b69d801754e6f1b581227
Opcode Fuzzy Hash: 54424ee5da26782a37665bbc102068cc15b5f81190ee1e33e4b0b968b8303093
Instruction Fuzzy Hash: E6F027B1904E2565EB3223649C44F7B5B9CDB54310F04003BE680B61D183BC4D828FD9

Function 039F1F32 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,?), ref: 039F1F46

Strings

, xrefs: 039F1F8F
, xrefs: 039F1F6B

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: c5058f6f2c3887d6dcea2c2a5986310882c7f258f9a01014d13bb716f313481e
Instruction ID: c05236d7e350828c11d493c6e6a9a30d536618e939871dae5b86aa70c5bee0a6
Opcode Fuzzy Hash: c5058f6f2c3887d6dcea2c2a5986310882c7f258f9a01014d13bb716f313481e
Instruction Fuzzy Hash: B14189321082585FD721D718DC49BEB7F9CEB02700F2C09E4DA89CB192C3654985CBA2

Function 0040547B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004054B1
CallWindowProcA.USER32(?,00000200,?,?), ref: 0040551F

Part of subcall function 004044EC: SendMessageA.USER32(00020448,00000000,00000000,00000000), ref: 004044FE

Strings

, xrefs: 00405489

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: a97747d4f20b58a5a8246378c350f1c08e6f5488a267fa018f0172030650b825
Instruction ID: 166d6715e7ab60c55adc75bb3d5397455d2db949af7a45014f951e8b9f02b12e
Opcode Fuzzy Hash: a97747d4f20b58a5a8246378c350f1c08e6f5488a267fa018f0172030650b825
Instruction Fuzzy Hash: 2C118C31200608BBDB216F52DC40A9B3B6AEF15365F00843BF609792A2C7788D51CFA9

Function 00402904 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34filestringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 00402922
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll,00000000,?,?,00000000,00000011), ref: 00402941

Strings

C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll, xrefs: 00402910, 00402935

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll
API String ID: 427699356-1437982054
Opcode ID: bcbf014360f17b4c072ef3e4100504422a2a3de39269110d03a8084a7a26d8e5
Instruction ID: 81bf12f3e497c37cfbdb7e66173dd3580eab781fa494c6dd951371effea59d05
Opcode Fuzzy Hash: bcbf014360f17b4c072ef3e4100504422a2a3de39269110d03a8084a7a26d8e5
Instruction Fuzzy Hash: E8F0B472604144AED700FBB09E09AAB7268DB04309F10443BE142B60C1D7BC494297AD

Function 039F1720 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,false,?,039F133F,00000000,00000000), ref: 039F1751
WriteFile.KERNEL32(00000000,039F7048,00000002,?,00000000,?,?,00000000,00000000,false,?,039F133F,00000000,00000000), ref: 039F1767

Strings

false, xrefs: 039F1725

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: FileWrite
String ID: false
API String ID: 3934441357-734881840
Opcode ID: 07ff4a68960446508fb28e860ae5b07863bee65339dc280fa738ee9ab8986601
Instruction ID: 1cf361d01a8a16872f2dd7aab871decc324104e4c8da1be6680f2044082d17be
Opcode Fuzzy Hash: 07ff4a68960446508fb28e860ae5b07863bee65339dc280fa738ee9ab8986601
Instruction Fuzzy Hash: D3F030B62582117FD324DA68EC01F5B7BE8DBC8761F204A1DB219D71D4C7B0A8048764

Function 00405AD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00423DE0,Error launching installer), ref: 00405AF9
CloseHandle.KERNEL32(?), ref: 00405B06

Strings

Error launching installer, xrefs: 00405AE7

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 3b66473eb4771c68d0353ea43fb647f521c8516ae3fc4b703c5bf4ba3abd35a8
Instruction ID: 1d70755ca8eb642d96ec23e61d28b209352ba4559abde40ea63553acab106949
Opcode Fuzzy Hash: 3b66473eb4771c68d0353ea43fb647f521c8516ae3fc4b703c5bf4ba3abd35a8
Instruction Fuzzy Hash: 1DE0ECB4610209ABDB10DF65ED09EAF7BBCEB00345F808435A915E2150E779E514CA68

Function 00403B61 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,76232EE0,00403B38,?,0040392A,00000020), ref: 00403B7B
GlobalFree.KERNEL32(005C3588), ref: 00403B82

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403B73

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3936084776
Opcode ID: 4a26028100cf0ca1eb7320d9d5861408e20f1dc8c6947a4482afe346d8307102
Instruction ID: fc000f3235394a2863270d4c988953181e2e652df1d5c43234967270b233dd50
Opcode Fuzzy Hash: 4a26028100cf0ca1eb7320d9d5861408e20f1dc8c6947a4482afe346d8307102
Instruction Fuzzy Hash: 2BE08C3352102097C6211F45A904B5AB7BCAF45B26F06853BE884772A287742C428BCC

Function 00405E07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,0040318C,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,80000000,00000003), ref: 00405E0D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,0040318C,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe,80000000,00000003), ref: 00405E1B

Strings

C:\Users\user\AppData\Local\Temp\~nsuA.tmp, xrefs: 00405E07

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\~nsuA.tmp
API String ID: 2709904686-97582353
Opcode ID: 0e813410e8fe4af35f1e42066ab3310dcd072c640338dbde9885af6b97860c84
Instruction ID: 23fada268802dc59446a59c67ae78adf9070c91ebc4bc7db9eb0e03d7b787ba1
Opcode Fuzzy Hash: 0e813410e8fe4af35f1e42066ab3310dcd072c640338dbde9885af6b97860c84
Instruction Fuzzy Hash: A3D0A772408D701EE3036310DC04B8F6B48DF16300F0900A7F1C1AA1D0C6784D424BFD

Function 00406747 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?,?,00000000,00405D75,RMDir: RemoveDirectory("%s"),?,?,?), ref: 0040675E
wvsprintfA.USER32(00000000,File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1),?), ref: 00406766

Part of subcall function 004065C8: CloseHandle.KERNEL32(FFFFFFFF,?,?,00406773,00000000), ref: 004065DE

Strings

File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1), xrefs: 00406747, 00406758, 0040675D

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: File: skipped: "C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll" (overwriteflag=1)
API String ID: 3509786178-1688853826
Opcode ID: 37f07c27298e82f33cc4ea35b45c4898f6a3a97ae3bf8fd59e0fb2dd5667139f
Instruction ID: be19833288726f4bc11686dc6ee22efb9c47c58bb1c6306399fb84dec137b1c2
Opcode Fuzzy Hash: 37f07c27298e82f33cc4ea35b45c4898f6a3a97ae3bf8fd59e0fb2dd5667139f
Instruction Fuzzy Hash: 63D0A9329086203EC201A361FC09BDB2F9C9F083A0FC1407BF848E2091CBB88501C6AE

Function 00403BF6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062CD: lstrcpynA.KERNEL32(?,?,00000400,00403795,LogicLinx 3.31 Uninstall,NSIS Error), ref: 004062DA

Part of subcall function 00405DC0: lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004036D4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00405DC6
Part of subcall function 00405DC0: CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004036D4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00403875), ref: 00405DCF
Part of subcall function 00405DC0: lstrcatA.KERNEL32(?,0040A28C), ref: 00405DE0

lstrcatA.KERNEL32(00000000,00000000,00424780,C:\Users\user\Desktop\,install.log,00403D69,C:\Users\user\Desktop\,C:\Users\user\Desktop\,1033,00421DD8,80000001,Control Panel\Desktop\ResourceLocale,00000000,00421DD8,00000000,00000003), ref: 00403C11

Strings

C:\Users\user\Desktop\, xrefs: 00403BFB
install.log, xrefs: 00403BF6

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: lstrcat$CharPrevlstrcpynlstrlen
String ID: C:\Users\user\Desktop\$install.log
API String ID: 2126114531-2537383190
Opcode ID: 4b77a2e339eb68ff388b82575c8e29bbe101c667e65de6cbe57859233cde245b
Instruction ID: 573e70e16c7f3eccbdc253e2bea591d89099f51d3e6e710ae79217221ee15991
Opcode Fuzzy Hash: 4b77a2e339eb68ff388b82575c8e29bbe101c667e65de6cbe57859233cde245b
Instruction Fuzzy Hash: 27B00265BA075160D80436B32D5BF1E051C5C81B2C3F689BFB011710C259BCA065546D

Function 039F45E4 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,00000000,00000000,039F43AC,00000000,00000000,00000000,039F3095,00000000,00000000,039F221D,00000000,00000000,00000000), ref: 039F460C
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,039F43AC,00000000,00000000,00000000,039F3095,00000000,00000000,039F221D,00000000,00000000,00000000), ref: 039F4640
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 039F465A
HeapFree.KERNEL32(00000000,?), ref: 039F4671

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: ca85b1d7ca20f5b5500e7e91d2cbe1d7a8db1547aaea1ed18273ec41c731678f
Instruction ID: 303e8fb8aa580cb053436b4c1213025e2fb93dfb4da50c5edf98c01b3b70072d
Opcode Fuzzy Hash: ca85b1d7ca20f5b5500e7e91d2cbe1d7a8db1547aaea1ed18273ec41c731678f
Instruction Fuzzy Hash: F2113031208201AFD720EF2AEC85E267BB9FF85755725491AF662CB194D7719412CF10

Function 00405F19 Relevance: 5.0, APIs: 4, Instructions: 30stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F20
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405F39
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405F47
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00406127,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405F50

Memory Dump Source

Source File: 00000002.00000002.3439475743.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3439462217.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439489435.0000000000408000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000040A000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000410000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000423000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000427000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.000000000042C000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439503883.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3439589373.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_Au_.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 799b41214dee5a3a207c986fb220c019988a50b8bc6b7bac04f470c9780bf706
Instruction ID: a929261b065623d84111eb1ef98f27e3caca39442dc5c5f552f944d16b5be969
Opcode Fuzzy Hash: 799b41214dee5a3a207c986fb220c019988a50b8bc6b7bac04f470c9780bf706
Instruction Fuzzy Hash: 84F0A736209D52ABC202AB355C04A6B6B94EF86315B14047EF041F2240D73A98259BBE

Function 039F1B3F Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,039F2179,?,039F19ED), ref: 039F1B4C
InitializeCriticalSection.KERNEL32 ref: 039F1B54
InitializeCriticalSection.KERNEL32 ref: 039F1B5C
InitializeCriticalSection.KERNEL32 ref: 039F1B64

Memory Dump Source

Source File: 00000002.00000002.3440368393.00000000039F1000.00000020.00000001.01000000.00000008.sdmp, Offset: 039F0000, based on PE: true

Associated: 00000002.00000002.3440356341.00000000039F0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440380688.00000000039F6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440392347.00000000039F7000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440404042.00000000039F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000002.00000002.3440415852.00000000039FB000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_39f0000_Au_.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: ec320d9b043571910ef564d7ba05400468327a5588897493f392803aef3d329b
Instruction ID: c3d7e01340a91190d97ae2e7fefba471c3e577460c5775e88bf3b81308758303
Opcode Fuzzy Hash: ec320d9b043571910ef564d7ba05400468327a5588897493f392803aef3d329b
Instruction Fuzzy Hash: D4C0E931819024AFCB113BA5FC04C553F26EF042E13090066A50C59178863158B6DF80

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report yDoZVwXSMG.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\nslC943.tmp\BrandingURL.dll

C:\Users\user\AppData\Local\Temp\nslC943.tmp\FindProcDLL.dll

C:\Users\user\AppData\Local\Temp\nslC943.tmp\InstallOptions.dll

C:\Users\user\AppData\Local\Temp\nslC943.tmp\LangDLL.dll

C:\Users\user\AppData\Local\Temp\nslC943.tmp\LogEx.dll

C:\Users\user\AppData\Local\Temp\nslC943.tmp\ioSpecial.ini

C:\Users\user\AppData\Local\Temp\nslC943.tmp\modern-wizard.bmp

C:\Users\user\AppData\Local\Temp\nsqC8C5.tmp

C:\Users\user\AppData\Local\Temp\nsvC710.tmp

C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe

C:\Users\user\AppData\Local\Temp\~nsuA.tmp\Au_.exe:Zone.Identifier

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

Windows Analysis Report
yDoZVwXSMG.exe

Function 004036E7 Relevance: 82.6, APIs: 27, Strings: 20, Instructions: 317
stringfilecomCOMMON

Function 00406AB6 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Function 0040601B Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 144
filememoryCOMMON

Function 00403120 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Function 0040679C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Function 00405FD3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 004033C6 Relevance: 7.6, APIs: 5, Instructions: 109
fileCOMMON

Function 004034F1 Relevance: 6.1, APIs: 4, Instructions: 108
fileCOMMON

Function 00405A22 Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Function 00405AD4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Function 00406EEB Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 004070EC Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 00406E02 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00406907 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406D55 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON