Edit tour

Windows Analysis Report
Ni2ghr9eUJ.exe

Overview

General Information

Sample name:	Ni2ghr9eUJ.exe renamed because original name is a hash value
Original sample name:	c7df4c7117c0ea3fc75667d1b09db5e8.exe
Analysis ID:	1574298
MD5:	c7df4c7117c0ea3fc75667d1b09db5e8
SHA1:	d1adda0415be3e1499bd41cc45db354026d1a499
SHA256:	1f8b6dd65f2ce836562b17f850644b7c0d265f5c770f65ccfcc4481e9e3b02dc
Tags:	exeuser-abuse_ch
Infos:

Detection

Socks5Systemz

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Yara detected Socks5Systemz

AI detected suspicious sample

Contains functionality to infect the boot sector

Found API chain indicative of debugger detection

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Ni2ghr9eUJ.exe (PID: 3624 cmdline: "C:\Users\user\Desktop\Ni2ghr9eUJ.exe" MD5: C7DF4C7117C0EA3FC75667D1B09DB5E8)

Ni2ghr9eUJ.tmp (PID: 4408 cmdline: "C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp" /SL5="$20414,3770460,54272,C:\Users\user\Desktop\Ni2ghr9eUJ.exe" MD5: B4D4F779EA9E1F6AC0828B0B21EE319A)

schtasks.exe (PID: 6408 cmdline: "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12125" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2608 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

videominimizer32.exe (PID: 5528 cmdline: "C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe" -i MD5: 624F0DE58BEEA53641A6304AE005CB48)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\ProgramData\EarnPackage\EarnPackage.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-TNDK0.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000005.00000002.3886391694.0000000002BC2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000005.00000000.2035473597.0000000000401000.00000020.00000001.01000000.00000009.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: videominimizer32.exe PID: 5528	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
5.0.videominimizer32.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Suricata Signatures

ET JA3 Hash - [Abuse.ch] Possible Dridex

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:27:36.697855+0100	2028765	3	Unknown Traffic	192.168.2.5	49946	188.119.66.185	443	TCP
2024-12-13T08:27:42.233817+0100	2028765	3	Unknown Traffic	192.168.2.5	49963	188.119.66.185	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-13T08:27:37.381237+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49946	188.119.66.185	443	TCP
2024-12-13T08:27:42.925059+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49963	188.119.66.185	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: Ni2ghr9eUJ.exe

ReversingLabs: Detection: 26%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\EarnPackage\EarnPackage.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0045CFD8 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	1_2_0045CFD8
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0045D08C ArcFourCrypt,	1_2_0045D08C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0045D0A4 ArcFourCrypt,	1_2_0045D0A4
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_10001000 ISCryptGetVersion,	1_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_10001130 ArcFourCrypt,	1_2_10001130

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Unpacked PE file: 5.2.videominimizer32.exe.400000.0.unpack

Source: Ni2ghr9eUJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Minimizer_is1

Jump to behavior

Source: unknown

HTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.5:49946 version: TLS 1.2

Source:	Binary string: msvcp71.pdbx# source: is-MHLT1.tmp.1.dr
Source:	Binary string: msvcr71.pdb< source: is-60ALK.tmp.1.dr
Source:	Binary string: msvcp71.pdb source: is-MHLT1.tmp.1.dr
Source:	Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-ITRAP.tmp.1.dr
Source:	Binary string: msvcr71.pdb source: is-60ALK.tmp.1.dr

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,	1_2_00474DFC
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,	1_2_004625C4
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463B50
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00497C14
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463FCC

Source: global traffic

TCP traffic: 192.168.2.5:49953 -> 31.214.157.206:2024

Source: Joe Sandbox View	IP Address: 31.214.157.206 31.214.157.206
Source: Joe Sandbox View	IP Address: 188.119.66.185 188.119.66.185

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49946 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2028765 - Severity 3 - ET JA3 Hash - [Abuse.ch] Possible Dridex : 192.168.2.5:49963 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49946 -> 188.119.66.185:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49963 -> 188.119.66.185:443

Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650f2ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda33231dd4398f HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4ce71bc34f7f632ef3b70caaf94cda9ea6967478d3f44cc588fa45d7d69a43faeaa5960502d18f414ad332231ad7308bd0d59d5e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185

Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.206
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.206
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.206
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.206
Source: unknown	TCP traffic detected without corresponding DNS query: 31.214.157.206
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185
Source: unknown	TCP traffic detected without corresponding DNS query: 188.119.66.185

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00AC2B95 WSASetLastError,WSARecv,WSASetLastError,select,

5_2_00AC2B95

Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650f2ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda33231dd4398f HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185
Source: global traffic	HTTP traffic detected: GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4ce71bc34f7f632ef3b70caaf94cda9ea6967478d3f44cc588fa45d7d69a43faeaa5960502d18f414ad332231ad7308bd0d59d5e HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)Host: 188.119.66.185

Source: videominimizer32.exe, 00000005.00000000.2036315085.00000000004D5000.00000002.00000001.01000000.00000009.sdmp, videominimizer32.exe.1.dr, is-TNDK0.tmp.1.dr, EarnPackage.exe.5.dr	String found in binary or memory: http://liba52.sourceforge.net/B6.4.0.1
Source: videominimizer32.exe, 00000005.00000000.2036315085.00000000004D5000.00000002.00000001.01000000.00000009.sdmp, videominimizer32.exe.1.dr, is-TNDK0.tmp.1.dr, EarnPackage.exe.5.dr	String found in binary or memory: http://www.audiocoding.com/
Source: Ni2ghr9eUJ.tmp, Ni2ghr9eUJ.tmp, 00000001.00000000.2021656504.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-5K4VI.tmp.1.dr, Ni2ghr9eUJ.tmp.0.dr	String found in binary or memory: http://www.innosetup.com/
Source: Ni2ghr9eUJ.exe, 00000000.00000003.2020969404.0000000002098000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020618096.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, Ni2ghr9eUJ.tmp, 00000001.00000000.2021656504.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-5K4VI.tmp.1.dr, Ni2ghr9eUJ.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: Ni2ghr9eUJ.exe, 00000000.00000003.2020969404.0000000002098000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020618096.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000000.2021656504.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-5K4VI.tmp.1.dr, Ni2ghr9eUJ.tmp.0.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: videominimizer32.exe, 00000005.00000000.2036315085.00000000004D5000.00000002.00000001.01000000.00000009.sdmp, videominimizer32.exe.1.dr, is-TNDK0.tmp.1.dr, EarnPackage.exe.5.dr	String found in binary or memory: http://www.videolan.org/dtsdec.html96.4.0.2
Source: videominimizer32.exe, 00000005.00000002.3886512016.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886512016.00000000031A0000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3885770545.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/
Source: videominimizer32.exe, 00000005.00000002.3886512016.00000000031A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b325
Source: videominimizer32.exe, 00000005.00000002.3885770545.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3885770545.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4
Source: videominimizer32.exe, 00000005.00000002.3886512016.00000000031A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://188.119.66.185/en-US
Source: Ni2ghr9eUJ.exe, 00000000.00000002.3885559314.0000000002091000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020104217.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020261456.0000000002091000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000002.3885891099.00000000022E8000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000003.2022780749.00000000022E8000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000003.2022705233.0000000003230000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000002.3885621428.0000000000792000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.easycutstudio.com/support.html

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946

Source: unknown

HTTPS traffic detected: 188.119.66.185:443 -> 192.168.2.5:49946 version: TLS 1.2

Source: is-ITRAP.tmp.1.dr

Binary or memory string: DirectDrawCreateEx

memstr_0e55c7eb-8

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0042F520 NtdllDefWindowProc_A,	1_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00423B84 NtdllDefWindowProc_A,	1_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004125D8 NtdllDefWindowProc_A,	1_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004785E0 NtdllDefWindowProc_A,	1_2_004785E0
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004573E0 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	1_2_004573E0

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

1_2_0042E934

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_0040840C	0_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004804DB	1_2_004804DB
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0047051C	1_2_0047051C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00467218	1_2_00467218
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004352C8	1_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0043DD50	1_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0043035C	1_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004444C8	1_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004345C4	1_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004866B4	1_2_004866B4
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00444A70	1_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00430EE8	1_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0045EF38	1_2_0045EF38
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0045AFC4	1_2_0045AFC4
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00445168	1_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00469278	1_2_00469278
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00445574	1_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00487614	1_2_00487614
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0048D9F0	1_2_0048D9F0
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004519BC	1_2_004519BC
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00401051	5_2_00401051
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00401C26	5_2_00401C26
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_004070A7	5_2_004070A7
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609660FA	5_2_609660FA
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6092114F	5_2_6092114F
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6091F2C9	5_2_6091F2C9
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096923E	5_2_6096923E
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6093323D	5_2_6093323D
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095C314	5_2_6095C314
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60950312	5_2_60950312
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094D33B	5_2_6094D33B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6093B368	5_2_6093B368
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096748C	5_2_6096748C
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6093F42E	5_2_6093F42E
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60954470	5_2_60954470
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609615FA	5_2_609615FA
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096A5EE	5_2_6096A5EE
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096D6A4	5_2_6096D6A4
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609606A8	5_2_609606A8
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60932654	5_2_60932654
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60955665	5_2_60955665
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094B7DB	5_2_6094B7DB
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6092F74D	5_2_6092F74D
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60964807	5_2_60964807
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094E9BC	5_2_6094E9BC
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60937929	5_2_60937929
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6093FAD6	5_2_6093FAD6
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096DAE8	5_2_6096DAE8
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094DA3A	5_2_6094DA3A
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60936B27	5_2_60936B27
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60954CF6	5_2_60954CF6
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60950C6B	5_2_60950C6B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60966DF1	5_2_60966DF1
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60963D35	5_2_60963D35
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60909E9C	5_2_60909E9C
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60951E86	5_2_60951E86
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60912E0B	5_2_60912E0B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60954FF8	5_2_60954FF8
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00AD70B0	5_2_00AD70B0
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00ACE06F	5_2_00ACE06F
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00ADBAED	5_2_00ADBAED
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00AE2A70	5_2_00AE2A70
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00ADD31F	5_2_00ADD31F
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00AE0DA4	5_2_00AE0DA4
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00ADB5F9	5_2_00ADB5F9
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00AE266D	5_2_00AE266D
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00AD873A	5_2_00AD873A
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00ADBF05	5_2_00ADBF05

Source: Joe Sandbox View

Dropped File: C:\ProgramData\EarnPackage\sqlite3.dll 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 004078F4 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00457D6C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00403494 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00403684 appears 224 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00457B60 appears 97 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 00453344 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: String function: 004460A4 appears 59 times
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: String function: 00AD7750 appears 32 times
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: String function: 00AE2A00 appears 136 times

Source: Ni2ghr9eUJ.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: Ni2ghr9eUJ.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: Ni2ghr9eUJ.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: Ni2ghr9eUJ.tmp.0.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: is-5K4VI.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-5K4VI.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-5K4VI.tmp.1.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Source: sqlite3.dll.5.dr	Static PE information: Number of sections : 19 > 10
Source: is-KHIDH.tmp.1.dr	Static PE information: Number of sections : 19 > 10

Source: Ni2ghr9eUJ.exe, 00000000.00000003.2020969404.0000000002098000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Ni2ghr9eUJ.exe
Source: Ni2ghr9eUJ.exe, 00000000.00000003.2020618096.00000000023C0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs Ni2ghr9eUJ.exe

Source: Ni2ghr9eUJ.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: videominimizer32.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: EarnPackage.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal92.troj.evad.winEXE@8/30@0/2

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00ACF8C0 _memset,FormatMessageA,GetLastError,FormatMessageA,GetLastError,

5_2_00ACF8C0

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		0_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		1_2_004555E4

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceA,

1_2_00455E0C

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: CreateServiceA,CloseServiceHandle,

5_2_004026EC

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_0046DF58 GetVersion,CoCreateInstance,

1_2_0046DF58

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Code function: 0_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,

0_2_00409BEC

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00402812 lstrcmpiW,StartServiceCtrlDispatcherA,

5_2_00402812

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_00402812 lstrcmpiW,StartServiceCtrlDispatcherA,		5_2_00402812
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_0040D6C1 StartServiceCtrlDispatcherA,		5_2_0040D6C1

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2608:120:WilError_03

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

File created: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp

Jump to behavior

Source: Yara match	File source: 5.0.videominimizer32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000000.2035473597.0000000000401000.00000020.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: C:\ProgramData\EarnPackage\EarnPackage.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-TNDK0.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: videominimizer32.exe, videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: videominimizer32.exe, videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: videominimizer32.exe, videominimizer32.exe, 00000005.00000003.2038898236.0000000000812000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmp, sqlite3.dll.5.dr, is-KHIDH.tmp.1.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: Ni2ghr9eUJ.exe

ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

File read: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Ni2ghr9eUJ.exe "C:\Users\user\Desktop\Ni2ghr9eUJ.exe"
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp "C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp" /SL5="$20414,3770460,54272,C:\Users\user\Desktop\Ni2ghr9eUJ.exe"
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12125"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process created: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe "C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe" -i
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp "C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp" /SL5="$20414,3770460,54272,C:\Users\user\Desktop\Ni2ghr9eUJ.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12125"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process created: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe "C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe" -i	Jump to behavior

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Section loaded: ncryptsslp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Video Minimizer_is1

Jump to behavior

Source: Ni2ghr9eUJ.exe

Static file information: File size 4019237 > 1048576

Source:	Binary string: msvcp71.pdbx# source: is-MHLT1.tmp.1.dr
Source:	Binary string: msvcr71.pdb< source: is-60ALK.tmp.1.dr
Source:	Binary string: msvcp71.pdb source: is-MHLT1.tmp.1.dr
Source:	Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-ITRAP.tmp.1.dr
Source:	Binary string: msvcr71.pdb source: is-60ALK.tmp.1.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Unpacked PE file: 5.2.videominimizer32.exe.400000.0.unpack .text:ER;_abtt_1:R;_actt_1:W;.rsrc:R;_adtt_1:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Unpacked PE file: 5.2.videominimizer32.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004502C0

Source: videominimizer32.exe.1.dr	Static PE information: section name: _abtt_1
Source: videominimizer32.exe.1.dr	Static PE information: section name: _actt_1
Source: videominimizer32.exe.1.dr	Static PE information: section name: _adtt_1
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /4
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /19
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /35
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /51
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /63
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /77
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /89
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /102
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /113
Source: is-KHIDH.tmp.1.dr	Static PE information: section name: /124
Source: is-ITRAP.tmp.1.dr	Static PE information: section name: Shared
Source: EarnPackage.exe.5.dr	Static PE information: section name: _abtt_1
Source: EarnPackage.exe.5.dr	Static PE information: section name: _actt_1
Source: EarnPackage.exe.5.dr	Static PE information: section name: _adtt_1
Source: sqlite3.dll.5.dr	Static PE information: section name: /4
Source: sqlite3.dll.5.dr	Static PE information: section name: /19
Source: sqlite3.dll.5.dr	Static PE information: section name: /35
Source: sqlite3.dll.5.dr	Static PE information: section name: /51
Source: sqlite3.dll.5.dr	Static PE information: section name: /63
Source: sqlite3.dll.5.dr	Static PE information: section name: /77
Source: sqlite3.dll.5.dr	Static PE information: section name: /89
Source: sqlite3.dll.5.dr	Static PE information: section name: /102
Source: sqlite3.dll.5.dr	Static PE information: section name: /113
Source: sqlite3.dll.5.dr	Static PE information: section name: /124

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_004065C8 push 00406605h; ret	0_2_004065FD
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_004040B5 push eax; ret	0_2_004040F1
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00408104 push ecx; mov dword ptr [esp], eax	0_2_00408109
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00404185 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00404206 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_0040C218 push eax; ret	0_2_0040C219
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_004042E8 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00404283 push 00404391h; ret	0_2_00404389
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: 0_2_00408F38 push 00408F6Bh; ret	0_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0040994C push 00409989h; ret	1_2_00409981
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00483A6C push 00483B7Ah; ret	1_2_00483B72
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004062B4 push ecx; mov dword ptr [esp], eax	1_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004104E0 push ecx; mov dword ptr [esp], edx	1_2_004104E5
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0049481C push ecx; mov dword ptr [esp], ecx	1_2_00494821
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00412928 push 0041298Bh; ret	1_2_00412983
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0040CE38 push ecx; mov dword ptr [esp], edx	1_2_0040CE3A
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0048515C push ecx; mov dword ptr [esp], ecx	1_2_00485161
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00459120 push 00459164h; ret	1_2_0045915C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0040F398 push ecx; mov dword ptr [esp], edx	1_2_0040F39A
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00443440 push ecx; mov dword ptr [esp], ecx	1_2_00443444
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0040546D push eax; ret	1_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0040553D push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004055BE push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00477628 push ecx; mov dword ptr [esp], edx	1_2_00477629
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0040563B push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004056A0 push 00405749h; ret	1_2_00405741
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004517F8 push 0045182Bh; ret	1_2_00451823
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004519BC push ecx; mov dword ptr [esp], eax	1_2_004519C1
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0045FB90 push ecx; mov dword ptr [esp], ecx	1_2_0045FB94
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00419C28 push ecx; mov dword ptr [esp], ecx	1_2_00419C2D
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00499D1C pushad ; retf	1_2_00499D2B

Source: videominimizer32.exe.1.dr	Static PE information: section name: .text entropy: 7.751631091566533
Source: EarnPackage.exe.5.dr	Static PE information: section name: .text entropy: 7.751631091566533

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		5_2_00401A4F
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		5_2_00ACE898

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\is-5K4VI.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	File created: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	File created: C:\ProgramData\EarnPackage\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-KHIDH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\sqlite3.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-MHLT1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-RIK92.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-61IGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-60ALK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-ITRAP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-OP2NP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\ltkrn13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	File created: C:\Users\user\AppData\Local\Video Minimizer 1.77\LTDIS13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	File created: C:\ProgramData\EarnPackage\EarnPackage.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	File created: C:\ProgramData\EarnPackage\sqlite3.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	File created: C:\ProgramData\EarnPackage\EarnPackage.exe			Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		5_2_00401A4F
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		5_2_00ACE898

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12125"

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00402812 lstrcmpiW,StartServiceCtrlDispatcherA,

5_2_00402812

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	1_2_00423C0C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004241DC IsIconic,SetActiveWindow,SetFocus,	1_2_004241DC
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00424194 IsIconic,SetActiveWindow,	1_2_00424194
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	1_2_00418384
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	1_2_0042285C
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00483420 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	1_2_00483420
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00417598 IsIconic,GetCapture,	1_2_00417598
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00417CCE IsIconic,SetWindowPos,	1_2_00417CCE
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	1_2_00417CD0

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

1_2_0041F118

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		5_2_00401B4B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		5_2_00ACE99C

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\is-5K4VI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-KHIDH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-MHLT1.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-RIK92.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-61IGP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-60ALK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-ITRAP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-OP2NP.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\ltkrn13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Video Minimizer 1.77\LTDIS13n.dll (copy)	Jump to dropped file

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-5543

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

API coverage: 4.9 %

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe TID: 6156	Thread sleep count: 81 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe TID: 6156	Thread sleep time: -162000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe TID: 5896	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe TID: 5896	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00452A60 FindFirstFileA,GetLastError,	1_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00474DFC FindFirstFileA,FindNextFileA,FindClose,	1_2_00474DFC
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_004625C4 FindFirstFileA,FindNextFileA,FindClose,	1_2_004625C4
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00463B50 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463B50
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00497C14 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	1_2_00497C14
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: 1_2_00463FCC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	1_2_00463FCC

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Code function: 0_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

0_2_00409B30

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: videominimizer32.exe, 00000005.00000002.3886512016.00000000031AF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: videominimizer32.exe, 00000005.00000002.3885770545.00000000007F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW]

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	API call chain: ExitProcess graph end node			graph_0-6675
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	API call chain: ExitProcess graph end node			graph_5-61839

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_5-61881

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00AD80F0 IsDebuggerPresent,

5_2_00AD80F0

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00ADE6AE RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

5_2_00ADE6AE

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_004502C0

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00AC5E4F RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_memset,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,_memset,_memset,_memset,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,_memset,_memset,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

5_2_00AC5E4F

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00AD80DA SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00AD80DA

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_00478024 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

1_2_00478024

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

1_2_0042E09C

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Code function: 5_2_00ACE850 cpuid

5_2_00ACE850

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: GetLocaleInfoA,	0_2_0040520C
Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe	Code function: GetLocaleInfoA,	0_2_00405258
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: GetLocaleInfoA,	1_2_00408568
Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	Code function: GetLocaleInfoA,	1_2_004085B4

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_00458418 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

1_2_00458418

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Code function: 0_2_004026C4 GetSystemTime,

0_2_004026C4

Source: C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Code function: 1_2_0045559C GetUserNameA,

1_2_0045559C

Source: C:\Users\user\Desktop\Ni2ghr9eUJ.exe

Code function: 0_2_00405CF4 GetVersionExA,

0_2_00405CF4

Stealing of Sensitive Information

Yara detected Socks5Systemz

Source: Yara match	File source: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3886391694.0000000002BC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: videominimizer32.exe PID: 5528, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.3886391694.0000000002BC2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: videominimizer32.exe PID: 5528, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	5_2_609660FA
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	5_2_6090C1D6
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,	5_2_60963143
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	5_2_6096A2BD
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,	5_2_6096923E
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,	5_2_6096A38C
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	5_2_6096748C
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	5_2_609254B1
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	5_2_6094B407
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6090F435 sqlite3_bind_parameter_index,	5_2_6090F435
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,	5_2_609255D4
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609255FF sqlite3_bind_text,	5_2_609255FF
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,	5_2_6096A5EE
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,	5_2_6094B54C
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,	5_2_60925686
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,	5_2_6094A6C5
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,	5_2_609256E5
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	5_2_6094B6ED
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6092562A sqlite3_bind_blob,	5_2_6092562A
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,	5_2_60925655
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	5_2_6094C64A
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	5_2_609687A7
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	5_2_6095F7F7
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,	5_2_6092570B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	5_2_6095F772
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	5_2_60925778
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6090577D sqlite3_bind_parameter_name,	5_2_6090577D
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	5_2_6094B764
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6090576B sqlite3_bind_parameter_count,	5_2_6090576B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	5_2_6094A894
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	5_2_6095F883
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,	5_2_6094C8C2
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,	5_2_6096281E
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,	5_2_6096583A
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,	5_2_6095F9AD
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	5_2_6094A92B
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6090EAE5 sqlite3_transfer_bindings,	5_2_6090EAE5
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	5_2_6095FB98
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	5_2_6095ECA6
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	5_2_6095FCCE
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,	5_2_6095FDAE
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,	5_2_60966DF1
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,	5_2_60969D75
Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	Code function: 5_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	5_2_6095FFB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	5 Windows Service	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	1 Scheduled Task/Job	1 Access Token Manipulation	22 Software Packing	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Bootkit	5 Windows Service	1 DLL Side-Loading	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	2 Process Injection	1 Masquerading	LSA Secrets	141 Security Software Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	121 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ni2ghr9eUJ.exe	26%	ReversingLabs	Win32.Trojan.Munp

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe	100%	Joe Sandbox ML
C:\ProgramData\EarnPackage\EarnPackage.exe	100%	Joe Sandbox ML
C:\ProgramData\EarnPackage\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\LTDIS13n.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\gdiplus.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-60ALK.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-61IGP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-ITRAP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-KHIDH.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-MHLT1.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-OP2NP.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\is-RIK92.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\ltkrn13n.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcp71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcr71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\sqlite3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\is-5K4VI.tmp	3%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\unins000.exe (copy)	3%	ReversingLabs
C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.dll (copy)	0%	ReversingLabs

Source	Detection	Scanner	Label
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650f2ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda33231dd4398f	0%	Avira URL Cloud	safe
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4	0%	Avira URL Cloud	safe
https://188.119.66.185/en-US	0%	Avira URL Cloud	safe
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4ce71bc34f7f632ef3b70caaf94cda9ea6967478d3f44cc588fa45d7d69a43faeaa5960502d18f414ad332231ad7308bd0d59d5e	0%	Avira URL Cloud	safe
http://liba52.sourceforge.net/B6.4.0.1	0%	Avira URL Cloud	safe
http://www.audiocoding.com/	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650f2ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda33231dd4398f	false	Avira URL Cloud: safe	unknown
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4ce71bc34f7f632ef3b70caaf94cda9ea6967478d3f44cc588fa45d7d69a43faeaa5960502d18f414ad332231ad7308bd0d59d5e	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.innosetup.com/	Ni2ghr9eUJ.tmp, Ni2ghr9eUJ.tmp, 00000001.00000000.2021656504.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-5K4VI.tmp.1.dr, Ni2ghr9eUJ.tmp.0.dr	false		high
http://www.remobjects.com/psU	Ni2ghr9eUJ.exe, 00000000.00000003.2020969404.0000000002098000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020618096.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000000.2021656504.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-5K4VI.tmp.1.dr, Ni2ghr9eUJ.tmp.0.dr	false		high
http://liba52.sourceforge.net/B6.4.0.1	videominimizer32.exe, 00000005.00000000.2036315085.00000000004D5000.00000002.00000001.01000000.00000009.sdmp, videominimizer32.exe.1.dr, is-TNDK0.tmp.1.dr, EarnPackage.exe.5.dr	false	Avira URL Cloud: safe	unknown
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4	videominimizer32.exe, 00000005.00000002.3885770545.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3885770545.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://188.119.66.185/en-US	videominimizer32.exe, 00000005.00000002.3886512016.00000000031A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.videolan.org/dtsdec.html96.4.0.2	videominimizer32.exe, 00000005.00000000.2036315085.00000000004D5000.00000002.00000001.01000000.00000009.sdmp, videominimizer32.exe.1.dr, is-TNDK0.tmp.1.dr, EarnPackage.exe.5.dr	false		high
https://188.119.66.185/	videominimizer32.exe, 00000005.00000002.3886512016.00000000031C2000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3886512016.00000000031A0000.00000004.00000020.00020000.00000000.sdmp, videominimizer32.exe, 00000005.00000002.3885770545.00000000008CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.remobjects.com/ps	Ni2ghr9eUJ.exe, 00000000.00000003.2020969404.0000000002098000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020618096.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, Ni2ghr9eUJ.tmp, 00000001.00000000.2021656504.0000000000401000.00000020.00000001.01000000.00000004.sdmp, is-5K4VI.tmp.1.dr, Ni2ghr9eUJ.tmp.0.dr	false		high
https://www.easycutstudio.com/support.html	Ni2ghr9eUJ.exe, 00000000.00000002.3885559314.0000000002091000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020104217.00000000023C0000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.exe, 00000000.00000003.2020261456.0000000002091000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000002.3885891099.00000000022E8000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000003.2022780749.00000000022E8000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000003.2022705233.0000000003230000.00000004.00001000.00020000.00000000.sdmp, Ni2ghr9eUJ.tmp, 00000001.00000002.3885621428.0000000000792000.00000004.00000020.00020000.00000000.sdmp	false		high
https://188.119.66.185/ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b325	videominimizer32.exe, 00000005.00000002.3886512016.00000000031A0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.audiocoding.com/	videominimizer32.exe, 00000005.00000000.2036315085.00000000004D5000.00000002.00000001.01000000.00000009.sdmp, videominimizer32.exe.1.dr, is-TNDK0.tmp.1.dr, EarnPackage.exe.5.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
31.214.157.206	unknown	Germany		58329	RACKPLACEDE	false
188.119.66.185	unknown	Russian Federation		209499	FLYNETRU	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1574298
Start date and time:	2024-12-13 08:24:42 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ni2ghr9eUJ.exe renamed because original name is a hash value
Original Sample Name:	c7df4c7117c0ea3fc75667d1b09db5e8.exe
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@8/30@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 201 Number of non-executed functions: 302
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Ni2ghr9eUJ.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
31.214.157.206	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse
	7i6bUvYZ4L.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
188.119.66.185	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse
	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse
	7i6bUvYZ4L.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
RACKPLACEDE	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	7i6bUvYZ4L.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
	file.exe	Get hash	malicious	Socks5Systemz	Browse	31.214.157.206
FLYNETRU	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	7i6bUvYZ4L.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	https://drive.google.com/file/d/1yoYdaJg2olHzjqEKXjn6nnXKPPak7HoL/view?usp=sharing_eil&ts=675747b9	Get hash	malicious	Unknown	Browse	188.119.66.154

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
51c64c77e60f3980eea90869b68c58a8	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	7i6bUvYZ4L.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185
	17Xmvtq2Tq.exe	Get hash	malicious	Vidar	Browse	188.119.66.185
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	188.119.66.185
	file.exe	Get hash	malicious	Socks5Systemz	Browse	188.119.66.185

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\EarnPackage\sqlite3.dll	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse
	2mtt3zE6Vh.exe	Get hash	malicious	Socks5Systemz	Browse
	7i6bUvYZ4L.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	imMQqf6YWk.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse

Created / dropped Files

C:\ProgramData\EarnPackage\EarnPackage.exe

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3191062
Entropy (8bit):	6.448717575265652
Encrypted:	false
SSDEEP:	49152:mfODTVo396X9driyYw3nDZwE2nnhq+facnw+W:WODJoW9Biy13nDZknnhPfacw+W
MD5:	624F0DE58BEEA53641A6304AE005CB48
SHA1:	AEE9BF070824DAB00026A442FD91FF0B2E97A54D
SHA-256:	DBA536ED37D38DF9687579923EBC89D8A84A34E7B2976FCBDBB745F1165A135F
SHA-512:	E46961298F80A822C486CAEC55C4977FA65F781868021C85F406F5AF31C14FFD85991F46157B9767A880647B2663D6B4607E8036C534316498C6ED40F5079F30
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\EarnPackage\EarnPackage.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....[g.....................(.......]............@.......................... 1.....\|\|1..............................................P..X...............................................................................@............................text...j........................... ..`_abtt_1.............................@..@_actt_1.xd.......0..................@....rsrc........P......................@..@_adtt_1.............................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EarnPackage\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2mtt3zE6Vh.exe, Detection: malicious, Browse Filename: 2mtt3zE6Vh.exe, Detection: malicious, Browse Filename: 7i6bUvYZ4L.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: imMQqf6YWk.exe, Detection: malicious, Browse Filename: imMQqf6YWk.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\ProgramData\ea1212it56.dat

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe
File Type:	ISO-8859 text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:F+S/n:bn
MD5:	3D7AE91DA49E9A081F466B03651752D8
SHA1:	7E13E7D56375583E52C49360D14B8716FA0C3021
SHA-256:	D39AB24A42A14F8B4B71E0B2F5C14C79339B9A591941AEC4512DAF20E9165F1F
SHA-512:	900A105265E04FD5F8F0AA71B7FFBA34E867DA439981B777C304E3CC75ADACE1BFE87C1367687B7EB93C7451E2110C9780EDC634EC5990BCC864E889DB7FCB27
Malicious:	false
Preview:	..[g....

C:\ProgramData\ea1212rc56.dat

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:M:M
MD5:	4352D88A78AA39750BF70CD6F27BCAA5
SHA1:	3C585604E87F855973731FEA83E21FAB9392D2FC
SHA-256:	67ABDD721024F0FF4E0B3F4C2FC13BC5BAD42D0B7851D456D88D203D15AAA450
SHA-512:	EDF92E3D4F80FC47D948EA2F17B9BFC742D34E2E785A7A4927F3E261E8BD9D400B648BFF2123B8396D24FB28F5869979E08D58B4B5D156E640344A2C0A54675D
Malicious:	false
Preview:	....

C:\ProgramData\ea1212resa.dat

Download File

Process:	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9012093522336393
Encrypted:	false
SSDEEP:	3:ObXXXd0AbDBdUBWetxt:Or9Lb3UFx
MD5:	679DD163372163CD8FFC24E3C9E758B3
SHA1:	F307C14CA65810C8D0238B89B49B2ACD7C5B233B
SHA-256:	510EA89D00FA427C33BD67AEEA60D21066976F085959C2AFE1F69411A8CA722D
SHA-512:	46C464F15BCE39E28DCD48AF36C424845631D2B48D7E37D7FBBBEE0BC4DF32445A2810E397BF29FCA76C0364B1AA30CC05DCF4D9E799C6C697B49A174560969C
Malicious:	false
Preview:	12b48997735ce8b4537cf99be74bb62f518d3799011c89eb7c719048e83fac56................................................................

C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

Download File

Process:	C:\Users\user\Desktop\Ni2ghr9eUJ.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	705536
Entropy (8bit):	6.505787173623696
Encrypted:	false
SSDEEP:	12288:kTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORu4VwRxyF:4PcYn5c/rPx37/zHBA6pDp2mIEi4CRx+
MD5:	B4D4F779EA9E1F6AC0828B0B21EE319A
SHA1:	7862EA3B0C9EAE8E4E24125D63E5A8DDBC0BF588
SHA-256:	422CF23BE87C93223D11DAA8E74C3C8C5AF80C70CD8EFF1F501DA70E612014A6
SHA-512:	EC52C6F8B83C5088BE39988F067D93C6A183A95C98B5BBE4119625F7925C3F274F969271722C3171300CF4943D076B0DDD1A6D5ED38EDE849A3976BADC99D065
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.289297026665552
Encrypted:	false
SSDEEP:	48:Sv1LfWvPcXegCPUo1vlZQrAxoONfHFZONfH3d1xCWMBFNL2pGSS4k+bkg6j0KHc:wfkcXegaJ/ZAYNzcld1xaX12pfSKvkc
MD5:	C8871EFD8AF2CF4D9D42D1FF8FADBF89
SHA1:	D0EACD5322C036554D509C7566F0BCC7607209BD
SHA-256:	E4FC574A01B272C2D0AED0EC813F6D75212E2A15A5F5C417129DD65D69768F40
SHA-512:	2735BB610060F749E26ACD86F2DF2B8A05F2BDD3DCCF3E4B2946EBB21BA0805FB492C474B1EEB2C5B8BF1A421F7C1B8728245F649C644F4A9ECC5BD8770A16F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....HP..........#............................@.............................`..............................................................<!.......P.......@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc........P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\LTDIS13n.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.4472652154517345
Encrypted:	false
SSDEEP:	6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
MD5:	752CA72DE243F44AF2ED3FF023EF826E
SHA1:	7B508F6B72BD270A861B368EC9FE4BF55D8D472F
SHA-256:	F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
SHA-512:	4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\gdiplus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-2Q5CI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	78183
Entropy (8bit):	7.692742945771669
Encrypted:	false
SSDEEP:	1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
MD5:	B1B9E6D43319F6D4E52ED858C5726A97
SHA1:	5033047A30CCCF57783C600FD76A6D220021B19D
SHA-256:	8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
SHA-512:	E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
Malicious:	false
Preview:	ITSF....`..........E.......\|.{.......".....\|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...\|.{./Auto-SmartPatchCosmet

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-60ALK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-61IGP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.439135831549689
Encrypted:	false
SSDEEP:	12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
MD5:	CAC7E17311797C5471733638C0DC1F01
SHA1:	58E0BD1B63525A2955439CB9BE3431CEA7FF1121
SHA-256:	19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
SHA-512:	A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-ITRAP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-KHIDH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-MHLT1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-OP2NP.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.204917493416147
Encrypted:	false
SSDEEP:	3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
MD5:	FEC4FF0C2967A05543747E8D552CF9DF
SHA1:	B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
SHA-256:	5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
SHA-512:	93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-RIK92.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.4472652154517345
Encrypted:	false
SSDEEP:	6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
MD5:	752CA72DE243F44AF2ED3FF023EF826E
SHA1:	7B508F6B72BD270A861B368EC9FE4BF55D8D472F
SHA-256:	F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
SHA-512:	4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-TNDK0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	data
Category:	dropped
Size (bytes):	3191062
Entropy (8bit):	6.448717168800787
Encrypted:	false
SSDEEP:	49152:DfODTVo396X9driyYw3nDZwE2nnhq+facnw+W:jODJoW9Biy13nDZknnhPfacw+W
MD5:	542D4CE2B17CCD6138E1A4478AE0A9D5
SHA1:	06D0625097C209CB713F33B9139A47CF2EF4FD75
SHA-256:	139F113DC13CBFAACA02C70233EBD37FA9C868AE2DB73AF19051486E2FF6AF4D
SHA-512:	B4DDE15AEB95CFB3FBD8F0C4A477C91203DEC76688000B21F85C8954D35A35F35D8EB5C7E68C94514E6A010FB70F7DA4BBBB84EFD43982CE2C0BCCC47DA5968E
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\is-TNDK0.tmp, Author: Joe Security
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....[g.....................(.......]............@.......................... 1.....\|\|1..............................................P..X...............................................................................@............................text...j........................... ..`_abtt_1.............................@..@_actt_1.xd.......0..................@....rsrc........P......................@..@_adtt_1.............................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\ltkrn13n.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.439135831549689
Encrypted:	false
SSDEEP:	12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
MD5:	CAC7E17311797C5471733638C0DC1F01
SHA1:	58E0BD1B63525A2955439CB9BE3431CEA7FF1121
SHA-256:	19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
SHA-512:	A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\is-5K4VI.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	716789
Entropy (8bit):	6.514245354995985
Encrypted:	false
SSDEEP:	12288:sTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORu4VwRxyFJ:wPcYn5c/rPx37/zHBA6pDp2mIEi4CRxe
MD5:	DAE3749FEB9FFE7F74FB1BFF7A3B0922
SHA1:	CA65A423D082614D9A4740A4C7F05B60083D409D
SHA-256:	64A62CC1B82D79E62FAA3487D07B780EA8D7C3779139AAB969E257708677E2B4
SHA-512:	3A58EDA117AA1B1CF1CDDC8B46900D7868375475665554FAF7F06F9C222AE2AD8EEBA211A31F51F16FBB08A7AA6C812F8B7937D6E9682F59B8B8A03AE58766FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	InnoSetup Log Video Minimizer, version 0x30, 4844 bytes, 760639\user, "C:\Users\user\AppData\Local\Video Minimizer 1.77"
Category:	dropped
Size (bytes):	4844
Entropy (8bit):	4.77344385330656
Encrypted:	false
SSDEEP:	96:lcRjctW8j289pkcZagxn9e+eOIhEsa7ICSss/Lnmv4LPHNMOqtIEC9/:btW8iapkc3xNHIh4ICSsAnz9
MD5:	4BB10EFBF1735A215033500635231711
SHA1:	3279282D9107CA928BA954EE1F0A025E366DC4F9
SHA-256:	E0C53CDC904B2FF6B3B13732D40AE56D9D783DA869390EF0C64388EF757A8C34
SHA-512:	D9C59A69B7E7556EBBCA1FFB3239006C039F29FEA7C6327DB8EF366701725292D2322CB1C8A2418BC7FA4F93E18EFFC8AF8C30D0616C4BE171DA0A0338C81F27
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................Video Minimizer.................................................................................................................Video Minimizer.................................................................................................................0...........%...............................................................................................................i..%..........0Y......S....760639.user2C:\Users\user\AppData\Local\Video Minimizer 1.77...............-.. ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:Use

C:\Users\user\AppData\Local\Video Minimizer 1.77\uninstall\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	716789
Entropy (8bit):	6.514245354995985
Encrypted:	false
SSDEEP:	12288:sTPcYn5c/rPx37/zHBA6a5Ueyp2CrIEROlnrNORu4VwRxyFJ:wPcYn5c/rPx37/zHBA6pDp2mIEi4CRxe
MD5:	DAE3749FEB9FFE7F74FB1BFF7A3B0922
SHA1:	CA65A423D082614D9A4740A4C7F05B60083D409D
SHA-256:	64A62CC1B82D79E62FAA3487D07B780EA8D7C3779139AAB969E257708677E2B4
SHA-512:	3A58EDA117AA1B1CF1CDDC8B46900D7868375475665554FAF7F06F9C222AE2AD8EEBA211A31F51F16FBB08A7AA6C812F8B7937D6E9682F59B8B8A03AE58766FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................z........................@..............................................@...............................%..................................................................................................................CODE....\y.......z.................. ..`DATA.................~..............@...BSS......................................idata...%.......&..................@....tls.....................................rdata..............................@..P.reloc...... ......................@..P.rsrc...............................@..P.....................P..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	78183
Entropy (8bit):	7.692742945771669
Encrypted:	false
SSDEEP:	1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
MD5:	B1B9E6D43319F6D4E52ED858C5726A97
SHA1:	5033047A30CCCF57783C600FD76A6D220021B19D
SHA-256:	8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
SHA-512:	E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
Malicious:	false
Preview:	ITSF....`..........E.......\|.{.......".....\|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...\|.{./Auto-SmartPatchCosmet

C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.204917493416147
Encrypted:	false
SSDEEP:	3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
MD5:	FEC4FF0C2967A05543747E8D552CF9DF
SHA1:	B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
SHA-256:	5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
SHA-512:	93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	3191062
Entropy (8bit):	6.448717575265652
Encrypted:	false
SSDEEP:	49152:mfODTVo396X9driyYw3nDZwE2nnhq+facnw+W:WODJoW9Biy13nDZknnhPfacw+W
MD5:	624F0DE58BEEA53641A6304AE005CB48
SHA1:	AEE9BF070824DAB00026A442FD91FF0B2E97A54D
SHA-256:	DBA536ED37D38DF9687579923EBC89D8A84A34E7B2976FCBDBB745F1165A135F
SHA-512:	E46961298F80A822C486CAEC55C4977FA65F781868021C85F406F5AF31C14FFD85991F46157B9767A880647B2663D6B4607E8036C534316498C6ED40F5079F30
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L.....[g.....................(.......]............@.......................... 1.....\|\|1..............................................P..X...............................................................................@............................text...j........................... ..`_abtt_1.............................@..@_actt_1.xd.......0..................@....rsrc........P......................@..@_adtt_1.............................`.+.........................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.998279535609148
TrID:	Win32 Executable (generic) a (10002005/4) 98.86% Inno Setup installer (109748/4) 1.08% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Ni2ghr9eUJ.exe
File size:	4'019'237 bytes
MD5:	c7df4c7117c0ea3fc75667d1b09db5e8
SHA1:	d1adda0415be3e1499bd41cc45db354026d1a499
SHA256:	1f8b6dd65f2ce836562b17f850644b7c0d265f5c770f65ccfcc4481e9e3b02dc
SHA512:	79618d4cbf0a688f2e02a8ca573d3bde0b82756e54141de65659b29cc52b01ced246f7a4fd501dd8654999fb17ca326963b2bcda8c132a006eab5a28efe61d1e
SSDEEP:	98304:Iv9Ekqc5MQhT4fSGPXnqqk10qbbmz4qj+sbq2:U9EqhhEfjPXqqk10q0jBd
TLSH:	EA1633177DD94578F242183A18E17EED44123F6318BB1B8CB0BACD989F77868D2587CA
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Static PE Info

General

Entrypoint:	0x409c40
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	1
OS Version Minor:	0
File Version Major:	1
File Version Minor:	0
Subsystem Version Major:	1
Subsystem Version Minor:	0
Import Hash:	884310b1928934402ea6fec1dbd3cf5e

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
push ebx
push esi
push edi
xor eax, eax
mov dword ptr [ebp-10h], eax
mov dword ptr [ebp-24h], eax
call 00007FF87451D9BBh
call 00007FF87451EBC2h
call 00007FF87451EE51h
call 00007FF87451EEF4h
call 00007FF874520E93h
call 00007FF8745237FEh
call 00007FF874523965h
xor eax, eax
push ebp
push 0040A2FCh
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
xor edx, edx
push ebp
push 0040A2C5h
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
mov eax, dword ptr [0040C014h]
call 00007FF8745243CBh
call 00007FF874523FFEh
lea edx, dword ptr [ebp-10h]
xor eax, eax
call 00007FF8745214B8h
mov edx, dword ptr [ebp-10h]
mov eax, 0040CE24h
call 00007FF87451DA67h
push 00000002h
push 00000000h
push 00000001h
mov ecx, dword ptr [0040CE24h]
mov dl, 01h
mov eax, 0040738Ch
call 00007FF874521D47h
mov dword ptr [0040CE28h], eax
xor edx, edx
push ebp
push 0040A27Dh
push dword ptr fs:[edx]
mov dword ptr fs:[edx], esp
call 00007FF87452443Bh
mov dword ptr [0040CE30h], eax
mov eax, dword ptr [0040CE30h]
cmp dword ptr [eax+0Ch], 01h
jne 00007FF87452457Ah
mov eax, dword ptr [0040CE30h]
mov edx, 00000028h
call 00007FF874522148h
mov edx, dword ptr [00000030h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd000	0x950	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x11000	0x2c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x9364	0x9400	e8a38c5eb0d717d3fb478c7e19f20477	False	0.6147856841216216	data	6.563139352016593	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xb000	0x24c	0x400	5d98c64569668b0235ae89005918165a	False	0.3046875	data	2.7373065622921344	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xc000	0xe88	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd000	0x950	0xa00	bb5485bf968b970e5ea81292af2acdba	False	0.414453125	data	4.430733069799036	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xe000	0x8	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf000	0x18	0x200	9ba824905bf9c7922b6fc87a38b74366	False	0.052734375	data	0.2044881574398449	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x10000	0x8b4	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x11000	0x2c00	0x2c00	3824b00ad83284733f59af3c83a83df9	False	0.3259055397727273	data	4.4972864265663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x11354	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	Dutch	Netherlands	0.5675675675675675
RT_ICON	0x1147c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	Dutch	Netherlands	0.4486994219653179
RT_ICON	0x119e4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	Dutch	Netherlands	0.4637096774193548
RT_ICON	0x11ccc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	Dutch	Netherlands	0.3935018050541516
RT_STRING	0x12574	0x2f2	data			0.35543766578249336
RT_STRING	0x12868	0x30c	data			0.3871794871794872
RT_STRING	0x12b74	0x2ce	data			0.42618384401114207
RT_STRING	0x12e44	0x68	data			0.75
RT_STRING	0x12eac	0xb4	data			0.6277777777777778
RT_STRING	0x12f60	0xae	data			0.5344827586206896
RT_RCDATA	0x13010	0x2c	data			1.1590909090909092
RT_GROUP_ICON	0x1303c	0x3e	data	English	United States	0.8387096774193549
RT_VERSION	0x1307c	0x4b8	COM executable for DOS	English	United States	0.2740066225165563
RT_MANIFEST	0x13534	0x5a4	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.42590027700831024

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
user32.dll	MessageBoxA
oleaut32.dll	VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
kernel32.dll	WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
user32.dll	TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
comctl32.dll	InitCommonControls
advapi32.dll	AdjustTokenPrivileges

Possible Origin

Language of compilation system	Country where language is spoken	Map
Dutch	Netherlands
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-13T08:27:36.697855+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49946	188.119.66.185	443	TCP
2024-12-13T08:27:37.381237+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49946	188.119.66.185	443	TCP
2024-12-13T08:27:42.233817+0100	2028765	ET JA3 Hash - [Abuse.ch] Possible Dridex	3	192.168.2.5	49963	188.119.66.185	443	TCP
2024-12-13T08:27:42.925059+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49963	188.119.66.185	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 13, 2024 08:27:35.023561001 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:35.023611069 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:35.023739100 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:35.049542904 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:35.049566984 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:36.697706938 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:36.697854996 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:36.760586023 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:36.760618925 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:36.761109114 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:36.761542082 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:36.767483950 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:36.815329075 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:37.381273985 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:37.381356955 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:37.381505013 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:37.395272017 CET	49946	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:37.395299911 CET	443	49946	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:37.396338940 CET	49953	2024	192.168.2.5	31.214.157.206
Dec 13, 2024 08:27:37.517491102 CET	2024	49953	31.214.157.206	192.168.2.5
Dec 13, 2024 08:27:37.517606974 CET	49953	2024	192.168.2.5	31.214.157.206
Dec 13, 2024 08:27:37.517748117 CET	49953	2024	192.168.2.5	31.214.157.206
Dec 13, 2024 08:27:37.637411118 CET	2024	49953	31.214.157.206	192.168.2.5
Dec 13, 2024 08:27:37.637646914 CET	49953	2024	192.168.2.5	31.214.157.206
Dec 13, 2024 08:27:37.757457018 CET	2024	49953	31.214.157.206	192.168.2.5
Dec 13, 2024 08:27:38.759556055 CET	2024	49953	31.214.157.206	192.168.2.5
Dec 13, 2024 08:27:38.800844908 CET	49953	2024	192.168.2.5	31.214.157.206
Dec 13, 2024 08:27:40.772548914 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:40.772603989 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:40.772758961 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:40.773336887 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:40.773370981 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:42.233671904 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:42.233817101 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:42.234189987 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:42.234220028 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:42.234380960 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:42.234394073 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:42.925096989 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:42.925163984 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:42.925182104 CET	443	49963	188.119.66.185	192.168.2.5
Dec 13, 2024 08:27:42.925225019 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:42.927767992 CET	49963	443	192.168.2.5	188.119.66.185
Dec 13, 2024 08:27:42.927794933 CET	443	49963	188.119.66.185	192.168.2.5

HTTP Request Dependency Graph

188.119.66.185

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49946	188.119.66.185	443	5528	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 07:27:36 UTC	283	OUT	GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b82a8dcd6c946851e300888b3250aa15d005633775b0e650f2ba1e9c95b1c92975ccf55bc592fe5a818ece02a1b7e2984c57cad7021dda33231dd4398f HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-13 07:27:37 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 07:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-13 07:27:37 UTC	846	IN	Data Raw: 33 34 32 0d 0a 38 62 37 32 33 63 36 38 65 65 31 38 34 30 33 63 36 36 30 66 62 66 65 30 33 38 34 63 32 37 62 36 62 63 38 66 38 30 32 32 34 63 62 64 33 62 63 31 39 30 32 34 39 66 37 65 31 36 66 65 30 34 64 64 65 37 36 37 34 62 62 33 35 63 38 64 31 65 33 66 37 38 37 61 61 30 61 66 30 64 39 62 66 35 30 31 64 32 39 61 62 31 63 61 32 39 37 34 64 34 66 34 34 63 63 34 39 35 66 62 35 32 64 31 64 34 39 35 35 34 61 63 62 36 66 34 63 61 30 61 30 32 63 35 63 38 30 32 31 38 63 30 33 32 32 36 31 30 63 64 33 39 38 63 64 65 64 33 39 34 35 64 34 38 63 32 37 31 33 35 66 66 63 33 30 34 35 35 36 63 30 65 37 30 63 38 66 30 30 61 37 32 62 63 66 39 35 61 61 65 65 65 65 62 35 39 61 62 37 37 63 33 64 34 32 30 66 64 66 32 64 38 65 64 34 64 30 65 38 65 35 38 39 33 33 34 61 65 33 34 Data Ascii: 3428b723c68ee18403c660fbfe0384c27b6bc8f80224cbd3bc190249f7e16fe04dde7674bb35c8d1e3f787aa0af0d9bf501d29ab1ca2974d4f44cc495fb52d1d49554acb6f4ca0a02c5c80218c0322610cd398cded3945d48c27135ffc304556c0e70c8f00a72bcf95aaeeeeb59ab77c3d420fdf2d8ed4d0e8e589334ae34

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49963	188.119.66.185	443	5528	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-13 07:27:42 UTC	291	OUT	GET /ai/?key=8f3f2b3ae115416b731ce2a8231e72eee7c4db7e40b92a8dcd6c946a4fbd41879e7c4ce71bc34f7f632ef3b70caaf94cda9ea6967478d3f44cc588fa45d7d69a43faeaa5960502d18f414ad332231ad7308bd0d59d5e HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US) Host: 188.119.66.185
2024-12-13 07:27:42 UTC	200	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 13 Dec 2024 07:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/7.4.33
2024-12-13 07:27:42 UTC	24	IN	Data Raw: 65 0d 0a 38 62 37 32 33 36 36 33 65 63 31 33 32 35 0d 0a 30 0d 0a 0d 0a Data Ascii: e8b723663ec13250

Target ID:	0
Start time:	02:25:30
Start date:	13/12/2024
Path:	C:\Users\user\Desktop\Ni2ghr9eUJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ni2ghr9eUJ.exe"
Imagebase:	0x400000
File size:	4'019'237 bytes
MD5 hash:	C7DF4C7117C0EA3FC75667D1B09DB5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	1
Start time:	02:25:31
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp" /SL5="$20414,3770460,54272,C:\Users\user\Desktop\Ni2ghr9eUJ.exe"
Imagebase:	0x400000
File size:	705'536 bytes
MD5 hash:	B4D4F779EA9E1F6AC0828B0B21EE319A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	02:25:32
Start date:	13/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /Delete /F /TN "video_minimizer_12125"
Imagebase:	0xb10000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:25:32
Start date:	13/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:25:32
Start date:	13/12/2024
Path:	C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe" -i
Imagebase:	0x400000
File size:	3'191'062 bytes
MD5 hash:	624F0DE58BEEA53641A6304AE005CB48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000005.00000002.3886391694.0000000002BC2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000005.00000000.2035473597.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Video Minimizer 1.77\videominimizer32.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.5%
Total number of Nodes:	1463
Total number of Limit Nodes:	16

Executed Functions

Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B42
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B4D
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B8E
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BC0
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BD0

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction ID: 3002c4020e31fcb34e6ffc2d5983d7aa910ebdc8277ab133fd4bc27d875cdae8
Opcode Fuzzy Hash: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction Fuzzy Hash: F4219DB12003046BD7709AA99C85E5777E9EB85370F04082BFA89E32D3D239FC40C669

Function 0040520C Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction ID: 1248db9972fbf410c55bf070b604c98f5d62b90992f8f49b6b6440a9954d2c50
Opcode Fuzzy Hash: 08facca5f8c818d7ae0117448837c5e97f15c9e55cb3aedc2694e0bc5091a832
Instruction Fuzzy Hash: E2E0927170021427D710A9A99C86AEB725CEB58310F0002BFB904E73C6EDB49E804AED

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C60), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00409C60), ref: 004045C6

Strings

SetDllDirectoryW, xrefs: 00404589
SetSearchPathMode, xrefs: 0040459F
kernel32.dll, xrefs: 0040457D
SetProcessDEPPolicy, xrefs: 004045B5

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Function 0040A0E7 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040A0F4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,0208232C), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(00020414,000000FC,00409918), ref: 0040A148
RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020414,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

/SL5="$%x,%d,%d,, xrefs: 0040A188
STATIC, xrefs: 0040A12A
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ErrorLast$CreateDestroyDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3757039580-3001827809
Opcode ID: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
Instruction ID: f6a9afe5b3848034850d92184c83b7d566fc641e007638e18ad9d31f508a71de
Opcode Fuzzy Hash: 92d7a146f7fa7ea583be229cf1972f4387f7e731d45899e9009fd1a518b8a977
Instruction Fuzzy Hash: 3B411071600204DFD710EBA9EE86B9977A4EB45304F10467EF514B73E2C7B89811CB9D

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

Wow64RevertWow64FsRedirection, xrefs: 004090D4
Wow64DisableWow64FsRedirection, xrefs: 004090BA
shell32.dll, xrefs: 00409110
kernel32.dll, xrefs: 004090BF, 004090D9

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction ID: 4a4222b704d734fa8d0781b40c04fe9f9c76e7b4f133337d95099c0c8a01123f
Opcode Fuzzy Hash: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction Fuzzy Hash: 20017170748342AEFB00BB72DD4AB163A68E785704F50457BF5407A2D3DABD4C04DA6D

Function 0040A0D5 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(00020414,000000FC,00409918), ref: 0040A148

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040A1B9,?), ref: 00406B94

Part of subcall function 004099A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0208232C,00409A90,00000000,00409A77), ref: 00409A14
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0208232C,00409A90,00000000), ref: 00409A28
Part of subcall function 004099A4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
Part of subcall function 004099A4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0208232C,00409A90), ref: 00409A5C

RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
DestroyWindow.USER32(00020414,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

/SL5="$%x,%d,%d,, xrefs: 0040A188
STATIC, xrefs: 0040A12A
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
Instruction ID: bf8877be64b1eb53a955be5febe4cb156f3d413c702a3b20994545be7baf65d7
Opcode Fuzzy Hash: a64027cc69530ce26e0d020b421cb23cd984c73ff13cd53596b8d38fe4c4ed4c
Instruction Fuzzy Hash: 75411A71604204DFD714EBA9EE86B5A77A4EB49304F10427EE514B73E1CBB8A810CB9D

Function 004099A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0208232C,00409A90,00000000,00409A77), ref: 00409A14
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0208232C,00409A90,00000000), ref: 00409A28
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0208232C,00409A90), ref: 00409A5C

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,0208232C), ref: 0040966C

Strings

D, xrefs: 004099EE

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
Instruction ID: 6ea97129cf5aa135a7f7046e3a99eae43c862e8aca722617c6144c18eae127a8
Opcode Fuzzy Hash: 752074f715f169f8c9b0a2dfdb1d62babdf7ca20371da5ab86507c15e851728d
Instruction Fuzzy Hash: 3A1142B17442486EDB10EBE68C42FAEB7ACEF49714F50017BB604F72C2DA785D048A69

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: 38709c719971e1168baf9cdc3c67f999ad3db3ab521e9349fb3b390a12b3c6f3
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 00409E47 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
Instruction ID: 436c98ae07f88f71ec52beeb6e72a39fdb1c754e3b127fd60db974180cd34f4e
Opcode Fuzzy Hash: 025cb7c8070ceb0a973f57dc2423f3e96cefce6b80174f3a3145c26c436c6efd
Instruction Fuzzy Hash: 7541AC30600200DFC715EF25DE96A5A77A5EB49304B50463AF804B73E2CBB9AC05CBAD

Function 00409E62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
Instruction ID: effdcd9541676c6323f3fad609c54d18bb0bf767b5f2530b550772909ae59cb2
Opcode Fuzzy Hash: cf567291c84692d100e5ec609b282d55b3c5af0b5f3d357f2e8f357a6d06844b
Instruction Fuzzy Hash: 1F418D70610204DFC715EF25DED6A5A77A5EB49308B50463AF804B73E2CBB9AC05CBAD

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
Instruction ID: 229665e4fb482f752e04f7b041ef1ce89d659938bfc828767b82506ffacbf3f4
Opcode Fuzzy Hash: 7ba2b511fbcbba0bdafc57409f78771f2ffb69bdc1885ec5b7c8c3418ce725e0
Instruction Fuzzy Hash: 7C213774A04208ABDB05EFA1C8429DFB7B9EF88304F50457BE901B73C2DA7C9E059A65

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction ID: 20d0a63744b7af467993d3e8aec565234b7be2d060ba20bf9fd199bb98bd5a4e
Opcode Fuzzy Hash: 43d3196ec1ce5242573e8f450cfa6a0a1bc6604aabb0088ea34051851cbbaa4a
Instruction Fuzzy Hash: 8251D12294D2910FC7126B7849685A53FE0FE5331132E92FBC5C1AB1A3D27CA847D35B

Function 00401FD4 Relevance: 3.1, APIs: 2, Instructions: 122
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00402148), ref: 00402017

Part of subcall function 00401918: RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
Part of subcall function 00401918: RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
Part of subcall function 00401918: LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
Part of subcall function 00401918: RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction ID: b272be6629c35a549fc4f1c5a19e6e0df2414f51bb24a7fd7fb800939d1160d0
Opcode Fuzzy Hash: e41243de7c80276a36dcdd2c2c0e451bb1a6f3055e5ddec7aea90b49354f7273
Instruction Fuzzy Hash: D4419CB2A40711DFDB108F69DEC562A77A0FB58314B25837AD984B73E1D378A842CB48

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020803AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020803AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 00405280 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053B6), ref: 0040529F

Part of subcall function 00404CDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CF9

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction ID: b95c725f163960c8622ba1b0af82130980b93a97e76f79286a035b518bc8de08
Opcode Fuzzy Hash: ef449c44a2a61a26d18614e24c7ade2666283ce56a0d8fcdc2eeed56ad2c4646
Instruction Fuzzy Hash: 90314F75E01509ABCB00DF95C8C19EEB379FF84304F158577E815BB286E739AE068B98

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020803AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 7ef42d69529baecca532a801bf1eab389dc79dba057db81877db687b261eaad4
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02098000,0040A08C,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,020803AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction ID: 1e7236936b067224bcb0a7c190bcfb18a105a15b1652d3161176e1d0ad605fa4
Opcode Fuzzy Hash: 636722d4ca057b68616df378e1b8a5bd7f337355b9f7c137ab23b8dc1cafdb71
Instruction Fuzzy Hash: 43116371A042059BDB00EF19C881B5B7794AF44359F05807AF958AB2C6DB38E800CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Function 00409BEC Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BF6
SizeofResource.KERNEL32(00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 00409C09
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000), ref: 00409C1B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5), ref: 00409C2C

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction ID: ed04ed1443b666af2c347742ca0221af59beed1f1180006ed42e296f861e82c7
Opcode Fuzzy Hash: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction Fuzzy Hash: ECE07EA0B483562AFA6076FB08C2B2A018C4BA671DF40003BB701B92C3DEBD8C14856E

Function 00405258 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction ID: 1db3d1c1bb6fab5f91442dea8a08a829cd161d84d3a7e1f0c2fe21aaaafd944f
Opcode Fuzzy Hash: b79b605a6dbd2dbd76dc5df923bc970e8acc9169766131cf64cabc826e101d13
Instruction Fuzzy Hash: 9ED02EA230E2006AE210808B2C84EBB4A9CCEC53A0F00007FF648C3242D2208C029B76

Function 004026C4 Relevance: 1.5, APIs: 1, Instructions: 20timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 004026CE

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: SystemTime
String ID:
API String ID: 2656138-0
Opcode ID: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction ID: 69442b1fa125f02c17f5f00667ba5619268a94e84ed87230136e9e38920861ba
Opcode Fuzzy Hash: 1c1586f040ad907c453502297459692aa8199981632c93951a31d41848eff65d
Instruction Fuzzy Hash: 14E04F21E0010A82C704ABA5CD435EDF7AEAB95600B044272A418E92E0F631C251C748

Function 00405CF4 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,004065F0,00000000,004065FE,?,?,?,?,?,00409C6A), ref: 00405D02

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction ID: 4c33b40dd65743d8d98a5ffd827b1eb297e5dd4f71424004bfe2d5ab9b26ea54
Opcode Fuzzy Hash: 804cda8d473c4c61bcc63f12479ba9190822d5c554409fc9a119c77cb0a2aa37
Instruction Fuzzy Hash: 00C0126040070186D7109B31DC02B1672D4AB44310F4405396DA4963C2E73C80018A6E

Function 0040840C Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction ID: 7dc6dc86846b3232beed044054ddb30c9891ac2fec336679fba6e94018ae2b4c
Opcode Fuzzy Hash: 7cb438cf7f0ff76753a1d16800e3023f3e313fbbfbb21f985cf38b771b24bb28
Instruction Fuzzy Hash: C032D775E00219DFCB14CF99CA80AADB7B2BF88314F24816AD855B7385DB34AE42CF55

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 004070A1

Strings

GetUserDefaultUILanguage, xrefs: 00407043
kernel32.dll, xrefs: 00407048
.DEFAULT\Control Panel\International, xrefs: 00407078
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0
Locale, xrefs: 00407090

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: 84283e8ecd5f01446eeee6c4ca3ac4597d6d061694d9d4138b3ca6e7d0b19e25
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004053C4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,0040560C,?,?,?,?,00000000,00000000,00000000,?,004065EB,00000000,004065FE), ref: 004053DE

Part of subcall function 0040520C: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052D7,?,00000000,004053B6), ref: 0040522A

Part of subcall function 00405258: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040545A,?,?,?,00000000,0040560C), ref: 0040526B

Strings

mmmm d, yyyy, xrefs: 004054CF
:mm:ss, xrefs: 004055DA
:mm, xrefs: 004055C0
AMPM, xrefs: 004055A9
m/d/yy, xrefs: 004054AD

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction ID: cc137df54ae1fcbb63b87987e69a719e9c27c4b31815d0debc5c9b1d2781c89a
Opcode Fuzzy Hash: 2becd82198b95216644133442ecc563e5ef80f5327bc31795fb041598c227e39
Instruction Fuzzy Hash: F8515374B00548ABDB00EBA59891A5F7769DB88304F50D5BBB515BB3C6CA3DCA058F1C

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(004BAD00,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,004BAD00,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(004BBD00,?,00000000,00008000,004BAD00,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Error, xrefs: 00403D91
9@, xrefs: 00403D29, 00403D34
Runtime error at 00000000, xrefs: 00403D96, 00403DA9

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: 759139aa8138bb4f1b890a81a570935fc2f09484a8ccbcda4eb7e9d11bc9ffe5
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 004030DC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409C56), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409C56), ref: 004030EE

Strings

`&J, xrefs: 004030F3
U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@$`&J
API String ID: 2123368496-3451137920
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,004098D0,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction ID: 22a93fbabe645b78fd14ced98f65bd4bcb22fe3fd6f8222f7fa8e6a3c98f8dfc
Opcode Fuzzy Hash: 32d2d681139902fa63b50b1e86c1c6042aee641263ad409bd5d16b68eaa8278f
Instruction Fuzzy Hash: E6415E31D0021AAFDB21DF95C881BAFB7B8EB04704F56447AE901F7280D738AF108B99

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524

Memory Dump Source

Source File: 00000000.00000002.3885361813.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3885337251.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885387803.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3885406974.0000000000411000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Analysis Process: Ni2ghr9eUJ.tmpPID: 4408, Parent PID: 3624COMMON

Execution Graph

Execution Coverage:	15.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	80

Executed Functions

Function 0047051C Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 965COMMON

Download Yara Rule

Strings

Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470B29
Will register the file (a DLL/OCX) later., xrefs: 00471393
Installing the file., xrefs: 00470D7D
Non-default bitness: 32-bit, xrefs: 0047072F
Same version. Skipping., xrefs: 00470B59
Version of existing file: %u.%u.%u.%u, xrefs: 004709F0
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470B38
.tmp, xrefs: 00470E2B
Existing file has a later time stamp. Skipping., xrefs: 00470C43
Time stamp of our file: (failed to read), xrefs: 0047081B
@, xrefs: 00470624
Time stamp of existing file: %s, xrefs: 0047089F
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470C60
Dest filename: %s, xrefs: 00470708
Incrementing shared file count (64-bit)., xrefs: 00471400
Skipping due to "onlyifdoesntexist" flag., xrefs: 00470842
Will register the file (a type library) later., xrefs: 00471387
Dest file exists., xrefs: 0047082F
Skipping due to "onlyifdestfileexists" flag., xrefs: 00470D6E
Version of our file: %u.%u.%u.%u, xrefs: 00470964
Version of existing file: (none), xrefs: 00470B6E
-- File entry --, xrefs: 0047056F
Time stamp of existing file: (failed to read), xrefs: 004708AB
Same time stamp. Skipping., xrefs: 00470BC9
InUn, xrefs: 00470FD3
Stripped read-only attribute., xrefs: 00470D3B
Dest file is protected by Windows File Protection., xrefs: 00470761
Incrementing shared file count (32-bit)., xrefs: 00471419
Couldn't read time stamp. Skipping., xrefs: 00470BA9
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470D0A
User opted not to overwrite the existing file. Skipping., xrefs: 00470CC1
Time stamp of our file: %s, xrefs: 0047080F
Existing file is a newer version. Skipping., xrefs: 00470A76
Version of our file: (none), xrefs: 00470970
Non-default bitness: 64-bit, xrefs: 00470723
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470B44
Uninstaller requires administrator: %s, xrefs: 00471003
, xrefs: 00470A43, 00470C14, 00470C92
Failed to strip read-only attribute., xrefs: 00470D47
Installing into GAC, xrefs: 00471588

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing into GAC$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.
API String ID: 0-4021121268
Opcode ID: 9d68f8344ce4977df8583e247318b1194b32105c4f4fc62b9f0a4044c1636d2c
Instruction ID: b563e12d89f4af072a7005ff78b426759e5259748c8527a90f65f129335a0b73
Opcode Fuzzy Hash: 9d68f8344ce4977df8583e247318b1194b32105c4f4fc62b9f0a4044c1636d2c
Instruction Fuzzy Hash: 0B925234A0424CDFDB11DFA9C485BDDBBB5AF05308F1480ABE848A7392D778AE45CB59

Function 0042E09C Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0D6
GetVersion.KERNEL32(00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0F3
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E10C
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E112
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E280,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E127
FreeSid.ADVAPI32(00000000,0042E287,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E27A

Strings

1{I, xrefs: 0042E1A6, 0042E1D6, 0042E1E1, 0042E1E5, 0042E1A9, 0042E1E4, 0042E1E8
CheckTokenMembership, xrefs: 0042E102
advapi32.dll, xrefs: 0042E107

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: 1{I$CheckTokenMembership$advapi32.dll
API String ID: 2252812187-4020693264
Opcode ID: 99385c8667cd0eb2f7e8a761a457fbfbdd7e71a8091fdfbf45cde5befae85eff
Instruction ID: e5677345bf142a8b1d9111380f95962c8bb8cf61ba8e960ca5c3fd0f127139eb
Opcode Fuzzy Hash: 99385c8667cd0eb2f7e8a761a457fbfbdd7e71a8091fdfbf45cde5befae85eff
Instruction Fuzzy Hash: E351A271B44215EEEB10EAE69C42BBF77ACEB09704F9404BBB901F7281D57C99018B79

Function 004502C0 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00480636), ref: 004502D3
LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480636), ref: 004502EB
GetProcAddress.KERNEL32(6CF60000,RmStartSession), ref: 00450309
GetProcAddress.KERNEL32(6CF60000,RmRegisterResources), ref: 0045031E
GetProcAddress.KERNEL32(6CF60000,RmGetList), ref: 00450333
GetProcAddress.KERNEL32(6CF60000,RmShutdown), ref: 00450348
GetProcAddress.KERNEL32(6CF60000,RmRestart), ref: 0045035D
GetProcAddress.KERNEL32(6CF60000,RmEndSession), ref: 00450372

Strings

RmStartSession, xrefs: 004502FE
RmRegisterResources, xrefs: 00450313
RmRestart, xrefs: 00450352
RmGetList, xrefs: 00450328
RmShutdown, xrefs: 0045033D
RmEndSession, xrefs: 00450367
Rstrtmgr.dll, xrefs: 004502E6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction ID: c77cef2ad5653e61b65a4477cbb73d0d56cf7b8a9d174f96be3e9b6947252677
Opcode Fuzzy Hash: 2681632e5309952c30eea3f8c2bf2722b4339596373eceda0d07b93e3cd0d7e4
Instruction Fuzzy Hash: B211F7B4510301DBD710FB61BF45A2E36E9E728315B08063FE804961A2CB7C4844CF8C

Function 00423C0C Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9e250b99cf182ccbef41989ebe76349b30642d984367dffe3cd9cb4059d0181
Instruction ID: afb4f91cf4018cf9acc1c9974f14325182323c15c0e0405bd0f9b005e596376e
Opcode Fuzzy Hash: b9e250b99cf182ccbef41989ebe76349b30642d984367dffe3cd9cb4059d0181
Instruction Fuzzy Hash: 03E1AE31700124EFDB04DF69E989AADB7B5FB54300FA440AAE5559B352C73CEE81DB09

Function 00467218 Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0049543C: GetWindowRect.USER32(00000000), ref: 00495452

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 004675E7

Part of subcall function 0041D6B0: GetObjectA.GDI32(?,00000018,00467601), ref: 0041D6DB

Part of subcall function 00466FF4: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD
Part of subcall function 00466FF4: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114

Part of subcall function 004669B4: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC

Part of subcall function 004956C0: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 004956CA

Part of subcall function 0042ED38: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8
Part of subcall function 0042ED38: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0049538C: GetDC.USER32(00000000), ref: 004953AE
Part of subcall function 0049538C: SelectObject.GDI32(?,00000000), ref: 004953D4
Part of subcall function 0049538C: ReleaseDC.USER32(00000000,?), ref: 00495425

Part of subcall function 004956B0: MulDiv.KERNEL32(0000004B,?,00000006), ref: 004956BA

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,022EFAD8,022F1838,?,?,022F1868,?,?,022F18B8,?), ref: 00468271
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468282
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0046829A

Part of subcall function 0042A05C: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A072

Strings

(Default), xrefs: 00468883
STOPIMAGE, xrefs: 004675DC
, xrefs: 004676A9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectReleaseSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 3231140908-770201673
Opcode ID: d8aa18b457e06c76cf1710bd301156fff42577b8956d306d2f0c8863d05d0704
Instruction ID: 95164e1e617b107b44698f642e4cc1154f551ad52f4085116ed94e07ec8bca55
Opcode Fuzzy Hash: d8aa18b457e06c76cf1710bd301156fff42577b8956d306d2f0c8863d05d0704
Instruction Fuzzy Hash: BEF2C6786005148FCB00EB59D9D9F9973F1BF49304F1542BAE9049B36ADB74EC4ACB8A

Function 00474DFC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474E55
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F32
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00474F66,?,?,0049C1DC,00000000), ref: 00474F40

Strings

unins???.*, xrefs: 00474E3F
unins, xrefs: 00474EA8

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
Instruction ID: 31c653d7bd6b2cf4ad5ba67a359891eda5ad6ed959604e3cb46055c530bb22dc
Opcode Fuzzy Hash: 5e576b03208d2e259677c02318acd6f2ad4d278db2359f1cb77b12eb5b061527
Instruction Fuzzy Hash: 2A313370A001089FCB10EF65D991ADEB7A9DF85318F51C4B6F80CA76A2DB389F418B58

Function 00452A60 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452A9D
GetLastError.KERNEL32(00000000,?,00000000,00452AC3,?,?,-00000001,00000000), ref: 00452AA5

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction ID: 3e58272229af866f17ac5928e9872a720c3be2d4903e778e839a846eb7d55d53
Opcode Fuzzy Hash: 9c675a8f1f28b386d0fa8c71b8ecb41695e84785a8bb79b0d9bc0322d07a8b6a
Instruction Fuzzy Hash: 94F0F971A04604AB8B10EF669D4149EF7ACEB8672571046BBFC14E3282DAB84E0485A8

Function 0046DF58 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,0046DFEE), ref: 0046DF62
CoCreateInstance.OLE32(00499B84,00000000,00000001,00499B94,?,?,0046DFEE), ref: 0046DF7E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 590230f93a95ca5811c62fe34acfb8e2c0307c22a832fa8ed403bfd539588e2d
Instruction ID: 3442edb0ea1fabc64a92ad6c3e34ff78e3c28f6093e8310d9e86ee8e53d0260d
Opcode Fuzzy Hash: 590230f93a95ca5811c62fe34acfb8e2c0307c22a832fa8ed403bfd539588e2d
Instruction Fuzzy Hash: 4EF0A031B85200DEEB14A7A9DC45B463BD4BB24328F04007BF0448B295E3AC9850861F

Function 00408568 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction ID: 8daab3ef8e56b0da8b8c23f45c5b5388ad46b50bd825570c2d348c61856efc62
Opcode Fuzzy Hash: 64da881718ef9bfb5c3691e8182369eeaf442f2681d4624e7b5adc518b999176
Instruction Fuzzy Hash: BFE0223170021466C311AA2A9C86AEAB34C9758310F00427FB904E73C2EDB89E4042A8

Function 00423B84 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424151,?,00000000,0042415C), ref: 00423BAE

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: 03c86555d74cd6010afd77b9e61a524e96c156e733cd5bd8e2feacc4387cef90
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Function 0045559C Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 004555B2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction ID: 9f318ec9847dd9a6abcb639c8bc611599857aea0b867fcad4bfaeec6bdb042bf
Opcode Fuzzy Hash: 969018677e36c7ee3cac7a31a88a81c68082f6a067fe28717e4d5eb0c099a74a
Instruction Fuzzy Hash: 8FD0C27230470473CB00AA689C825AA35CD8B84305F00483E3CC5DA2C3FABDDA485756

Function 0042F520 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F53C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction ID: 7ca9c19e24a5def9c493c34941f9da96f9ca037215ec7a65a90973bf7a04e639
Opcode Fuzzy Hash: 9e43cbcd657a147b44e82c26281af1c584f356d37a2e763e4ec43db1fd6d4cd6
Instruction Fuzzy Hash: FCD09E7120011D7B9B00DE99E840D6B33AD9B88710B909925F945D7642D634ED9197A5

Function 0046EECC Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046ECB8: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB

Part of subcall function 0046ED28: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B

RegCloseKey.ADVAPI32(?,0046F571,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F5BC,?,?,0049C1DC,00000000), ref: 0046F564

Strings

Inno Setup: Setup Version, xrefs: 0046EFBD
Inno Setup: Selected Components, xrefs: 0046F09C
Inno Setup: Deselected Components, xrefs: 0046F0BB
MinorVersion, xrefs: 0046F405
Inno Setup: No Icons, xrefs: 0046F03F
URLInfoAbout, xrefs: 0046F2B2
_is1, xrefs: 0046EF28
DisplayIcon, xrefs: 0046F1E7
QuietUninstallString, xrefs: 0046F25B
Inno Setup: Deselected Tasks, xrefs: 0046F102
UninstallString, xrefs: 0046F221
Inno Setup: Icon Group, xrefs: 0046F021
Inno Setup: Setup Type, xrefs: 0046F07D
NoModify, xrefs: 0046F394
NoRepair, xrefs: 0046F3A8
URLUpdateInfo, xrefs: 0046F309
InstallDate, xrefs: 0046F3C7
ModifyPath, xrefs: 0046F380
Inno Setup: User Info: Name, xrefs: 0046F11A
DisplayName, xrefs: 0046F1CA
MajorVersion, xrefs: 0046F3F3
5.5.2 (a), xrefs: 0046EFC2
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046EF22
" /SILENT, xrefs: 0046F24E
Contact, xrefs: 0046F343
Inno Setup: App Path, xrefs: 0046EFF2
Readme, xrefs: 0046F326
Publisher, xrefs: 0046F295
RegisterPreviousData, xrefs: 0046F51A
InstallLocation, xrefs: 0046F012
DisplayVersion, xrefs: 0046F278
Inno Setup: User Info: Organization, xrefs: 0046F12F
Inno Setup: Language, xrefs: 0046F16B
Inno Setup: User Info: Serial, xrefs: 0046F144
Comments, xrefs: 0046F360
Inno Setup: User, xrefs: 0046F05E
HelpTelephone, xrefs: 0046F2CF
HelpLink, xrefs: 0046F2EC
Inno Setup: Selected Tasks, xrefs: 0046F0E3
EstimatedSize, xrefs: 0046F4E1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.2 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-2734025597
Opcode ID: 4b47327b70ee27fc59f023ce9095d4925cbd7ad973a1f437070c8b1580be5bb7
Instruction ID: 41df9594f94a3a106a445eb875b77748a5d5020e54387338891d7450c5044d2a
Opcode Fuzzy Hash: 4b47327b70ee27fc59f023ce9095d4925cbd7ad973a1f437070c8b1580be5bb7
Instruction Fuzzy Hash: CF123335A00109AFDB04EF55E981ADE73F5EB48304F60847BE840AB396EB78AD45CB5D

Function 004923A8 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,0049289D,?,?,?,?,00000000,00000000,00000000), ref: 004923E8
FindWindowA.USER32(00000000,00000000), ref: 00492419

Strings

POSTMESSAGE, xrefs: 004924C3
CHARTOOEMBUFF, xrefs: 0049283E
REGISTERWINDOWMESSAGE, xrefs: 0049257B
SENDMESSAGE, xrefs: 0049246D
SENDNOTIFYMESSAGE, xrefs: 0049251F
CREATEMUTEX, xrefs: 004927C9
FINDWINDOWBYCLASSNAME, xrefs: 004923F5
OEMTOCHARBUFF, xrefs: 004927FB
SLEEP, xrefs: 004923D2
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00492657
LOADDLL, xrefs: 004926AB
CALLDLLPROC, xrefs: 0049270D
POSTBROADCASTMESSAGE, xrefs: 00492603
FINDWINDOWBYWINDOWNAME, xrefs: 00492431
SENDBROADCASTMESSAGE, xrefs: 004925B5
FREEDLL, xrefs: 00492794

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: fc65408302e00bfaa9df3cfa690acb5bb30b22ebaabf7b5c0919dab2d319a526
Instruction ID: 9f3505894e5a6fd9d1366d4270c7319e33b1617852d99992837f934410b553a1
Opcode Fuzzy Hash: fc65408302e00bfaa9df3cfa690acb5bb30b22ebaabf7b5c0919dab2d319a526
Instruction Fuzzy Hash: 0CC182A0B042413BDB14FF3E9D4151F59A99B94708B118A3FB446EB38BCE7DED0A4399

Function 00483560 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004835F1

Strings

RegDeleteKeyExA, xrefs: 004835CA
GetSystemWow64DirectoryA, xrefs: 004835BB
advapi32.dll, xrefs: 004835CF
IsWow64Process, xrefs: 0048358E
GetNativeSystemInfo, xrefs: 00483578
kernel32.dll, xrefs: 0048356C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
Instruction ID: 55e3f4d73e57614863bf74929b0f0177a2d28665cd9645ad6096ae2f13a54172
Opcode Fuzzy Hash: ecd875b9fed982c6964d0a5895b6aed5fdd9f377785afaacdd435e2d250d9586
Instruction Fuzzy Hash: D6113D81549782B4DA21BB7D8D5AB6F1A888B10F5AF140C3B7C40753C2E96DCE458B6E

Function 00468BFC Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00468E16,?,?,00000001,00000000,00000000,00468E31,?,00000000,00000000,?), ref: 00468DFF

Strings

Inno Setup: User Info: Organization, xrefs: 00468DCE
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468C5B
Inno Setup: App Path, xrefs: 00468CBE
Inno Setup: Deselected Components, xrefs: 00468D40
Inno Setup: Setup Type, xrefs: 00468D0E
Inno Setup: Deselected Tasks, xrefs: 00468D8D
Inno Setup: No Icons, xrefs: 00468CE7
Inno Setup: Selected Tasks, xrefs: 00468D6B
Inno Setup: User Info: Serial, xrefs: 00468DE1
Inno Setup: User Info: Name, xrefs: 00468DBB
%s\%s_is1, xrefs: 00468C79
Inno Setup: Selected Components, xrefs: 00468D1E
Inno Setup: Icon Group, xrefs: 00468CDA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
Instruction ID: 0c37994fccd001a995e494b6850b37eb05b7d5ed784e69181523ebf3a7e49158
Opcode Fuzzy Hash: 477994bb8960d1965e10b40f61816eaf4c7b707db17a7ca4aa6169c09ca9eb9e
Instruction Fuzzy Hash: 8D51C570A006049BCB10DB65C941BDEB7F5EF48304F50856EE840AB391EB38AF01CB6D

Function 0047C15C Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042D898: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00453DB4,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15), ref: 0042D8AB

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042D8F0: GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
Part of subcall function 0042D8F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

SHGetKnownFolderPath.SHELL32(00499D1C,00008000,00000000,?,00000000,0047C432), ref: 0047C336
CoTaskMemFree.OLE32(?,0047C37B), ref: 0047C36E

Part of subcall function 0042D208: GetEnvironmentVariableA.KERNEL32(00000000,00000000,00000000,?,?,00000000,0042DA3E,00000000,0042DAD0,?,?,?,0049B628,00000000,00000000), ref: 0042D233

Strings

Failed to get path of 64-bit Common Files directory, xrefs: 0047C2FC
SystemDrive, xrefs: 0047C1C3
Failed to get path of 64-bit Program Files directory, xrefs: 0047C2CD
\Program Files, xrefs: 0047C24B
ProgramFilesDir, xrefs: 0047C224, 0047C2AB
Common Files, xrefs: 0047C295
COMMAND.COM, xrefs: 0047C40D
CommonFilesDir, xrefs: 0047C25E, 0047C2DA
cmd.exe, xrefs: 0047C3EC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Directory$AddressEnvironmentFolderFreeHandleKnownModulePathProcSystemTaskVariableWindows
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 3771764029-544719455
Opcode ID: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
Instruction ID: 599f5abe96f02a195e24b8b9203061af68f55c26e596fa95a84979d127ba116b
Opcode Fuzzy Hash: 458afd9a1cda60bc5c06d2a3f17cd4b8a975594a1455dcf27ea3d462b6d04529
Instruction Fuzzy Hash: 84619134A00204ABDB10EBA5E8D2A9E7B65EB54308F90C57FE804A7396C73C9E44CF5D

Function 00423874 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3C4: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

GetClassInfoA.USER32(00400000,0042367C), ref: 0042389F
RegisterClassA.USER32(00499630), ref: 004238B7
GetSystemMetrics.USER32(00000000), ref: 004238D9
GetSystemMetrics.USER32(00000001), ref: 004238E8
SetWindowLongA.USER32(00410460,000000FC,0042368C), ref: 00423944
SendMessageA.USER32(00410460,00000080,00000001,00000000), ref: 00423965
GetSystemMenu.USER32(00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 00423970
DeleteMenu.USER32(00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C,0041EDA4), ref: 0042397F
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 0042398C
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410460,00000000,00000000,00400000,00000000,00000000,00000000), ref: 004239A2

Strings

|6B, xrefs: 00423893, 00423914

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: |6B
API String ID: 183575631-3009739247
Opcode ID: 4cae07da4ecbd82a5ef2c5022e230c145e19d211ee6ce0cd027d67cd6f27acc7
Instruction ID: 5979ac727d64f3fe5c9a0a43452729076f54e0f9e4c251b9a4c28f9d6bed272f
Opcode Fuzzy Hash: 4cae07da4ecbd82a5ef2c5022e230c145e19d211ee6ce0cd027d67cd6f27acc7
Instruction Fuzzy Hash: E63152B17402006AEB10AF69DC82F6A37989B14709F60017BFA44EF2D7C6BDED40876D

Function 0047C968 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74600000,SHGetFolderPathA), ref: 0047CA6A

Strings

SHGetFolderPathA, xrefs: 0047CA5F
Failed to get version numbers of _shfoldr.dll, xrefs: 0047C9C0
SHFOLDERDLL, xrefs: 0047C9A7
ptI, xrefs: 0047C9B1, 0047C9F6, 0047C9DE, 0047C9E6
_isetup\_shfoldr.dll, xrefs: 0047C99A
Failed to get address of SHGetFolderPath function, xrefs: 0047CA7B
Failed to load DLL "%s", xrefs: 0047CA4D
shell32.dll, xrefs: 0047CA15
shfolder.dll, xrefs: 0047C9CD, 0047CA06

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$ptI$shell32.dll$shfolder.dll
API String ID: 190572456-2576699960
Opcode ID: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
Instruction ID: 1b7f257eac351b2865de88edbb479a2ab4f4c09eb1d5ad9e3bfc9d6f8503b50a
Opcode Fuzzy Hash: de0f38486c819f413c08132c2c10785360ce7bb1d082894e1dd7e5610f115569
Instruction Fuzzy Hash: 66310E70A001099BCB00EB95D5D2AEEB7B5EB44305F50847BE404F7241D778AE45CBAD

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366

Strings

kernel32.dll, xrefs: 0040631D
SetSearchPathMode, xrefs: 0040633F
SetDllDirectoryW, xrefs: 00406329
SetProcessDEPPolicy, xrefs: 00406355

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: fb4db72500fb8039bf9e982fa136c472a352d03826636d66c2b82dec8efce00d
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Function 0041321B Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 633COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Strings

3A, xrefs: 0041343D
yA, xrefs: 004132DE

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: LongWindow$Prop
String ID: 3A$yA
API String ID: 3887896539-3278460822
Opcode ID: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction ID: bcb4e109f9bb3244d1d15a250a8b19338fc20a7c4ef9bfc7c396c8b3ff51cb63
Opcode Fuzzy Hash: d9856cee796f57cc1685d9958f98130356579251106e4d85d69cc018d86e5275
Instruction Fuzzy Hash: 8C22D06508E3C05FE31B9B74896A5D57FA0EE13325B1D45DFC4C28B1A3D21E8A8BC71A

Function 0042F560 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F58F
GetFocus.USER32 ref: 0042F597
RegisterClassA.USER32(004997AC), ref: 0042F5B8
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F68C,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5F6
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F63C
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F64D
SetFocus.USER32(00000000,00000000,0042F66F,?,?,?,00000001,00000000,?,004581A2,00000000,0049B628), ref: 0042F654

Strings

TWindowDisabler-Window, xrefs: 0042F5EF, 0042F635

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
Instruction ID: c3989f54cd535b42bfd745bd8d6279a550c1ea008e6f4be51b2d228796931bcd
Opcode Fuzzy Hash: af2d58cb1d61aa5294d5b80584b5773ea49d3efeec85bd27a4eae10aec25b275
Instruction Fuzzy Hash: B021A170740710BAE310EF66AD43F1A76B8EB04B44F91853BF604AB2E1D7B86D0586AD

Function 004531F0 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Strings

kernel32.dll, xrefs: 0045320B, 00453225
Wow64DisableWow64FsRedirection, xrefs: 00453206
Wow64RevertWow64FsRedirection, xrefs: 00453220
shell32.dll, xrefs: 0045325C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
Instruction ID: 0cfad7ca53bf4133c716031d63a26ec494c9be7874946ed143d2344feace3e75
Opcode Fuzzy Hash: 460e23cb00cf3424ad6d0c49a1f828097ca48bff1b05d8589e040c86aeca4b16
Instruction Fuzzy Hash: 9F01D870240B04BED3016F63AD12F563A58E755B5BF5044BBFC1496582C77C4A088EAD

Function 00466FF4 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 00467097
ExtractIconA.SHELL32(00400000,00000000,?), ref: 004670BD

Part of subcall function 00466F34: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00466FCC
Part of subcall function 00466F34: DestroyCursor.USER32(00000000), ref: 00466FE2

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 00467114
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467175
ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046719B

Strings

shell32.dll, xrefs: 004670F8
c:\directory, xrefs: 00467092

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
Instruction ID: 28e44f0b0ade20fd2fa41990bb26b25d2b6273e6e4b8387af8825f96a0abaac4
Opcode Fuzzy Hash: 6d041171d1007e38f1423e999fca6c8345fae3a72a3914b9ee39d1bb44a6fd6f
Instruction Fuzzy Hash: 65517E70604204AFD710DF65CD89FDFB7E8EB49308F1081A7F8089B351D6389E81CA69

Function 00430940 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430948
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 00430957
GetCurrentThreadId.KERNEL32 ref: 00430971
GlobalAddAtomA.KERNEL32(00000000), ref: 00430992

Strings

WndProcPtr%.8X%.8X, xrefs: 00430983
commdlg_help, xrefs: 00430943
commdlg_FindReplace, xrefs: 00430952

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction ID: 0bd92e6c8c1c5a5b8444157758b44b4e11dae02c37acc47d2edddbd1fb793b69
Opcode Fuzzy Hash: 8a088dfdc0b2c62b7d21c5c596ec815df7ae76573c78c741c8a86d6eee6cb681
Instruction Fuzzy Hash: 22F012B0458340DEE300EB65994271E7BD0EF58718F50467FF498A6392D7795904CB5F

Function 00471FC8 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 272fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472175
FindClose.KERNEL32(000000FF,004721A0,00472199,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 00472193
FindNextFileA.KERNEL32(000000FF,?,00000000,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555), ref: 00472297
FindClose.KERNEL32(000000FF,004722C2,004722BB,?,00000000,?,0049C1DC,00000000,00472389,?,00000000,?,00000000,?,00472555,?), ref: 004722B5

Strings

&&G, xrefs: 0047221F, 00472222
&&G, xrefs: 0047200E, 00472025

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: &&G$&&G
API String ID: 2066263336-852616326
Opcode ID: 53d573c3283eea8276722ae00e783839c534cad26cf1d76589be1e10efaeed4f
Instruction ID: 5d8f9e8498e1fb85c1a49ff99105bc28d4ff0fd985b73b461b66a4ef7da0b053
Opcode Fuzzy Hash: 53d573c3283eea8276722ae00e783839c534cad26cf1d76589be1e10efaeed4f
Instruction Fuzzy Hash: F0C14C3490424D9FCF11DFA5C981BDEBBB9FF09304F5085AAE908A3291D7789A45CF64

Function 00455010 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C,00000000), ref: 004551BA
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0045522C,0045522C,?,0045522C), ref: 004551C7

Part of subcall function 00454F7C: WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
Part of subcall function 00454F7C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
Part of subcall function 00454F7C: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
Part of subcall function 00454F7C: CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Strings

cmd.exe" /C ", xrefs: 004550ED
D, xrefs: 00455158
COMMAND.COM" /C , xrefs: 00455124
.cmd, xrefs: 004550BB
.bat, xrefs: 004550A0

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: d48cb867d8132222f58630969ce6cc8153310e3eaa120555069058459d823a95
Instruction ID: 058baa7e90e176347c833b132b7c272bf8058e823d6e061bdbf2f6311869cd9e
Opcode Fuzzy Hash: d48cb867d8132222f58630969ce6cc8153310e3eaa120555069058459d823a95
Instruction Fuzzy Hash: 41516D34B0074DABCF10EFA5D852BDEBBB9AF44305F50447BB804B7292D7789A098B59

Function 0042368C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
OemToCharA.USER32(?,?), ref: 0042375C
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Strings

2, xrefs: 004236EA
MAINICON, xrefs: 00423711

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction ID: 339a64ebbf2375270c19ef2cfa2d714624ee8dcb7e06b01b5ae6522dc3b50067
Opcode Fuzzy Hash: a0d1a492a3e1df344d79b5ede7937f80cf878dadafa44837ceada302c6d607ca
Instruction Fuzzy Hash: 243181B0A042549ADF10EF29D8C57C67BA8AF14308F4441BAE844DB393D7BED988CB59

Function 00495078 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00495089

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004950AB
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495629), ref: 004950BF
GetTextMetricsA.GDI32(00000000,?), ref: 004950E1
ReleaseDC.USER32(00000000,00000000), ref: 004950FE

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 004950B6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Text$CreateExtentFontIndirectMetricsObjectPointReleaseSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 2948443157-222967699
Opcode ID: 53fe9a462762cb4918ee61071ab08c48f7ebae39ed882d9ecfdb03bcb5db6ebb
Instruction ID: d310c62e5609ca3062061d10b625b1d271ae10615434581f3ecc8597d6741426
Opcode Fuzzy Hash: 53fe9a462762cb4918ee61071ab08c48f7ebae39ed882d9ecfdb03bcb5db6ebb
Instruction Fuzzy Hash: 76014875A04704BFDB05DBA5CC42F5EB7ECDB49714F614476F604E7281D5789E008B68

Function 00418F38 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F3D
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F5E
GetCurrentThreadId.KERNEL32 ref: 00418F79
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F9A

Part of subcall function 004230C8: GetDC.USER32(00000000), ref: 0042311E
Part of subcall function 004230C8: EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
Part of subcall function 004230C8: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
Part of subcall function 004230C8: ReleaseDC.USER32(00000000,00000000), ref: 00423144

Part of subcall function 0042368C: LoadIconA.USER32(00400000,MAINICON), ref: 0042371C
Part of subcall function 0042368C: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 00423749
Part of subcall function 0042368C: OemToCharA.USER32(?,?), ref: 0042375C
Part of subcall function 0042368C: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FE6,00000000,?,?,?,00000001), ref: 0042379C

Part of subcall function 0041F118: GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
Part of subcall function 0041F118: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
Part of subcall function 0041F118: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
Part of subcall function 0041F118: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D

Strings

ControlOfs%.8X%.8X, xrefs: 00418F8B
Delphi%.8X, xrefs: 00418F4F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$CapsDeviceEnumFileFontsIconLibraryLowerModuleNameProcessReleaseThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 316262546-2767913252
Opcode ID: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction ID: d883a59e21ed3b4d0722d018b4a025de81f9e45e1fd093e44b5ebaba0e30331f
Opcode Fuzzy Hash: b417f06b73a7dba032b12b865c8ed9bc6bb92a8bfb887f153b822e9fb73695be
Instruction Fuzzy Hash: AC115E706142419AD740FF76A94235A7BE1DF64308F40943FF448A7391DB3DA9448B5F

Function 0041363C Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 00413664
GetWindowLongA.USER32(?,000000F0), ref: 0041366F
GetWindowLongA.USER32(?,000000F4), ref: 00413681
SetWindowLongA.USER32(?,000000F4,?), ref: 00413694
SetPropA.USER32(?,00000000,00000000), ref: 004136AB
SetPropA.USER32(?,00000000,00000000), ref: 004136C2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction ID: 06abc153636d574f2b9d5b42ed2ef1d3d1989bf2b09c04f5b7aa0ee96fd2bcf7
Opcode Fuzzy Hash: 7846fecbe383e6d7fdaea4169180c186d89bab15e88d328ea810806c298c4441
Instruction Fuzzy Hash: 1011C975100244BFEF00DF9DDC84EDA37E8EB19364F144666B958DB2A2D738DD908B68

Function 004556D8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,0045586F,?,00000000,004558AF), ref: 004557B5

Strings

WININIT.INI, xrefs: 004557E4
PendingFileRenameOperations, xrefs: 00455754
PendingFileRenameOperations2, xrefs: 00455784
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455738

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
Instruction ID: 0fa1da25f67206326559771d92c7e47b52ca8d856d575cc5f046ac455f5bab2a
Opcode Fuzzy Hash: ff5e046778063e7c615d5c8ac9a6b1d801ca0d933ef60992733312df31d3558f
Instruction Fuzzy Hash: FF51A974E006089FDB10EF61DC51AEEB7B9EF44305F50857BEC04A7292DB78AE49CA58

Function 0047C684 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C717
GetLastError.KERNEL32(00000000,00000000,00000000,0047C7DA,?,?,00000000,0049B628,00000000,00000000,?,004980A9,00000000,00498252,?,00000000), ref: 0047C720

Strings

\_setup64.tmp, xrefs: 0047C792
_isetup, xrefs: 0047C702
Created temporary directory: , xrefs: 0047C6B9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 3f7519f2dbd75ec89759c5e36ccc4ab0adc05f47ddd4608262a1c5d06c660367
Instruction ID: edb20439a36284776f78bdf2a161e381ec1662189dfb35441dcb715623f8c11f
Opcode Fuzzy Hash: 3f7519f2dbd75ec89759c5e36ccc4ab0adc05f47ddd4608262a1c5d06c660367
Instruction Fuzzy Hash: 6F410574A001099BDB01EBA5D8C2ADEB7B5EF44309F50547BE411B7392DB389E058F69

Function 00452510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

74D31520.VERSION(00000000,?,?,?,ptI), ref: 00452530
74D31500.VERSION(00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 0045255D
74D31540.VERSION(?,004525D4,?,?,00000000,?,00000000,?,00000000,004525AB,?,00000000,?,?,?,ptI), ref: 00452577

Strings

ptI, xrefs: 00452516
%E, xrefs: 004525BB, 00452583

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: D31500D31520D31540
String ID: ptI$%E
API String ID: 1003763464-3209181666
Opcode ID: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction ID: f5dca5bfdad9659449235e2d7a4f424f1fde127461be4d93bb02e754cc996b3f
Opcode Fuzzy Hash: f18440ec30d6a8502c14f0dca7f1c7caee1af709ad5b943411f89d38bbe9f821
Instruction Fuzzy Hash: D2218331A00608BFDB01DAA989519AFB7FCEB4A300F554477F800E7242E6B9AE04C765

Function 00423A84 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A1C), ref: 00423AA8
GetWindow.USER32(?,00000003), ref: 00423ABD
GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

Strings

\AB, xrefs: 00423AF2, 00423AF6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: \AB
API String ID: 4191631535-3948367934
Opcode ID: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
Instruction ID: 3ad81c14f5822e14e615a382c86082b2427cd388a5bf15486a3129e996868218
Opcode Fuzzy Hash: bca5fbb655e429c390612aedafb62b4dde642c29ff44978b36ddb9eb5ee27a78
Instruction Fuzzy Hash: D6115E70700610ABDB109F28E885F5677E8EB08715F10026AF994AB2E3C378ED41CB59

Function 004019CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

LvLv, xrefs: 004019FA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: LvLv
API String ID: 730355536-1162934395
Opcode ID: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 46a689739c098c0829933ff4921327776432a14e69d4c62b65241a59cfc7f4a2
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Function 0042DE44 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE50
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFEB,00000000,0042E003,?,?,?,?,00000006,?,00000000,004973CD), ref: 0042DE6B
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE71

Strings

advapi32.dll, xrefs: 0042DE66
RegDeleteKeyExA, xrefs: 0042DE61

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction ID: e7246de0df94fba710dd2820c0ca51643d5dd29c3ac0bea476bad59fd0e01b91
Opcode Fuzzy Hash: ed1542cdc99e60fdc1e6205037aed1b156b4601bf62b1d4fa5b097ff81e7402e
Instruction Fuzzy Hash: 73E06DF1B41B30AAD72022657C8ABA33729DB75365F658437F105AD19183FC2C50CE9D

Function 0046B984 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

Need to restart Windows? %s, xrefs: 0046BD09
NextButtonClick, xrefs: 0046BAC0
PrepareToInstall failed: %s, xrefs: 0046BCE2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: 37ba51fdfbf3f4723fb08e99647d0fd9c61c097c060f23ffe4e001e6baa90b0a
Instruction ID: b95f389d09e957f91eb9f42d110418d47b08b3dab155efeebd7a2a0376f7d9ee
Opcode Fuzzy Hash: 37ba51fdfbf3f4723fb08e99647d0fd9c61c097c060f23ffe4e001e6baa90b0a
Instruction Fuzzy Hash: F2D12F34A04208DFCB10EBA9D585AED77F5EF09304F5440BAE404EB352D779AE81DB9A

Function 00482B68 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 226COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00482EB9), ref: 00482C8C
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00482D2A

Strings

, xrefs: 00482DE7
Need to restart Windows? %s, xrefs: 00482D67

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 81628947227ec58f55b2c351f2131b28aedfbb6b6148b8ba4744526014514c8c
Instruction ID: 086790f0fc0b942e3ee9f07944933bacbb32a26cbddea002bc31c7aef2919c1b
Opcode Fuzzy Hash: 81628947227ec58f55b2c351f2131b28aedfbb6b6148b8ba4744526014514c8c
Instruction Fuzzy Hash: 60919F746002449FDB10FB69D9C5BAE7BE5AF59304F4484BBE8009B3A2C7B8AD05CB5D

Function 0046F950 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

GetLastError.KERNEL32(00000000,0046FB4D,?,?,0049C1DC,00000000), ref: 0046FA2A
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FAA4
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FAC9

Strings

Creating directory: %s, xrefs: 0046FA12

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: d5447365283b068e30203d66d8a9de4eaa18c1a3b89182fdc70a83f7754103f0
Instruction ID: 553d0e02451aea180b77d3c3bea8b04784d1aec5cd58197de2500155b30451aa
Opcode Fuzzy Hash: d5447365283b068e30203d66d8a9de4eaa18c1a3b89182fdc70a83f7754103f0
Instruction Fuzzy Hash: E5516474E00248ABDB00DFA5D992BDEB7F5AF49304F50847AE850B7386D7786E08CB59

Function 00454DD4 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E82
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F48), ref: 00454EEC

Strings

sfc.dll, xrefs: 00454E44
SfcIsFileProtected, xrefs: 00454E7C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
Instruction ID: 0183ab2a96bad10459dc7acb776d15a29b7b4c70eaa7773bbc3cb8db3249cf06
Opcode Fuzzy Hash: b2872c537cb6cd03ad7726ff2c2bd0a0e2fc6763cd0da9df413ff005d177c2bc
Instruction Fuzzy Hash: 1A419771A042189BEB20DB59DC85B9DB7B8EB4430DF5041B7E908A7293D7785F88CE1C

Function 0042ED38 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDC5

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA8

Strings

shlwapi.dll, xrefs: 0042ED73
SHAutoComplete, xrefs: 0042EDA2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
Instruction ID: e807f919b0f5f47641bb36d66eaae5ab4e0d2818c3cb02d7dc2bc8906116ae4e
Opcode Fuzzy Hash: 9bc7ff361d258be52dd27e2f74bcf33eed5b2b299b3a40fb55461f8ad11e2a91
Instruction Fuzzy Hash: 3311A330B00319BBD711EB62FD85B8E7BA8DB55704F90447BF40066291DBB8AE05C65D

Function 00455A10 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00455A7B,?,00000001,00000000), ref: 00455A6E

Strings

PendingFileRenameOperations, xrefs: 00455A40
PendingFileRenameOperations2, xrefs: 00455A4F
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00455A1C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
Instruction ID: e9356c19d9a7d2c1b22529064790e486fb2be540b5bf165494b3782c633fa2c0
Opcode Fuzzy Hash: 9558350f34ddeb35ff12a6c57317cf96059e68c4625077236ac43c80a8283c08
Instruction Fuzzy Hash: A3F0F671304A08BFDB04D661DC62A3B739CE744725FB08167F800CB682EA7CBD04915C

Function 0047F7DC Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?,00000000), ref: 0047F882
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?,?), ref: 0047F88F
FindNextFileA.KERNEL32(000000FF,?,00000000,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B), ref: 0047F984
FindClose.KERNEL32(000000FF,0047F9AF,0047F9A8,?,?,?,?,00000000,0047F9D5,?,00000000,00000000,?,?,00480C2B,?), ref: 0047F9A2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
Instruction ID: 945984253e7709c97adc8e2d755cc1877c70959f01d2b28a808f8207dce1d898
Opcode Fuzzy Hash: d71ed79f5e3cae8dbdb8f9366932315e37cb591a7859d28a8b9a768ac6bf17e9
Instruction Fuzzy Hash: FD513E71900648AFCB20EF65CC45ADEB7B8EB88315F1084BAA418E7351D7389F89CF55

Function 00421274 Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421361
SetMenu.USER32(00000000,00000000), ref: 0042137E
SetMenu.USER32(00000000,00000000), ref: 004213B3
SetMenu.USER32(00000000,00000000), ref: 004213CF

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction ID: 68e231870b0c3442489bede8fdcf2aa1db34e154331db007d9f14f65c1163b63
Opcode Fuzzy Hash: 011238806e8749de4259267c2425fab43e1a23b2a7ed20fe69ece2c0c4e48eae
Instruction Fuzzy Hash: 4641AE3070425447EB20EA3AA9857AB36925B20308F4841BFFC40DF7A3CA7CDD45839D

Function 00416B42 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B84
SetTextColor.GDI32(?,00000000), ref: 00416B9E
SetBkColor.GDI32(?,00000000), ref: 00416BB8
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BE0

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction ID: 4ea48ea5c9b96bae81565ca4ce64eb356f32bd46963e120bc97d04dec40f2685
Opcode Fuzzy Hash: 072521f5090f240ceba025e33949739ce14f97652003165ca459573163e57643
Instruction Fuzzy Hash: BC115171705604AFD710EE6ECC84E8777ECEF49310715887EB959CB612C638F8418B69

Function 00454F7C Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454FA8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454FCA
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FD9
CloseHandle.KERNEL32(?,00455006,00454FFF,?,?,?,00000000,?,?,004551DB,?,?,?,00000044,00000000,00000000), ref: 00454FF9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
Instruction ID: ea90b2abd28d60bbe0c33bbe6d7a83e36ef454db8471bda6b5c19e9a906557d9
Opcode Fuzzy Hash: 7a90289248fc1b73338e990bec893a2b2f0b3f31367c070c083f3916a619ed36
Instruction Fuzzy Hash: B9012D31A006097FEB1097AA8C02F6FBBECDF49764F610127F904D72C2C5788D409A78

Function 004230C8 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042311E
EnumFontsA.GDI32(00000000,00000000,00423068,00410460,00000000,?,?,00000000,?,00418FD3,00000000,?,?,?,00000001), ref: 00423131
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00423139
ReleaseDC.USER32(00000000,00000000), ref: 00423144

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CapsDeviceEnumFontsRelease
String ID:
API String ID: 2698912916-0
Opcode ID: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction ID: a9d24610abdaa6694e735d00c6d38f20457f2ac5f1468c421a1b182fb2ef8db9
Opcode Fuzzy Hash: ae3b46bdf4144dece9088701a44aa945a4d7eb571b2044da6dc5baa79edeb2ca
Instruction Fuzzy Hash: 8D01CC716042102AE700BF6A5C82B9B3AA49F01319F40027BF808AA3C6DA7E980547AE

Function 0045C0B4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933

FlushFileBuffers.KERNEL32(?), ref: 0045C2E9

Strings

EndOffset range exceeded, xrefs: 0045C21D
NumRecs range exceeded, xrefs: 0045C1E6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 342f5355273d5727d167a8c36915eb09cbddc721749ec1229ea5b88aeccb3df0
Instruction ID: 054e4d8252a4b7fe708e1d13fc1942b3136e6dcde41ac9beef610e5760cb7d56
Opcode Fuzzy Hash: 342f5355273d5727d167a8c36915eb09cbddc721749ec1229ea5b88aeccb3df0
Instruction Fuzzy Hash: D3615434A002588FDB25DF25D881AD9B7B5AF49305F0084DAED89AB353D774AEC8CF54

Function 00498718 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,00498726), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,00498726), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498730), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00498730), ref: 00406366

Part of subcall function 004063C4: 6F541CD0.COMCTL32(00498735), ref: 004063C4

Part of subcall function 00410764: GetCurrentThreadId.KERNEL32 ref: 004107B2

Part of subcall function 00419040: GetVersion.KERNEL32(0049874E), ref: 00419040

Part of subcall function 0044F744: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
Part of subcall function 0044F744: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Part of subcall function 0044FC10: GetVersionExA.KERNEL32(0049B790,00498767), ref: 0044FC1F

Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 00453210
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453216
Part of subcall function 004531F0: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,00453289,?,?,?,?,00000000,?,00498776), ref: 0045322A
Part of subcall function 004531F0: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453230

Part of subcall function 00456F00: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24

Part of subcall function 00464468: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
Part of subcall function 00464468: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D

Part of subcall function 0046CC64: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79

Part of subcall function 00478740: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
Part of subcall function 00478740: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763

Part of subcall function 00483A6C: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B

Part of subcall function 00495724: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 0049573D

SetErrorMode.KERNEL32(00000001,00000000,004987DC), ref: 004987AE

Part of subcall function 004984D8: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
Part of subcall function 004984D8: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8

Part of subcall function 004244D4: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244F3

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,004987DC), ref: 0049880F

Part of subcall function 004820AC: SetActiveWindow.USER32(?), ref: 0048215A

Strings

Setup, xrefs: 004987F5

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF541FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 291738113-3839654196
Opcode ID: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
Instruction ID: 72ad643eee306aeb53380572695708c68149a0501138caf3355f256a6ce1e3ac
Opcode Fuzzy Hash: 4026870168645be20c4e504289bca16f7fc9894158eff1610b8fe089479f565d
Instruction Fuzzy Hash: 7931C5712046409ED705BBBBAC5392D3B94EF8A728BA2447FF80486593DE3C58508A7F

Function 00453A24 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A6A
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453B13,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A73

Strings

.tmp, xrefs: 00453A53

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 7172d9ffade96b62561a832a68f8cbe161be4b5cae50dfb87ffdb02f7c338e4f
Instruction ID: ea6adcadec8e2c01cafa1ba510acc1338588d6ec7b4e1cf88163bb5bfef62d35
Opcode Fuzzy Hash: 7172d9ffade96b62561a832a68f8cbe161be4b5cae50dfb87ffdb02f7c338e4f
Instruction Fuzzy Hash: A9213575A002089BDB01EFA1C8429DEB7B8EF49305F50457BE801B7343DA3CAF058B69

Function 00483A6C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00483560: GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483571
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0048357E
Part of subcall function 00483560: GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 0048358C
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00483594
Part of subcall function 00483560: GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 004835A0
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 004835C1
Part of subcall function 00483560: GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004835D4
Part of subcall function 00483560: GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004835DA

Part of subcall function 0048388C: GetVersionExA.KERNEL32(?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 0048389A
Part of subcall function 0048388C: GetVersionExA.KERNEL32(0000009C,?,00483A9E,00000000,00483B73,?,?,?,?,?,00498799), ref: 004838EC

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 00483B5B

Strings

shell32.dll, xrefs: 00483B50
SHGetKnownFolderPath, xrefs: 00483B46

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleModuleVersion$CurrentErrorInfoLibraryLoadModeNativeProcessSystem
String ID: SHGetKnownFolderPath$shell32.dll
API String ID: 3869789854-2936008475
Opcode ID: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
Instruction ID: 33d3db6593e9873a674f830e342c1c65c6cab746408e9d399a43700aa418428b
Opcode Fuzzy Hash: 36bbd7205677a14235ded179242f98fe4396733ea939f399f849956901c26b03
Instruction Fuzzy Hash: 672100B06503516EC300BF7E59A661A3BA5EB5474C380893FF804EB3D2D77E68145BAE

Function 0047C0C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C41C,00000000,0047C432), ref: 0047C12A

Strings

RegisteredOrganization, xrefs: 0047C119
RegisteredOwner, xrefs: 0047C107

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
Instruction ID: 6af266579ce0f4cae339b7a6725c06c490679c1ac7d4d5cc7f46b4f942b6f465
Opcode Fuzzy Hash: 0e90ec8331aa68b80fdbd6afaabfad8867ded4c3b6cad332e65b349247218e2d
Instruction Fuzzy Hash: 32F0B430704244AFDB04DAA8EDD2BAA776AD741304FA4803FE1048F382D679DE019BAC

Function 004750C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750E5
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,004752F7), ref: 004750FC

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

CreateFile, xrefs: 004750F1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
Instruction ID: 6399d4087dc53d24fa9d3bc8bb06fd86b45c214eecae9240140a798b65cacfb0
Opcode Fuzzy Hash: bbf61bf67fe349c097a8a02b07410db95704594b340b54041ead5b805cfa0960
Instruction Fuzzy Hash: 18E06D302407447BEA10FA69CCC6F4A77989B04768F10C162FA48AF3E2C5B9EC408658

Function 00456F00 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00456E90: CoInitialize.OLE32(00000000), ref: 00456E96

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456F24

Strings

SHCreateItemFromParsingName, xrefs: 00456F0F
shell32.dll, xrefs: 00456F19

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
Instruction ID: 06a1b1eafb8ede6a4ef061af05be88198505768e1dcfa776260a5a664dfb1d55
Opcode Fuzzy Hash: 3ee7a517847f468c0619dab237ccb69dbf9a8b231eaadc82d937c3bc473404de
Instruction Fuzzy Hash: BBC04CA1F5271156CA00BBFA655361F2805DB5031FBD2803FB948A7587CE7C9C095B6E

Function 0046CC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E394: SetErrorMode.KERNEL32(00008000), ref: 0042E39E
Part of subcall function 0042E394: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC79

Strings

SHPathPrepareForWriteA, xrefs: 0046CC64
shell32.dll, xrefs: 0046CC6E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
Instruction ID: d379c4162c5a45317e257a8b9368072ef34678a45322f04a033aff34d3fd6743
Opcode Fuzzy Hash: 86cf81fee744bb21f40f36152ca0a59654e50c5ee39d1ae44c17eff86845b0ac
Instruction Fuzzy Hash: 4BB092A06027018ADB00F7F258A662B28099B40319B20803B71889B685EE3C88004BAF

Function 0044852C Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448709), ref: 0044864C
GetProcAddress.KERNEL32(00000000,00000000), ref: 004486CD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: c059e024c9e6eb8416f72924d9350c7e8f021855cc9b01300ad62ba4517ae118
Instruction ID: 2eaa58f6359003fef9dee836e3db1fa56ae38c906bc4f4c4d93ca6671f7cd4fb
Opcode Fuzzy Hash: c059e024c9e6eb8416f72924d9350c7e8f021855cc9b01300ad62ba4517ae118
Instruction Fuzzy Hash: 14515470E00105AFDB40EF95C491AAEBBF9EB45319F11817FE414BB391DA389E05CB99

Function 00481760 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481898), ref: 00481830
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481841
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481859

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
Instruction ID: 2579a7d5db53e33ee4863251c1290a2b13440539eb68b17f0e677d1311332c65
Opcode Fuzzy Hash: d933746ff7b66401e606975732ccc260a02719cdd81df1f2e9532199b1c22675
Instruction Fuzzy Hash: A131A3307043445AD721BB769C83B6E3B989F55718F54587FF8009A2E3CA7C9D0A879D

Function 0044B38C Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0044B401
SelectObject.GDI32(?,00000000), ref: 0044B424
ReleaseDC.USER32(00000000,?), ref: 0044B457

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ObjectReleaseSelect
String ID:
API String ID: 1831053106-0
Opcode ID: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
Instruction ID: 242bcfed98594cbdcf51f2854abe94a1ec69c13560e3a72339b9f4254961cc58
Opcode Fuzzy Hash: 71686dd1bf2aceb477ce3f8db4b541325f82ff5bc32dc74031120fde16d0cea8
Instruction Fuzzy Hash: 62216570A04248AFEB15DFA6C841B9F7BB9DB49304F11806AF904A7682D778D940CB59

Function 0044B0C0 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B14C,?,004820C7,?,?), ref: 0044B11E
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B131
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B165

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
Instruction ID: fec6fabf6d030a51aab30bc406273ff78954f96defe81b00f374268ef7e1f253
Opcode Fuzzy Hash: 48900d8d8fc19135f8d19aada3e9e9d8d34cb92564939e70bb5bc2663f887e99
Instruction Fuzzy Hash: 2A11CBB27046047FEB00DB6A9C91D6F77ECDB49750F10817BF504D72D0D6399E018669

Function 004243FC Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 00424412
TranslateMessage.USER32(?), ref: 0042448F
DispatchMessageA.USER32(?), ref: 00424499

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction ID: 8eae6dca0d2455523dd27ca57e4683f6da326f6f2f90499d04ddbfd693f83f9d
Opcode Fuzzy Hash: d4f7142ddfb2041a0388c754ad29f8297397d1c5d5a6fc901d04af05902ad934
Instruction Fuzzy Hash: E3116D303043205AEB20FA24A941B9F73D4DFC5758F80481EFC99972C2D77D9D49879A

Function 00416644 Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 0041666A
SetPropA.USER32(00000000,00000000), ref: 0041667F
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 004166A6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
Instruction ID: 6913c5f2d07602d921388148e43cadd8ab2d6729f30613f48e4cae6714e3bc13
Opcode Fuzzy Hash: ff8df5d04f2ecdb5f17762fdbd8b59dc717163ef82ea70d213bab306533cf9bb
Instruction Fuzzy Hash: ACF01271701210ABDB10AB599C85FA732DCAB09714F16057AB905EF286C778DC40C7A8

Function 004014E4 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Strings

LvLv, xrefs: 00401522

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: LvLv
API String ID: 2087232378-1162934395
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Function 0041EE54 Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE64
IsWindowEnabled.USER32(?), ref: 0041EE6E
EnableWindow.USER32(?,00000000), ref: 0041EE94

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction ID: 3b4cb379701a2ac24b7d0c87bf9454d2e26b3d0fb89a85d5a5a22e513a73856b
Opcode Fuzzy Hash: 495d6a49dc4b54b7e424eeae3cce025a94256eba33976185de8149e812397146
Instruction Fuzzy Hash: EAE06DB5100301AAE301AB2BDC81B5B7A9CAB54350F05843BA9089B292D63ADC408B7C

Function 00469D90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00469EA1

Strings

PrepareToInstall, xrefs: 00469E4B, 00469EF2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: e58a16817a64f5759f31888600c1354bb1a8a8b494c3c93af2f1dbc242ca25c6
Instruction ID: ccacc6dcba8b8cbbfa1c17f86b27e08b0c11e5798d11daccd90c331c988b02c3
Opcode Fuzzy Hash: e58a16817a64f5759f31888600c1354bb1a8a8b494c3c93af2f1dbc242ca25c6
Instruction Fuzzy Hash: 7EA11934A00109DFCB00EF59D986EDEB7F5AF48304F6580B6E404AB366D778AE41DB99

Function 0046C330 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C4CC, 0046C4E3

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
Instruction ID: 1e87f3d38ec7dbf16fc1afa4daea9e6ca85b65b9a8fb7c68475855461939e3a0
Opcode Fuzzy Hash: 43277fb1c717e2606564b112b1b0681d416f5021830c97b09ce096e65d7cf365
Instruction Fuzzy Hash: 4371A470A40214ABDB10EB66DDD2BEE77A19F40308F1084A7F580AB392E779AD45875F

Function 004820AC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 0048215A

Strings

InitializeWizard, xrefs: 004820F3

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: 376233a1d1dddbf1dd43b25fae561af2bf40b6633c4dd7a0e8b1389a7c4343be
Instruction ID: 36b0f45b5e581da985bac651985c8aaa8d6a9bed6a39233588f506be3a995c8b
Opcode Fuzzy Hash: 376233a1d1dddbf1dd43b25fae561af2bf40b6633c4dd7a0e8b1389a7c4343be
Instruction Fuzzy Hash: 79119434205200AFD701FBA9EEDAB1937E4EB59328F60047BF5009B6A1DA796C00CB5D

Function 0047BFE4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047C230,00000000,0047C432), ref: 0047C029

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047BFF9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
Instruction ID: 5930872802659161668f2fc27ec2b8a5c579264ce8ecaca434dd7baa373bea44
Opcode Fuzzy Hash: 91d5c32787d00ddb3ecc29a404e36154aacf37a6ecdb6076e024b20848598476
Instruction Fuzzy Hash: B1F08231700514A7DA00A69E6D82B9BA79D9B84758F20403FF508DB242DABE9E0202EC

Function 0046ECB8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,00475FFE,?,0049C1DC,?,0046EFCF,?,00000000,0046F56A,?,_is1), ref: 0046ECDB

Strings

Inno Setup: Setup Version, xrefs: 0046ECD9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version
API String ID: 3702945584-4166306022
Opcode ID: 56bbb1f4a6cd77c20b542710a526df67742b244f3cd53e0af7fea37619b23a66
Instruction ID: 3111e2ab1a00cbee8849f506c2bc3fe53732bb3e30b7299e44938699edfd3f7c
Opcode Fuzzy Hash: 56bbb1f4a6cd77c20b542710a526df67742b244f3cd53e0af7fea37619b23a66
Instruction Fuzzy Hash: 71E06D753012043FE710AA2B9C85F5BBBDCDF99765F10403AB909DB392D978DD0085A8

Function 0046ED28 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F3A6,?,?,00000000,0046F56A,?,_is1,?), ref: 0046ED3B

Strings

NoModify, xrefs: 0046ED39

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 306e8526e04bb1da42350282118940b5300f429dbb2620f70078b8bfc6bd1a7c
Instruction ID: e7aa99f2e089c5623e338f59092b711216c244eb116ac0446a77828d65f342ac
Opcode Fuzzy Hash: 306e8526e04bb1da42350282118940b5300f429dbb2620f70078b8bfc6bd1a7c
Instruction Fuzzy Hash: 3AE04FB4640304BFEB04DB55CD4AF6B77ECDB48710F104059BA049B291E674FE00CA68

Function 0042DE1C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DE36

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction ID: 60e43675bb36a9eef4a15598a1848ca3f705ecc445ee8c9fe52fc6b05f1352bb
Opcode Fuzzy Hash: a11f376e1d034aeb0d9ae53f60934921bcd728bb93d306f1768079d63b1ffdfe
Instruction Fuzzy Hash: 29D09E72950128BB9B009A89DC41DFB775DDB15760F45441BF9049B141C5B4AC5197E4

Function 0047DF58 Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047E237,?,-0000001A,004800ED,-00000010,?,00000004,0000001B,00000000,0048043A,?,0045D9B8), ref: 0047DFCE

Part of subcall function 0042E31C: GetDC.USER32(00000000), ref: 0042E32B
Part of subcall function 0042E31C: EnumFontsA.GDI32(?,00000000,0042E308,00000000,00000000,0042E374,?,00000000,00000000,004804A1,?,?,00000001,00000000,00000002,00000000), ref: 0042E356
Part of subcall function 0042E31C: ReleaseDC.USER32(00000000,?), ref: 0042E36E

SendNotifyMessageA.USER32(00020414,00000496,00002711,-00000001), ref: 0047E19E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: EnumFontsMessageNotifyReleaseSend
String ID:
API String ID: 2649214853-0
Opcode ID: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
Instruction ID: 52cd92918bf59317d76ec0dbded9268cc5ddbf6ebeab8dbad6023b52803fe890
Opcode Fuzzy Hash: e029a571d7ea910feaf489f47ebd39d374a0288316229fc386b1e2e4e1e2ac40
Instruction Fuzzy Hash: 045196746001108BC710FF26D981A9B37E9EB58308B90C67BA4089B3A7CB7CDD46CB9D

Function 00402088 Relevance: 3.1, APIs: 2, Instructions: 122COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,004021FC), ref: 004020CB

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalSection$Enter$AllocInitializeLeaveLocal
String ID:
API String ID: 296031713-0
Opcode ID: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction ID: 30adadd309813d1a6846ca6b4958dbaac508113c784b73a5bb8d11bfdb372a30
Opcode Fuzzy Hash: ab3545b22e3440e815b1719652ff5d854977479bd1b850cbba673e5eb4522dee
Instruction Fuzzy Hash: 3941E3B2E00304DFDB10CF69EE8521A77A4F7A8324B15417FD854A77E2D3789801DB88

Function 0042DC00 Relevance: 3.1, APIs: 2, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DC3C
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD38), ref: 0042DCAC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction ID: 5bd1c55a509b6dee259ffcee94d68868fe84ce326e73fb4cf6662c4527ef549e
Opcode Fuzzy Hash: b62dc44b296d1c54c0416b8d239270b5fe200a79a82432283709fd1da487490f
Instruction Fuzzy Hash: 9D414171E00529ABDB11DF95D881BAFB7B8EB04704F918466E810F7241D778AE00CBA5

Function 0042DEC0 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DF6C
RegCloseKey.ADVAPI32(?,0042DFDD,?,00000000,00000000,00000000,00000000,00000000,0042DFD6,?,?,00000008,00000000,00000000,0042E003), ref: 0042DFD0

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
Instruction ID: d62689c7b7995b9893119ef97773413105dd68debc8ff02f2d4f9d8a28cc91ff
Opcode Fuzzy Hash: 4ba9105902ea8f19abce0b58cfd6361b4b3e39fae621ffe28cce2eb109bf1346
Instruction Fuzzy Hash: DD31B270F04258AEDB11DFA6DD42BAEBBB9EB49304F91407BE501E6280D6785E01CA2D

Function 004955F4 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00495078: GetDC.USER32(00000000), ref: 00495089
Part of subcall function 00495078: SelectObject.GDI32(00000000,00000000), ref: 004950AB
Part of subcall function 00495078: GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00495629), ref: 004950BF
Part of subcall function 00495078: GetTextMetricsA.GDI32(00000000,?), ref: 004950E1
Part of subcall function 00495078: ReleaseDC.USER32(00000000,00000000), ref: 004950FE

MulDiv.KERNEL32(?,?,00000006), ref: 0049566B
MulDiv.KERNEL32(?,?,0000000D), ref: 00495680

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Text$ExtentMetricsObjectPointReleaseSelect
String ID:
API String ID: 844173074-0
Opcode ID: b8f0db3b1af8648b29f816169156a61a2f650473197c1b8975f501f87df3d951
Instruction ID: e4b412c173dc7d538e65be675045952483508aa93d4d052b068bbac01426267f
Opcode Fuzzy Hash: b8f0db3b1af8648b29f816169156a61a2f650473197c1b8975f501f87df3d951
Instruction Fuzzy Hash: C221D6313012009FDB40DF69C8C5AA637A9EB89714F5446B9FD08CF29ADB35EC058B65

Function 004527E8 Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,004580C8,00000000,004580B0,?,?,?,00000000,00452862,?,?,?,00000001), ref: 0045283C
GetLastError.KERNEL32(00000000,00000000,?,?,004580C8,00000000,004580B0,?,?,?,00000000,00452862,?,?,?,00000001), ref: 00452844

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction ID: fcc055d8c1a696a2a0db1e32a085008d871673fec5534948229a16d4440eefa6
Opcode Fuzzy Hash: 32d7980bd8ec2bee900e92c865b72ef71cfaa45d55aa0c85c0401d49ed696f28
Instruction Fuzzy Hash: A2113C72600208AF8B40DEA9DD41D9F77ECEB4E310B114567FD18D3241D678EE148B68

Function 0040ADD8 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040ADF2
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040AF4F,00000000,0040AF67,?,?,?,00000000), ref: 0040AE03

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
Instruction ID: 3d7a77417cef7b3885e8747e4544195f2de945da78ee84bb1155330bb8f828e3
Opcode Fuzzy Hash: 724046dbf40c25189cee710f776ecaa222692b14a71540f68148777f5d1b7dbd
Instruction Fuzzy Hash: 0301F771300700AFD700FF69EC52E1B77EDDB46714710807AF500AB3D1D639AC10966A

Function 0041EEA4 Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEF3
EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction ID: bcaa23655132f8f2785c0a842f21b48ac99b37e3223c43442b01e3940dbd0cdf
Opcode Fuzzy Hash: 30aad164e0a195eeb96462141dc827bf49acbc8680001675c00c89b7ac155170
Instruction Fuzzy Hash: 31015B76A04604BFD706CF6BEC1199ABBE8E789720B22887BEC04D3690E7355C10DF18

Function 00452C80 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452CC2
GetLastError.KERNEL32(00000000,00000000,00000000,00452CE8), ref: 00452CCA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction ID: 1f9035ddd188b097fe3d15476f32cd7793c58c8f4df07880d9fc6ba60e4ff235
Opcode Fuzzy Hash: 92f277caa9c3c56662d1ce6f28aaa0531c95695199337b3952b9b7b9e7465d28
Instruction Fuzzy Hash: 9401D671A04208AB8712EB799D4149EB7ECEB8A32575045BBFC04E3243EA785E048558

Function 0040170C Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,?,?,00401973), ref: 00401766

Strings

LvLv, xrefs: 0040173B, 0040177B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FreeVirtual
String ID: LvLv
API String ID: 1263568516-1162934395
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Function 00452770 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527A9
GetLastError.KERNEL32(00000000,00000000,00000000,004527CF), ref: 004527B1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 6f9ba9aa6754c9e5f92aa980ec9340f602ab7068810135e8d813bbe39961caa9
Instruction ID: e3b373b60118a844676bb749001e6832c3b26a50706decb61b3ae2e0e224b701
Opcode Fuzzy Hash: 6f9ba9aa6754c9e5f92aa980ec9340f602ab7068810135e8d813bbe39961caa9
Instruction Fuzzy Hash: 40F02871A00308BBCB01EF759D4259EB7E8EB4E311B2045B7FC04E3642E6B94E04859C

Function 0042323C Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423249
LoadCursorA.USER32(00000000,00000000), ref: 00423273

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction ID: 5e34cf6406f075c2c63d733b1f02ef4b9a88184ee1572dc0f3c8875cc615d59b
Opcode Fuzzy Hash: 0c9a104e89a33193f60416200903d3bd70bbd31149720632682593485f60625b
Instruction Fuzzy Hash: 9EF0A711B04254AADA109E7E6CC0D6B72A8DF82735B61037BFA3EC72D1C62E1D414569

Function 0042E394 Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E39E
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E8,?,00000000,0042E406,?,00008000), ref: 0042E3CD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction ID: 14c2566281f292fbf4bc3f3871eddb8f7eb4f11f4d1149329263d7d1c8790498
Opcode Fuzzy Hash: 4bb5710dc3172506f3a82e57bec548632d1945d06b3d92e94bd16d63dfaa8550
Instruction Fuzzy Hash: 02F08970B147447FDB119F779CA241BBBECDB49B1175249B6F800A3591E53C4910C928

Function 0047C37B Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(00499D2C,00008000,00000000,?), ref: 0047C38B
CoTaskMemFree.OLE32(?,0047C3CE), ref: 0047C3C1

Strings

Failed to get path of 64-bit Common Files directory, xrefs: 0047C2FC
SystemDrive, xrefs: 0047C1C3
Failed to get path of 64-bit Program Files directory, xrefs: 0047C2CD
\Program Files, xrefs: 0047C24B
ProgramFilesDir, xrefs: 0047C224, 0047C2AB
Common Files, xrefs: 0047C295
COMMAND.COM, xrefs: 0047C40D
CommonFilesDir, xrefs: 0047C25E, 0047C2DA
cmd.exe, xrefs: 0047C3EC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
Instruction ID: 7faaca218829a84c9f3570f99a5fa1a3454177a5e5567d2e8256f64c4bc7b3ab
Opcode Fuzzy Hash: f6c6a059b63e4d54008f1ffce5751a4521167e095c9041d7631769de42763c2c
Instruction Fuzzy Hash: 77E09B31340604AFEB219B619C92B6D77ACE744B00B718477F900E26C0D67CAD14991C

Function 004508F8 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 0045090E
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046FFBD,?,00000000), ref: 00450916

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
Instruction ID: 32d43412562f4d6ab64aa8be608e77008e370c57458e4df53f7444e76f76d0cb
Opcode Fuzzy Hash: ec46a7bc9e5a7a34518fa7989fb6988307d7ef9dfce9dbcd61575ad1106d4b51
Instruction Fuzzy Hash: 0EE012E93042015BF700EA6599C1B2F22DCDB44315F00446ABD44CA28BE678CC048B29

Function 004085DC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408712), ref: 004085FB

Part of subcall function 00406DEC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406E09

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction ID: 9026c6f0acc6bf601755118861b832b1e3c4c92574a9a05948c89544872af2a3
Opcode Fuzzy Hash: 92125e52594e5bc8ee6d97e09480d95589045c4468e862feaba19903f63d3f1d
Instruction Fuzzy Hash: 47314E35E00109ABCB00EB55CC819EEB779EF84314F558577E815BB286EB38AA018B98

Function 0041FB9C Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC39

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction ID: 6365c2cd079840e4170b7c9ce409c3d873e807bce8729d2e10e5c00059922083
Opcode Fuzzy Hash: a0ce2aaa01497ac04468ea6ac7a83421c49688bcbeeff2d3e991700215f3b25f
Instruction Fuzzy Hash: D8214FB1608746AFC351DF3984407A6BBE4BB48344F14893EE498C3741E778E99ACBD6

Function 0046C2C4 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C322,?,00000000,?,?,0046C534,?,00000000,0046C5A8), ref: 0046C306

Part of subcall function 0041EF58: IsWindow.USER32(?), ref: 0041EF66
Part of subcall function 0041EF58: EnableWindow.USER32(?,00000001), ref: 0041EF75

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ThreadWindow$CurrentEnableEnumPathPrepareWindowsWrite
String ID:
API String ID: 3319771486-0
Opcode ID: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
Instruction ID: ca087fa44df162080e90021c0b7c07397410ce2cdc620b11c20c1b42f9b7769a
Opcode Fuzzy Hash: 372a16360b70271e3fbe54b3c8c2dd1bf1f72266d056807abca4c83ddb60c27c
Instruction Fuzzy Hash: 93F0B470204300BFEB059FA6ED96B2576D8D748714FA1443BF904C6290E57D5880852E

Function 00441394 Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 004413AB

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: 51b66c86ab1fb2ed9abdb0db83839a26410808368eb32e0cb4295e2ee82716ff
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 09F04970608109EBBB1CCF58D0618AF7BA0EB48300F2080AFE907C7BA0D634AA80D658

Function 00416550 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 00416585

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Function 004149B4 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149EF

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 004507C4 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00450804

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: ce99838f7be0491c6923214398908b2fd93372403a84c7b432a549debe4dc153
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Function 0042CCCC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD14,?,00000001,?,?,00000000,?,0042CD66,00000000,00452A25,00000000,00452A46,?,00000000), ref: 0042CCF7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
Instruction ID: d3c11148bbbe1678040d416a6bc301cfea82702c80b798926358c5e84281cc0e
Opcode Fuzzy Hash: 2e3447488e8940f063bbcfc4a9008e9bc81ad59ac090e4e62a8f5aa92ecca264
Instruction Fuzzy Hash: 80E065B1304304BFD701EB66EC92A5EBAACDB49754BA14876B50097592D5B86E008468

Function 0042E8C8 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction ID: fbc307da5c1359fbfbc351051067b699ae1438aedf6613c80dda169529e76e7e
Opcode Fuzzy Hash: 07eb917982e44065cc90d67cadef310e262c4caec6bcfbb1197f6d5f5d2cfc19
Instruction Fuzzy Hash: BCE0206278431116F2353416AC47B77150E43C0708F944027BB90DF3D3D6AF9945D25E

Function 0041AF70 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetTextExtentPointA.GDI32(?,00000000,00000000), ref: 0041AF9B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ExtentPointText
String ID:
API String ID: 566491939-0
Opcode ID: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
Instruction ID: 6b43be1268843882f9474f888990ee0a0f71ddbfb678ee1088bae751a0726d8f
Opcode Fuzzy Hash: fe3873e992a20e622ffaf78f93863b288a9be0a8311253c2d6346deae250c6a6
Instruction Fuzzy Hash: E3E086F13097102BD600E67E1DC19DB77DC8A483697148177F458E7392D62DDE1A43AE

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,0042367C,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00406311

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Function 0042DDE4 Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction ID: 68673b5cf84413dff1d7ecec16939cb2303f89f305828e6cd22260af4b89741b
Opcode Fuzzy Hash: 296f4a6b1841180fcb6525c1425398a2afe0618770c3240f8adf4a5c8222c494
Instruction Fuzzy Hash: EDE07EB2610119AF9B40DE8CDC81EEB37ADAB1D350F404016FA08E7200C2B4EC519BB4

Function 00454BF8 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,004707E0,00000000,004715F6,?,00000000,0047163F,?,00000000,00471778,?,00000000,?,00000000), ref: 00454C0E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
Instruction ID: 5c2dbd3a099336849a47a332199978da45cb785deb8a29a76394180ab3bc5383
Opcode Fuzzy Hash: 7c8f6db93596433e8c6540ce52a48f0da3b0448ecaf471e45e9c42032ee7c2dc
Instruction Fuzzy Hash: A1E09BB09097004BC715DF39858031A76D19FC9325F05C96AEC99CF3D7E77D84454617

Function 0041467C Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00495556,?,00495578,?,?,00000000,00495556,?,?), ref: 0041469B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406F10 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F24

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction ID: adeaf4ebd0e6cd94d64be6b3cb299443ba394f13a0b1cd3d8337db6b6af80796
Opcode Fuzzy Hash: 4c02731fe18b0a47ab7745946c5e8dd4c7dfafdb2aa22804bebcbb41d9412fbb
Instruction Fuzzy Hash: 53D012722091506AD220965A6C44EAB6BDCCBC5770F11063AB558C2181D7209C01C675

Function 0042364C Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F8: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 0042360D

ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423628: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 00423644

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
Instruction ID: 3e39ddd90fb628193caaea160b6f4ed5bf244f394cc2da11a07db6b12dca8b82
Opcode Fuzzy Hash: f1fbc87c7d3064a6cf4368d53b3e4c6ee974437194041f03c0195094467d5de5
Instruction Fuzzy Hash: 34D05E123821703142307ABB280699B46EC8D822EB389043BB5449B312ED5DCE01116C

Function 004242C4 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242DC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction ID: e359d8c046b4275bb87a72ac3440150ee0889cd0e7de0465f76ccf46c1161c2e
Opcode Fuzzy Hash: 968e2600307bd84f4d65718215a4df57ccfa9b7919b98356d7a542cd4e907fd2
Instruction Fuzzy Hash: 81D05EE27011602BCB01BAED54C4AC667CC9B8D25AB1840BBF904EF257D638CE40C398

Function 004669B4 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,0046769C,00000000,00000000,00000000,0000000C,00000000), ref: 004669CC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 0042CD24 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004515CB,00000000), ref: 0042CD2F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
Instruction ID: 53db4a1afaa3b7bebcc80daf879f764776582c58df104e6651e2d127eece83ed
Opcode Fuzzy Hash: 699a035a793c66476b33cfcb292e18e8433149420fa0246697406cd7a61acf8b
Instruction Fuzzy Hash: 48C08CE03222001A9E60A6BD2CC551F06CC891423A3A41E3BB129EB2E2D23D88162818

Function 00406EC0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A6D4,0040CC80,?,00000000,?), ref: 00406EDD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: d487f09bce5ab2446fefe52ff91139140134d323c8d44495a9ab4cbc0f9c4527
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 0045092C Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 004506B4: GetLastError.KERNEL32(004504D0,00450776,?,00000000,?,0049799C,00000001,00000000,00000002,00000000,00497AFD,?,?,00000005,00000000,00497B31), ref: 004506B7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction ID: 9573b676cf6dd5fef234c73c81a1a5d02d78d5ca05287b50762f3c98dcfac2da
Opcode Fuzzy Hash: dfd6122944db5b319254e7b77af95d7469dcf5406d44b15aeae4525e96e42585
Instruction Fuzzy Hash: 1AC04CA5700211479F10A6BA85C1A0662D86A5D3157144066BD08CF207D668D8148A18

Function 004072A8 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 9cfe1b671e2ded52e2a4f1899edd371c25323ab6eac1b77aed394817f5a1d109
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Function 0042E3EF Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E40D), ref: 0042E400

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction ID: 426ac138898b17598b25982f2c454791bd479401c65f9a69ae9baa170422678e
Opcode Fuzzy Hash: cb8e2ebd86b0ac1182f6c4657d989dfa6a466ad308997f4b3834ff3b1e7758f7
Instruction Fuzzy Hash: CDB09B7670C6105EE709D6D5B45552D63D4D7C57207E14477F010D2581D57D58054E18

Function 004165EC Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?), ref: 004165F3

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DestroyWindow
String ID:
API String ID: 3375834691-0
Opcode ID: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: 1244af60e57b01067fe56da529b9c4312cbd500fa9ed17bad69dff1823a021af
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Function 00448728 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b311c6ba27037e114d2a0e0a4cc9575de8b4ed7f96be8eb5d2287752a4e0dd9
Instruction ID: 41a6872630840156d23f43a697f0b10540748f54e9aa1b8241e7bbe25a2b1888
Opcode Fuzzy Hash: 4b311c6ba27037e114d2a0e0a4cc9575de8b4ed7f96be8eb5d2287752a4e0dd9
Instruction Fuzzy Hash: 73517574E002099FDB00EFA9C892AAFBBF5EB49314F50817AE500E7351DB389D41CB98

Function 0047D888 Relevance: 1.4, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047DA68,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047DA22

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
Instruction ID: f29de2ad8c50687240b36adc22138c5273adba91495e2343049bdb371ee5aac2
Opcode Fuzzy Hash: f00937e419430fadacdfb08ba868c06bfaea8747007b4ff93a078d6954f67ca3
Instruction Fuzzy Hash: A051B6B0A14214AFDB10DF54D8C4B9ABBF8EF19308F108077E944A7391D738AE45CB6A

Function 0041F3C4 Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041EDA4,?,0042388F,00423C0C,0041EDA4), ref: 0041F3E2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction ID: 3312bc658de40493dbbbdb628fa1ac862c14c743cb2aabe02eeb7d71ec829e14
Opcode Fuzzy Hash: f624f178b2757757f6ee0ed82108e7e17b49aa81eb1cfd09d0e3ddd3732ee692
Instruction Fuzzy Hash: D5115A752007059BCB20DF19D880B82FBE5EF98390F10C53BE9688B385D3B4E8458BA9

Function 00452FC4 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045302D), ref: 0045300F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction ID: b902f5f71593d0acd8113edc39c0d5725662cc955bae9521e0e34912f41e4d76
Opcode Fuzzy Hash: 796ee09302341f2f0fe022b6b7ad64e2259239b3e6510a293da86372227c0e6a
Instruction Fuzzy Hash: 850170356042486FC701DF699C008EEFBE8EB4D76171082B7FC24C3382D7345E059664

Function 00406F48 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406F49

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
Opcode Fuzzy Hash: 11f5b55454e2001d57305e4d26194660ee260494afc1ae4151642f59c6b90a28
Instruction Fuzzy Hash:

Non-executed Functions

Function 0041F118 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FF0,00000000,?,?,?,00000001), ref: 0041F126
SetErrorMode.KERNEL32(00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F142
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F14E
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F15C
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F18C
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1B5
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1CA
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1DF
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1F4
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F209
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F21E
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F233
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F248
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F25D
FreeLibrary.KERNEL32(00000001,?,00418FF0,00000000,?,?,?,00000001), ref: 0041F26F

Strings

Ctl3dRegister, xrefs: 0041F181
Ctl3DColorChange, xrefs: 0041F23D
BtnWndProc3d, xrefs: 0041F252
Ctl3dUnAutoSubclass, xrefs: 0041F228
Ctl3dAutoSubclass, xrefs: 0041F213
Ctl3dCtlColorEx, xrefs: 0041F1FE
CTL3D32.DLL, xrefs: 0041F149
Ctl3dUnregister, xrefs: 0041F1AA
Ctl3dSubclassCtl, xrefs: 0041F1BF
Ctl3dSubclassDlgEx, xrefs: 0041F1D4
Ctl3dDlgFramePaint, xrefs: 0041F1E9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
Instruction ID: e724c2aa341d6685c6ab1c4031cb88844a897dd828fe35f3324890dc483947ec
Opcode Fuzzy Hash: 62814c6def9f01bce39a36d2c4270fbdb1234b3c2cb706e68bb71ccad2797809
Instruction Fuzzy Hash: 8E314FB2640700ABEB01EBB9AC46A6B3794F328724741093FB508D7192D77C5C55CF5C

Function 00458418 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045847F
QueryPerformanceCounter.KERNEL32(022D3858,00000000,00458712,?,?,022D3858,00000000,?,00458E0E,?,022D3858,00000000), ref: 00458488
GetSystemTimeAsFileTime.KERNEL32(022D3858,022D3858), ref: 00458492
GetCurrentProcessId.KERNEL32(?,022D3858,00000000,00458712,?,?,022D3858,00000000,?,00458E0E,?,022D3858,00000000), ref: 0045849B
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00458511
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,022D3858,022D3858), ref: 0045851F
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 00458567
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,004586BD,?,00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,004586CE), ref: 004585A0

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458649
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045867F
CloseHandle.KERNEL32(000000FF,004586C4,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 004586B7

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

D, xrefs: 004585C2
helper %d 0x%x, xrefs: 00458628
CreateNamedPipe, xrefs: 0045852F
CreateFile, xrefs: 00458575
Starting 64-bit helper process., xrefs: 0045844D
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 004584E7
Helper process PID: %u, xrefs: 0045869C
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458460
64-bit helper EXE wasn't extracted, xrefs: 00458473
CreateProcess, xrefs: 00458652
i, xrefs: 004585FC
SetNamedPipeHandleState, xrefs: 004585A9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 9504134f1b0840cae109e3ce12893ae1ca881710e7b52e2eec49e0a39d18bb41
Instruction ID: 01244017a6d81f6d28e4b5174d8fffcdbc0783d4be9496fecaa57000614c8eca
Opcode Fuzzy Hash: 9504134f1b0840cae109e3ce12893ae1ca881710e7b52e2eec49e0a39d18bb41
Instruction Fuzzy Hash: 71711370A003449EDB10EF65CC45B9EBBF4EB15705F5084BAF918FB282DB7899448F69

Function 00478024 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00477E90: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,022D2BDC,?,?,?,022D2BDC,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
Part of subcall function 00477E90: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
Part of subcall function 00477E90: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022D2BDC,?,?,?,022D2BDC,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
Part of subcall function 00477E90: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022D2BDC,?,?,?,022D2BDC), ref: 00477EEC
Part of subcall function 00477E90: CloseHandle.KERNEL32(00000000,?,?,?,022D2BDC,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A

Part of subcall function 00477F68: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00477FFA,?,?,?,022D2BDC,?,0047805C,00000000,00478172,?,?,-00000010,?), ref: 00477F98

ShellExecuteEx.SHELL32(0000003C), ref: 004780AC
GetLastError.KERNEL32(00000000,00478172,?,?,-00000010,?), ref: 004780B5
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478102
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 00478126
CloseHandle.KERNEL32(00000000,00478157,00000000,00000000,000000FF,000000FF,00000000,00478150,?,00000000,00478172,?,?,-00000010,?), ref: 0047814A

Strings

<, xrefs: 0047806B
GetExitCodeProcess, xrefs: 0047812F
MsgWaitForMultipleObjects, xrefs: 0047810F
runas, xrefs: 00478079
ShellExecuteEx, xrefs: 004780C6
ShellExecuteEx returned hProcess=0, xrefs: 004780D6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-221126205
Opcode ID: 3f9d2181694077b21b868e71eca94cf7724c1513c234160a79aee89dede81d9c
Instruction ID: 4776828256a8cc8572350b5820200226dc7264e1f18f620f8b2e082d5f540a6f
Opcode Fuzzy Hash: 3f9d2181694077b21b868e71eca94cf7724c1513c234160a79aee89dede81d9c
Instruction Fuzzy Hash: 6E316670940208AEDB10EFE6C845ADEB7B8EB04318F90847FF518F7281DA7899058B59

Function 0042285C Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229F4
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BBE), ref: 00422A04

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: feaf7eda56c5d7a46aeac68601ea302718d54c2d1d0da18b2df088f526b52f35
Instruction ID: 9e9026b6a08d43f4c34b0c014f83afec13b9727198b5f0eb67f7172f0d04fbcb
Opcode Fuzzy Hash: feaf7eda56c5d7a46aeac68601ea302718d54c2d1d0da18b2df088f526b52f35
Instruction Fuzzy Hash: 90915171B04214BFDB11EFA9DA86F9D77F4AB04304F5500BAF504AB392CB78AE419B58

Function 00418384 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00418393
GetWindowPlacement.USER32(?,0000002C), ref: 004183B0
GetWindowRect.USER32(?), ref: 004183CC
GetWindowLongA.USER32(?,000000F0), ref: 004183DA
GetWindowLongA.USER32(?,000000F8), ref: 004183EF
ScreenToClient.USER32(00000000), ref: 004183F8
ScreenToClient.USER32(00000000,?), ref: 00418403

Strings

,, xrefs: 0041839C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction ID: 8875a2d430ef8be2c5346fa25315cde737655516302bc4d2344e38a88124d083
Opcode Fuzzy Hash: 093fbc58c9f2bb22a74bd7cb36b3f86111f4d6c014dbe9a16a5ffda61369e0f0
Instruction Fuzzy Hash: 2B112B71505201ABEB00DF69C885F9B77E8AF48314F04067EFD58DB296D738D900CB65

Function 004555E4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00455612
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455639
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045563E
ExitWindowsEx.USER32(00000002,00000000), ref: 0045564F

Strings

SeShutdownPrivilege, xrefs: 0045560B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 71598a6bdd6d5fb56d5762fa92910e3e26de8c4971b3032dc2bdc18874b6a41e
Instruction ID: 23182b732e3c774e917f784577cc733395bd6f0e504c2650860deaf78f25ff04
Opcode Fuzzy Hash: 71598a6bdd6d5fb56d5762fa92910e3e26de8c4971b3032dc2bdc18874b6a41e
Instruction Fuzzy Hash: CBF0C870294B41B9EA10A6718C17F3B21C89B40709F80083ABD05E90D3D7BDD40C4A2E

Function 0045CFD8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045CFE1
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045CFF1
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045D001
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047F453,00000000,0047F47C), ref: 0045D026

Strings

ArcFourInit, xrefs: 0045CFEB
ArcFourCrypt, xrefs: 0045CFFB
ISCryptGetVersion, xrefs: 0045CFDB

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
Instruction ID: 053e23ae93e59936775da3b85939a49c1ec117bb16e32bace9e6a444f988995f
Opcode Fuzzy Hash: 6bea81dda9fbb2f0804f4d34ed7f3fdf770b10932dc8999661774a36d6befbc1
Instruction Fuzzy Hash: 3EF0F9B0980700CBE728EFB6ACC67263795EB9570AF14813BA808A11E2D7780499CB1C

Function 00497C14 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30,?,?,00000000,0049B628), ref: 00497C6B
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 00497CEE
FindNextFileA.KERNEL32(000000FF,?,00000000,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000), ref: 00497D06
FindClose.KERNEL32(000000FF,00497D31,00497D2A,?,00000000,?,00000000,00497D52,?,?,00000000,0049B628,?,00497EDC,00000000,00497F30), ref: 00497D24

Strings

isRS-???.tmp, xrefs: 00497C55
isRS-, xrefs: 00497C8B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
Instruction ID: 58584d30a9cebb9496c34c78ac808807487b68c9e5340ea926fa5a91c3adbdad
Opcode Fuzzy Hash: 364c0e76f2c6b87ee015195f117b48597cda05d20fe84bdce713179882c005fd
Instruction Fuzzy Hash: 22316571A146086BDF10EF65CC41ADEBBBCDF49304F5085BBA908A32A1E63C9E458F58

Function 004573E0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 238windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 0045745D
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457484
SetForegroundWindow.USER32(?), ref: 00457495
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,0045776F,?,00000000,004577AB), ref: 0045775A

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 004575DA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 6bd6caa41a15310477e83bc0a49d1206285915d7cd4776c217e2dcd25b97f1c8
Instruction ID: fa7acb0e2d6b8d582b6902519899a90ae2b0afcf3fbb82d78ce799b77582f668
Opcode Fuzzy Hash: 6bd6caa41a15310477e83bc0a49d1206285915d7cd4776c217e2dcd25b97f1c8
Instruction Fuzzy Hash: DF91D134608204EFD715CF69E991F5ABBF9FB49704F2180BAEC0497792D638AE04DB58

Function 00455E0C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F4B), ref: 00455E3C
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E42

Strings

kernel32.dll, xrefs: 00455E37
GetDiskFreeSpaceExA, xrefs: 00455E32

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
Instruction ID: d81c9a8c7c52065d28d66f53e81ce4f313aa74f068c2efe820cb9bfc493487ae
Opcode Fuzzy Hash: 425acd45c57e1a90a14b519a9b70c26380c560e6a4faa307eedde0d31f767984
Instruction Fuzzy Hash: B0418671A04649AFCF01EFA5C8929EEB7B8EF48305F504567F804F7292D67C5E098B68

Function 00417CD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Strings

,, xrefs: 00417D51

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
Instruction ID: e85585575f8c5a3e7823c55acc6b28d6d187d41511fbfc80546af44b70413e2d
Opcode Fuzzy Hash: a0af22d6e47f15c5c805b34526d81a80d06eca119401db975a7b3104afeb2d4e
Instruction Fuzzy Hash: 4C2112716042089BDF10EF69D8C1AEA77B8AF48314F05456AFD18DF346D678DD84CBA8

Function 00463B50 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463D0D), ref: 00463B81
FindFirstFileA.KERNEL32(00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463C10
FindNextFileA.KERNEL32(000000FF,?,00000000,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CA2
FindClose.KERNEL32(000000FF,00463CC9,00463CC2,?,00000000,?,00000000,00463CE0,?,00000001,00000000,00463D0D), ref: 00463CBC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
Instruction ID: 951735f7a3c6dd48f486321ddf7fb9c00a217b4e97ee71939f184256b73d479b
Opcode Fuzzy Hash: ea3eed7d1408edc3882bc6792a8114668d7e879bec7624fad3ea01842ef17e57
Instruction Fuzzy Hash: 2B41A871A00A58AFCB10EF65DC45ADDB7B8EB88706F4044BAF404B7381E67C9F488E59

Function 00463FCC Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,004641B3), ref: 00464041
FindFirstFileA.KERNEL32(00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 00464087
FindNextFileA.KERNEL32(000000FF,?,00000000,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046413C
FindClose.KERNEL32(000000FF,00464167,00464160,?,00000000,?,00000000,0046417E,?,00000001,00000000,004641B3), ref: 0046415A

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
Instruction ID: 3e1e9a66f2526eb02ce93895e5fa1006c5947d115418489384634c6f5ce8cf05
Opcode Fuzzy Hash: 178f21a278dbeca0b5487afb4cc8a3a474e9964bec91cf1fa54baf1df103d301
Instruction Fuzzy Hash: 7341A434B00A58AFCF11EF65CC859DEB7B9EBC8305F4044AAF804A7341E6389E848E49

Function 0042E934 Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E956
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E981
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E98E
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E996
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F3F,00000000,00452F60), ref: 0042E99C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction ID: 661b18b1de4eb1238568a50ab540e77c3175952f9b14320adb6d96c9b056064d
Opcode Fuzzy Hash: 00c40fca2cfdd97ba02e44e9efda7f487b55ec81a2bcf6d63bb4130569f45397
Instruction Fuzzy Hash: 80F090B23A17207AF620B57A5C86F7F418CCB89B68F10423BBA04FF1D1D9A85D0555AD

Function 00483420 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0048345E
GetWindowLongA.USER32(00000000,000000F0), ref: 0048347C
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 0048349E
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A4,0048293A,0048296E,00000000,0048298E,?,?,?,0049C0A4), ref: 004834B2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
Instruction ID: b2d3f2bb309dc3ccac68fe08692f7b65e7038161d92c55b9b58b225abec03440
Opcode Fuzzy Hash: 7adc6d23a2e45bfcb47f86f15328f2256524f13007b9a6bd5233fe1c8f26e82e
Instruction Fuzzy Hash: 750152706012409AE601BFE59D8AB5A26C55F10F49F18087BB9009F2A2DA2DDA858B1C

Function 004625C4 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00462698), ref: 0046261C
FindNextFileA.KERNEL32(000000FF,?,00000000,00462678,?,00000000,?,00000000,00462698), ref: 00462658
FindClose.KERNEL32(000000FF,0046267F,00462678,?,00000000,?,00000000,00462698), ref: 00462672

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
Instruction ID: 64bef34161faf0391a99b618d3e767a3fd2d5c762390acd0a64fbb4d401bfb5a
Opcode Fuzzy Hash: e94515bc2c8b3d54fda8ee7ea50903a5de584af26bf4ddc4af921dcd62f8e3d1
Instruction Fuzzy Hash: E921D831904B147ECB11EB65DC41ADEB7ACDB49304F5084F7F808E22A1E6B89E548F5A

Function 004241DC Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241E4
SetActiveWindow.USER32(?,?,?,0046CBC7), ref: 004241F1

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Part of subcall function 00423B14: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022D25AC,0042420A,?,?,?,0046CBC7), ref: 00423B4F

SetFocus.USER32(00000000,?,?,?,0046CBC7), ref: 0042421E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction ID: c953833529836f01456b8f788e47b4b7c36f7a841d6c6df07f57e62630513da6
Opcode Fuzzy Hash: 1be179083055f96161d8b165ddd04f1e3bd56871e014c6a07f585ac04199aa1a
Instruction Fuzzy Hash: 8CF030B170012097CB10BFAAA8C5B9676A8AB48344F5500BBBD05DF357CA7CDC018778

Function 00417CCE Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D0F
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D2D
GetWindowPlacement.USER32(?,0000002C), ref: 00417D63
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D8A

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
Instruction ID: d9358ea7cd183770b33139a8ac7b7a0a70302bd2c01e5fc8313c3e2814ac7f2c
Opcode Fuzzy Hash: 76c66e33316401a89d3facc50d11a2b6f1ba08a7ab00baf439cd89f832e1e53a
Instruction Fuzzy Hash: 33012C71204108ABDB10EE59D8C1EF673A8AF45724F154566FD19DF242D639ED8087A8

Function 00417598 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175C3
GetCapture.USER32 ref: 004175CC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
Instruction ID: 6cb7601519473143bf4e876ebf6758ccc8fc4fa751d6c6e0357a6193460a6b05
Opcode Fuzzy Hash: c22591b8c3f2be6e3e416ff0957708157ed46c57fff49ed7de8fa542590db40d
Instruction Fuzzy Hash: 0AF0A4723056425BD730AB2EC984AB762F69F84314B14403BE419CBFA1EB3CDCC08798

Function 00424194 Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0042419B

Part of subcall function 00423A84: EnumWindows.USER32(00423A1C), ref: 00423AA8
Part of subcall function 00423A84: GetWindow.USER32(?,00000003), ref: 00423ABD
Part of subcall function 00423A84: GetWindowLongA.USER32(?,000000EC), ref: 00423ACC
Part of subcall function 00423A84: SetWindowPos.USER32(00000000,\AB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241AB,?,?,00423D73), ref: 00423B02

SetActiveWindow.USER32(?,?,?,00423D73,00000000,0042415C), ref: 004241AF

Part of subcall function 0042364C: ShowWindow.USER32(00410460,00000009,?,00000000,0041EDA4,0042393A,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C0C), ref: 00423667

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction ID: ce5d4440ec1c13bcfda566247f28ea27228b22b89c70f7a48f218b5e8bc86154
Opcode Fuzzy Hash: b2ff140757208bd7b7cc33ac29151dbeb423d1cdddd3b288bc041a56f1810338
Instruction Fuzzy Hash: 55E01AA070011087DB10AFAADCC8B9632A9BB48304F55017ABD49CF35BD63CC8608724

Function 004125D8 Relevance: 1.7, APIs: 1, Instructions: 188nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,004127D5), ref: 004127C3

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction ID: 2c049f03cfb376e3baa0368465928f91904f6d03483072bf0e6cb5f6a46bccc5
Opcode Fuzzy Hash: 120c9c179850e2d77f2b5158c289480559fb4752f9becda92d3f5c4f199058c9
Instruction Fuzzy Hash: 4A5102357082048FD710DB6ADA80A9BF3E5EF98314B2082BBD814C77A1D7B8AD91C75D

Function 004785E0 Relevance: 1.6, APIs: 1, Instructions: 107nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0047872E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 10ca812e3c548e1abffc20113ea3ec26250c704f28d0c7929afa756ed2071b4a
Instruction ID: 93be4e423146f0b72d2fb04b2818289b08cc6f156d75f667f85849a608f59376
Opcode Fuzzy Hash: 10ca812e3c548e1abffc20113ea3ec26250c704f28d0c7929afa756ed2071b4a
Instruction Fuzzy Hash: 81416979604104EFCB10CF99D6889AAB7F5FB48310B74C5AAE809EB701DB38EE41DB55

Function 0045D08C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045D097

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
Instruction ID: 2e238a974be0c8424367b3c35ccc205e7f0a308c5ec670be841bb4718b7179ff
Opcode Fuzzy Hash: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
Instruction Fuzzy Hash: 37C09BF200420CBF660057D5ECC9C77B75CF6586547508126F6048210195726C104574

Function 0045D0A4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,0046D988,?,0046DB69), ref: 0045D0AA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
Instruction ID: 227689971defb3a768f182aa15824e3680876923b4d994b81e1676941902ce31
Opcode Fuzzy Hash: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
Instruction Fuzzy Hash: 9DA002B0A80300BAFD2057B05D4EF26352CA7D0F05F708465B202EA0D085A56410852C

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3886144837.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.3886128836.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3886165119.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3886144837.0000000010001000.00000020.00000001.01000000.00000007.sdmp, Offset: 10000000, based on PE: true

Associated: 00000001.00000002.3886128836.0000000010000000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000001.00000002.3886165119.0000000010002000.00000002.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_10000000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Function 0044B658 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B604: GetVersionExA.KERNEL32(00000094), ref: 0044B621

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C9
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7DB
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7ED
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7FF
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B811
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B823
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B835
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B847
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B859
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B86B
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B87D
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B88F
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B8A1
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8B3
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8C5
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8D7
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E9
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8FB
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B90D
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B91F
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B931
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B943
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B955
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B967
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B979
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B98B
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B99D
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9AF
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9C1
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9D3

Strings

SetWindowTheme, xrefs: 0044B875
EnableTheming, xrefs: 0044B9CB
IsThemeActive, xrefs: 0044B917
HitTestThemeBackground, xrefs: 0044B743
uxtheme.dll, xrefs: 0044B67A
CloseThemeData, xrefs: 0044B6A1
DrawThemeBackground, xrefs: 0044B6B3
GetThemeString, xrefs: 0044B7C1
GetThemeBackgroundRegion, xrefs: 0044B731
GetThemeEnumValue, xrefs: 0044B7F7
IsAppThemed, xrefs: 0044B929
SetThemeAppProperties, xrefs: 0044B983
OpenThemeData, xrefs: 0044B68F
GetThemeFont, xrefs: 0044B81B
GetThemeFilename, xrefs: 0044B887
GetThemeSysSize, xrefs: 0044B8CF
GetThemeDocumentationProperty, xrefs: 0044B9A7
GetThemeSysFont, xrefs: 0044B8E1
GetThemeIntList, xrefs: 0044B851
GetThemeAppProperties, xrefs: 0044B971
GetThemeSysColorBrush, xrefs: 0044B8AB
GetCurrentThemeName, xrefs: 0044B995
GetThemeMetric, xrefs: 0044B7AF
GetThemeBool, xrefs: 0044B7D3
GetThemeTextExtent, xrefs: 0044B70D
GetThemeInt, xrefs: 0044B7E5
GetThemeColor, xrefs: 0044B79D
DrawThemeEdge, xrefs: 0044B755
DrawThemeParentBackground, xrefs: 0044B9B9
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B78B
GetWindowTheme, xrefs: 0044B93B
GetThemeTextMetrics, xrefs: 0044B71F
IsThemePartDefined, xrefs: 0044B779
GetThemePosition, xrefs: 0044B809
GetThemeMargins, xrefs: 0044B83F
IsThemeDialogTextureEnabled, xrefs: 0044B95F
DrawThemeIcon, xrefs: 0044B767
GetThemeRect, xrefs: 0044B82D
GetThemeSysInt, xrefs: 0044B905
GetThemeBackgroundContentRect, xrefs: 0044B6D7, 0044B6E9
GetThemeSysBool, xrefs: 0044B8BD
GetThemeSysString, xrefs: 0044B8F3
GetThemePartSize, xrefs: 0044B6FB
GetThemeSysColor, xrefs: 0044B899
GetThemePropertyOrigin, xrefs: 0044B863
DrawThemeText, xrefs: 0044B6C5
EnableThemeDialogTexture, xrefs: 0044B94D

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction ID: e93aa9000a3b975727f71862fff1c9a8a52c50bca2d3d110ef64c9f3a3b13d35
Opcode Fuzzy Hash: 4248c38413e99d9464b79edb7fe9b1fdc4fa56b35b8262d24df0eec612bb70b6
Instruction Fuzzy Hash: D391A8F0A40B11ABEB00EFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Function 0041CA0C Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041CA40
CreateCompatibleDC.GDI32(?), ref: 0041CA4C
CreateBitmap.GDI32(0041A944,?,00000001,00000001,00000000), ref: 0041CA70
CreateCompatibleBitmap.GDI32(?,0041A944,?), ref: 0041CA80
SelectObject.GDI32(0041CE3C,00000000), ref: 0041CA9B
FillRect.USER32(0041CE3C,?,?), ref: 0041CAD6
SetTextColor.GDI32(0041CE3C,00000000), ref: 0041CAEB
SetBkColor.GDI32(0041CE3C,00000000), ref: 0041CB02
PatBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00FF0062), ref: 0041CB18
CreateCompatibleDC.GDI32(?), ref: 0041CB2B
SelectObject.GDI32(00000000,00000000), ref: 0041CB5C
SelectPalette.GDI32(00000000,00000000,00000001), ref: 0041CB74
RealizePalette.GDI32(00000000), ref: 0041CB7D
SelectPalette.GDI32(0041CE3C,00000000,00000001), ref: 0041CB8C
RealizePalette.GDI32(0041CE3C), ref: 0041CB95
SetTextColor.GDI32(00000000,00000000), ref: 0041CBAE
SetBkColor.GDI32(00000000,00000000), ref: 0041CBC5
BitBlt.GDI32(0041CE3C,00000000,00000000,0041A944,?,00000000,00000000,00000000,00CC0020), ref: 0041CBE1
SelectObject.GDI32(00000000,?), ref: 0041CBEE
DeleteDC.GDI32(00000000), ref: 0041CC04

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ColorSelect$CreatePalette$CompatibleObject$BitmapRealizeText$DeleteFillRect
String ID:
API String ID: 269503290-0
Opcode ID: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
Instruction ID: 91afdf38925dfcc0a19aef53af63d8b93a06df8cfedaf367688fa0d34ebdb442
Opcode Fuzzy Hash: 5610cf759d7025b655e2849d1764ebaab2a311e46506ba216d1aa554289a1213
Instruction Fuzzy Hash: 01610071A44648AFDF10EBE9DC86FDFB7B8EB48704F10446AB504E7281D67CA940CB68

Function 00497F40 Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000,00498699,?,00000000), ref: 00497FC3
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000,?,0049868F,00000000), ref: 00497FD6
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000,00000000), ref: 00497FE6
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00498007
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,004982D8,?,?,00000000,?,00000000), ref: 00498017

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

/REGU, xrefs: 00497F99
/REG, xrefs: 00497F75
.lst, xrefs: 00498054
Setup, xrefs: 00497FAF
.msg, xrefs: 0049803A
Inno-Setup-RegSvr-Mutex, xrefs: 00497FCD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
Instruction ID: 42a01cccdaaec234e2c43ae8d099a56eb68d33786198a0d03eeaed72e33259cf
Opcode Fuzzy Hash: acab9580149f75eae7839736e9631fcca2424d0ecbbcfe327cba637ac9836c34
Instruction Fuzzy Hash: 3991B530A046049FDF11EBA9D852BAE7BA4EB4A704F5144BBF500AB682DE7D9C05CB1D

Function 0045A528 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A7E4,?,?,?,?,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 0045A696

Strings

.lnk, xrefs: 0045A603
Stripped read-only attribute., xrefs: 0045A66F
.hlp, xrefs: 0045A55F
.chm, xrefs: 0045A5C4
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A6DF
Failed to strip read-only attribute., xrefs: 0045A67B
.chw, xrefs: 0045A5DD
.fts, xrefs: 0045A59C
Deleting file: %s, xrefs: 0045A635
.gid, xrefs: 0045A578
Failed to delete the file; it may be in use (%d)., xrefs: 0045A785

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 7b4c67a2979538d05da33b0281ac62305e71b724ae5420e86ae83fd1cfea1fbc
Instruction ID: 3d84b67d4b55823e814de2816039390ec2683d954eb16ce362ee678782389cb9
Opcode Fuzzy Hash: 7b4c67a2979538d05da33b0281ac62305e71b724ae5420e86ae83fd1cfea1fbc
Instruction Fuzzy Hash: 9A719030B002485BCB10EB698891BAE77B59F48719F54856BFC01AB383DA7CDE1D875E

Function 0045CA10 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045CA2A
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CA4A
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CA57
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CA64
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CA72

Part of subcall function 0045C918: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045C9B7,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045C991

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB2B
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC65,?,?,00000000), ref: 0045CB34

Strings

advapi32.dll, xrefs: 0045CA45
GetNamedSecurityInfoW, xrefs: 0045CA51
W, xrefs: 0045CB42
SetNamedSecurityInfoW, xrefs: 0045CA5E
SetEntriesInAclW, xrefs: 0045CA6C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: 551fcf749c72914a38171c600357803e83c81dab8682d1b21c615cfe1b656b91
Instruction ID: 9267600119b74d5c47b6def8195b3f0e3f25b5cd065e112b6ecb42d85fa503a5
Opcode Fuzzy Hash: 551fcf749c72914a38171c600357803e83c81dab8682d1b21c615cfe1b656b91
Instruction Fuzzy Hash: B1518571900708EFDB11DFA9C885BAEBBB8EB4C311F14806AF915B7241C6799944CFA9

Function 00456564 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 282comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565A6
CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,004568A1), ref: 004565CC
SysFreeString.OLEAUT32(?), ref: 00456759

Strings

IShellLink::QueryInterface(IID_IPersistFile), xrefs: 004567CA
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456790
CoCreateInstance, xrefs: 004565D7
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 0045673E
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 004566BB
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004566EF
IPropertyStore::Commit, xrefs: 004567A9
IPersistFile::Save, xrefs: 00456828

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateInstance$FreeString
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
API String ID: 308859552-3936712486
Opcode ID: c517585abefeef5e4aecaacf0f1214f05652fa0e4087abcedef047af4287d9d3
Instruction ID: 8ea5dda7a560ded85d07eb9974ca036a449deae5e5e286e87ef099e1c3d3d79c
Opcode Fuzzy Hash: c517585abefeef5e4aecaacf0f1214f05652fa0e4087abcedef047af4287d9d3
Instruction Fuzzy Hash: 70A12171A00105AFDB50DFA9C885BAE77F8EF09306F55406AF904E7262DB38DD48CB69

Function 0041B3AC Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 0041B3C3
CreateCompatibleDC.GDI32(00000000), ref: 0041B3CD
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3DF
CreateBitmap.GDI32(0000000B,?,00000001,00000001,00000000), ref: 0041B3F6
GetDC.USER32(00000000), ref: 0041B402
CreateCompatibleBitmap.GDI32(00000000,0000000B,?), ref: 0041B42F
ReleaseDC.USER32(00000000,00000000), ref: 0041B455
SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction ID: 0f3e5998203d07172116f12fa3fedaa120d09cd030f2870c51d139f455c41937
Opcode Fuzzy Hash: 9212dc48eb065078ffd6e64a0fe4b3e7e755c3ed7e1f96497366cc94fc87ddf9
Instruction Fuzzy Hash: E941AD71E44619AFDB10DAE9C846FEFB7BCEB08704F104466B614F7281D6786D408BA8

Function 004729BC Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472B74
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472C7B
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472C91
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472CB6

Strings

.lnk, xrefs: 00472A48
Desktop.ini, xrefs: 00472D37
Filename: %s, xrefs: 00472B16
target.lnk, xrefs: 00472D00
{group}\, xrefs: 00472A16
.url, xrefs: 00472A8E
.pif, xrefs: 00472A6B, 00472BFF

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: f320f92f694209bf3d87b242267b6161fd66681942871ca2a5a7eb633dffa5fc
Instruction ID: 488d38facc3b5b4348deb9d7b7a0b4180c51b54c04cb4348039bcbbbcac6ad39
Opcode Fuzzy Hash: f320f92f694209bf3d87b242267b6161fd66681942871ca2a5a7eb633dffa5fc
Instruction Fuzzy Hash: 62D13574A001499FDB11EFA9D981BDDBBF5AF08304F50806AF904B7392C778AE45CB69

Function 00454874 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,?,00000000,?,00000000,00454B0D,?,0045A9BA,00000003,00000000,00000000,00454B44), ref: 0045498D

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A11
RegQueryValueExA.ADVAPI32(0045A9BA,00000000,00000000,00000000,?,00000004,00000000,00454A57,?,0045A9BA,00000000,00000000,?,00000000,?,00000000), ref: 00454A40

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548AB
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548E4
, xrefs: 004548FE
RegOpenKeyEx, xrefs: 00454910

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: d2d2157a54bb89dc076ef9e0fa42170e86ba3ac777985cc89856524af98327e3
Instruction ID: 10c729c5df0f457655d9edc07d187ac9b2ad403c2690153cc8aec617143616fc
Opcode Fuzzy Hash: d2d2157a54bb89dc076ef9e0fa42170e86ba3ac777985cc89856524af98327e3
Instruction Fuzzy Hash: D1914871E44148ABDB10DF95C842BDEB7FCEB49309F50406BF900FB282D6789E458B69

Function 004592A8 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004591B4: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 0045934F
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 004593B9

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459420

Strings

.NET Framework version %s not found, xrefs: 00459459
v4.0.30319, xrefs: 00459341
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 004593D3
v1.1.4322, xrefs: 00459412
v2.0.50727, xrefs: 004593AB
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045936C
.NET Framework not found, xrefs: 0045946D
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00459302

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
Instruction ID: 97f3333ca529404cdccdc0b2d9ed50ca34310147e07c283222f48f4afab481b6
Opcode Fuzzy Hash: 54e34cd44602b93ede3f7296a9310ab82d879df4d5c444ac47c898e8d614a2f1
Instruction Fuzzy Hash: 7551B331A04144DBCB04DFA8D8A17EE77B6DB49305F54447BA841DB392E73D9E0ACB18

Function 00458894 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 004588CB
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004588E7
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004588F5
GetExitCodeProcess.KERNEL32(?), ref: 00458906
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045894D
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458969

Strings

Helper isn't responding; killing it., xrefs: 004588D7
Helper process exited, but failed to get exit code., xrefs: 0045893F
Helper process exited., xrefs: 00458915
Helper process exited with failure code: 0x%x, xrefs: 00458933
Stopping 64-bit helper process. (PID: %u), xrefs: 004588BD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
Instruction ID: 059a586d5f9fe809614c5be1e0bb00d3bdcd38e01f6b882276f5f7501e11c42c
Opcode Fuzzy Hash: 73dbfa3cdad617e305c3f832d4c000a78a7b9bdfac17e51cf2f5e1c942fa38a0
Instruction Fuzzy Hash: 4C2130706087409AD720E67AC485B6B76D4AF08305F00C82FB9DAE7693DE78E848D75B

Function 00454528 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDE4: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE10

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045464F
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546FF,?,00000000,004547C3), ref: 0045478B

Part of subcall function 0042E8C8: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453273,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8E7

Strings

RegCreateKeyEx, xrefs: 004545C3
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454597
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 00454567
, xrefs: 004545B1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: 64c03f8d0974fb8baae80ac1f56f66a2074ee7a7d7e2c1940a2ac01f19c1dde8
Instruction ID: cde7545684c4620c2d036396f19d9a4160a162433608d969df8f63117b7f1412
Opcode Fuzzy Hash: 64c03f8d0974fb8baae80ac1f56f66a2074ee7a7d7e2c1940a2ac01f19c1dde8
Instruction Fuzzy Hash: AC81FF75A00209ABDB00DFD5C981BDEB7B9EB49309F50452AF900FB282D7789A45CB69

Function 004967C0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 004538BC: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
Part of subcall function 004538BC: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 0049683D
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,00496991), ref: 0049685E
CreateWindowExA.USER32(00000000,STATIC,004969A0,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496885
SetWindowLongA.USER32(?,000000FC,00496018), ref: 00496898
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC,004969A0), ref: 004968C8
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 0049693C
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000), ref: 00496948

Part of subcall function 00453D30: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

DestroyWindow.USER32(?,0049696B,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496964,?,?,000000FC,00496018,00000000,STATIC), ref: 0049695E

Strings

/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 004968F7
STATIC, xrefs: 0049687E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$File$CloseCreateHandle$AttributesCopyDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1549857992-2312673372
Opcode ID: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
Instruction ID: 93ed1b954d13302bbccf96d2c338465d3c98789abcf3618d64464ab15fb4d88f
Opcode Fuzzy Hash: 7b9aa83098eabb2dba0b70aa405a2d9f6b8f1b4b66eab831558cfba939a8a2a9
Instruction Fuzzy Hash: 71412C70A04608AEDF00EBA5DC42FAE7BB8EB09714F51457AF400F7291D6799A008B69

Function 0042E418 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E441
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E447
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E51D,?,00000000,0047E1C0,00000000), ref: 0042E495

Strings

kernel32.dll, xrefs: 0042E43C
Control Panel\Desktop\ResourceLocale, xrefs: 0042E4A4
GetUserDefaultUILanguage, xrefs: 0042E437
Locale, xrefs: 0042E484
.DEFAULT\Control Panel\International, xrefs: 0042E46C
QaE, xrefs: 0042E4D7, 0042E4DF, 0042E4EA, 0042E50C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$QaE$kernel32.dll
API String ID: 4190037839-2312295185
Opcode ID: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
Instruction ID: f42d7e7755912f49377b3a3c2778cbb45b18f2cdc7334bb7b0fb93ca3fe573dd
Opcode Fuzzy Hash: cc4cf932d7b220052410dacf18b487448e6dec6834fb41b85ae1fa26c47c2f69
Instruction Fuzzy Hash: E8213230B10225BBDB10EAE6DC51B9E76B8EB44308F90447BA504E7281E77CDE419B5C

Function 00462864 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00462870
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462884
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462891
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0046289E
GetWindowRect.USER32(?,00000000), ref: 004628EA
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 00462928

Strings

MonitorFromWindow, xrefs: 0046288B
GetMonitorInfoA, xrefs: 00462898
user32.dll, xrefs: 0046287F
(, xrefs: 004628C9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
Instruction ID: fe1f68fcdb92d8fdb5b24afc8a588ee1dd3fc27577eab862170fec9bd430383f
Opcode Fuzzy Hash: 963cd5e9bec20ae9785dbab648af90e3917fdde5ac028f1e20745c9c218af8a1
Instruction Fuzzy Hash: 4621C5B5301B056BD301EA648D41F3B3699EBC4714F05052AF944DB3C6E6B8EC048B9A

Function 0042F188 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F194
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A8
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1B5
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1C2
GetWindowRect.USER32(?,00000000), ref: 0042F20E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F24C

Strings

GetMonitorInfoA, xrefs: 0042F1BC
(, xrefs: 0042F1ED
user32.dll, xrefs: 0042F1A3
MonitorFromWindow, xrefs: 0042F1AF

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
Instruction ID: 50a2e38ba83faf67dd7c56e8d7733487d454ef14a416094e89dadcccf0bf0910
Opcode Fuzzy Hash: fe4f6826bb7301b99e83fbe15c42cc49c8205db95b757379d9683ee99bf223cf
Instruction Fuzzy Hash: 3821F279704710ABD300EA68ED41F3B37A9DB89714F88457AF944DB382DA79EC044BA9

Function 00458A6C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458C4B,?,00000000,00458CAE,?,?,022D3858,00000000), ref: 00458AC9
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,022D3858,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B26
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,022D3858,?,00000000,00458BE0,?,00000000,00000001,00000000,00000000,00000000,00458C4B), ref: 00458B33
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458B7F
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,022D3858,?,00000000,00458BE0,?,00000000), ref: 00458BA5
GetLastError.KERNEL32(?,?,00000000,00000001,00458BB9,?,-00000020,0000000C,-00004034,00000014,022D3858,?,00000000,00458BE0,?,00000000), ref: 00458BAC

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

TransactNamedPipe, xrefs: 00458B3F
CreateEvent, xrefs: 00458AD7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 971ff5326f64256da56b2a3a5e971e3af97d4d6353f8bcf162cac826e6801041
Instruction ID: 4e8b515c978fc0f7227371b00e454fc29eb41545a574c41675fd698137751177
Opcode Fuzzy Hash: 971ff5326f64256da56b2a3a5e971e3af97d4d6353f8bcf162cac826e6801041
Instruction Fuzzy Hash: D74185B1A00608AFDB15DF95CD41F9EB7F8FB48715F10406AF900F7292CA78AE44CA68

Function 00456B6C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456CD1,?,?,00000031,?), ref: 00456B94
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456B9A
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456BE7

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

UnRegisterTypeLib, xrefs: 00456B8A
ITypeLib::GetLibAttr, xrefs: 00456C1D
UnRegisterTypeLib, xrefs: 00456C53
OLEAUT32.DLL, xrefs: 00456B8F
LoadTypeLib, xrefs: 00456BF2
GetProcAddress, xrefs: 00456BA7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
Instruction ID: 513f35abe53900720ade907ad6bd055a7f67a8f7377afb521354ad4100752fe6
Opcode Fuzzy Hash: ee3ea3d82efd4fb2b54eebd443786074e6cae9edf60e5ac548ea64bc7aca37c1
Instruction Fuzzy Hash: 54319671700604AFDB02EFAACD51D5BB7BDEB8974575284A6BC04D3752DA38DD04C728

Function 00416D80 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E13
SaveDC.GDI32(?), ref: 00416E27
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E4A
RestoreDC.GDI32(?,?), ref: 00416E65
CreateSolidBrush.GDI32(00000000), ref: 00416EE5
FrameRect.USER32(?,?,?), ref: 00416F18
DeleteObject.GDI32(?), ref: 00416F22
CreateSolidBrush.GDI32(00000000), ref: 00416F32
FrameRect.USER32(?,?,?), ref: 00416F65
DeleteObject.GDI32(?), ref: 00416F6F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 35a16e57ef2060bc5b86dfaf9fb4dd0844c8f61540c1a86612a76d2e62787fd3
Instruction ID: c082a38e55a2621cff38c0036c5e412d4739722926df34ebe37a7eff5f7859fc
Opcode Fuzzy Hash: 35a16e57ef2060bc5b86dfaf9fb4dd0844c8f61540c1a86612a76d2e62787fd3
Instruction Fuzzy Hash: 70515A712086459FDB50EF69C8C4B9B77E8AF48314F15466AFD488B286C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 004221E8 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00422233
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422251
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042225E
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0042226B
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422278
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 00422285
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 00422292
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 0042229F
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222BD
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
Instruction ID: 662ae76830c3dbb110fd6952920e185112f137d20e740dc0dcce1beff7d7cd05
Opcode Fuzzy Hash: d8fcfd45993f68361b05288e300d90e061abaf0c01acb012dac33f8cfd749464
Instruction Fuzzy Hash: AF2144703407047AE720E724CD8BF9BBBD89B04708F5451A5BA487F6D3C6F9AB804698

Function 00481338 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(10000000), ref: 004814F5
FreeLibrary.KERNEL32(00000000), ref: 00481509
SendNotifyMessageA.USER32(00020414,00000496,00002710,00000000), ref: 0048157B

Strings

Restarting Windows., xrefs: 00481556
Deinitializing Setup., xrefs: 00481356
DeinitializeSetup, xrefs: 004813F1
Not restarting Windows because Setup is being run from the debugger., xrefs: 0048152A
GetCustomSetupExitCode, xrefs: 00481395

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: 7fd84dd053b4401f5bdf0ca771466cc8f90a001c2e291a6a881faa6dba982769
Instruction ID: a147a64e5fa7f59d2c1c0707bc10c89f769f7b05bbdcd0d826f9af474dd6dcab
Opcode Fuzzy Hash: 7fd84dd053b4401f5bdf0ca771466cc8f90a001c2e291a6a881faa6dba982769
Instruction Fuzzy Hash: 55519F30700240AFD311EB69E8D5B6E7BA8EB59714F50887BE805C73B1DB38AC46CB59

Function 00461500 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 0046153B
GetActiveWindow.USER32 ref: 0046159F
CoInitialize.OLE32(00000000), ref: 004615B3
SHBrowseForFolder.SHELL32(?), ref: 004615CA
CoUninitialize.OLE32(0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615DF
SetActiveWindow.USER32(?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615F5
SetActiveWindow.USER32(?,?,0046160B,00000000,?,?,?,?,?,00000000,0046168F), ref: 004615FE

Strings

A, xrefs: 00461573

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
Instruction ID: 8a944d3e7b26c7d839f1ecf9cf32de2b38f87d5f920ef02beae42f78277bfb86
Opcode Fuzzy Hash: 703f1963e0dc72a1c395d9026068ceb343fdf60ef3171849bb259b064323ba87
Instruction Fuzzy Hash: 62312D70E00358AFDB00EFA6D885A9EBBF8EB09304F55847AF405E7251E7789A048B59

Function 0047286C Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89,?,?,00000000,00472DF8), ref: 00472890

Part of subcall function 0042CD94: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE0A

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000,?,00472B89), ref: 00472907
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,0047292D,?,?,?,00000008,00000000,00000000,00000000), ref: 0047290D

Strings

.ShellClassInfo, xrefs: 004728BF
target.lnk, xrefs: 004728E5
CLSID2, xrefs: 004728BA
{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 004728C9
desktop.ini, xrefs: 004728A4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 8c120786a4ea8c92214831f90170699f67ddada7000dc7cca521b0e92e4fa8e9
Instruction ID: c9f0bcdda41dfe4bc4fb8c2ad9af4abf79d42ba832169be77a83c6f088ccd444
Opcode Fuzzy Hash: 8c120786a4ea8c92214831f90170699f67ddada7000dc7cca521b0e92e4fa8e9
Instruction Fuzzy Hash: A711D0F07005147BD701F66A8D82BAFB2ACDB49714F65807BB604B72C1DB7CAE01865C

Function 0045D104 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D10D
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D11D
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D12D
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D13D

Strings

inflate, xrefs: 0045D117
inflateInit_, xrefs: 0045D107
inflateReset, xrefs: 0045D137
inflateEnd, xrefs: 0045D127

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
Instruction ID: 41a921eeb660c13fccdf509460c8c4a7353affed60c98b376863fdd8d28133a2
Opcode Fuzzy Hash: 642f53b55b6c69fa488a6078c858724ccece433db3f4d1a063b28ca439a42b30
Instruction Fuzzy Hash: 1A01FFB0D00B00DAE724EFB69D9572736A5AB64306F14C03B9C09962A6D7790858DF6C

Function 0041A8DC Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0041A9F3
SetBkColor.GDI32(?,?), ref: 0041AA08
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA52
SetTextColor.GDI32(00000000,00000000), ref: 0041AA5D
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA6D
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAAC
SetTextColor.GDI32(00000000,00000000), ref: 0041AAB6
SetBkColor.GDI32(00000000,?), ref: 0041AAC3

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
Instruction ID: 4467ea82dd13d464879b0bd0dd0607b47ee3045dce17e21d2c6451b7f26a8ea4
Opcode Fuzzy Hash: d922b450a47b78d2b04aec2ac0d2e0f837e00e48c8544b253d9025e975fd03f1
Instruction Fuzzy Hash: 8761E5B5A00505AFCB40EFADD985E9AB7F8EF08314B10816AF908DB262C775ED40CF58

Function 00457F14 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,004580C8,?, /s ",?,regsvr32.exe",?,004580C8), ref: 0045803A

Strings

Spawning 64-bit RegSvr32: , xrefs: 00457F9F
D, xrefs: 00457FF0
regsvr32.exe", xrefs: 00457F5B
Spawning 32-bit RegSvr32: , xrefs: 00457FC1
CreateProcess, xrefs: 0045802C
/s ", xrefs: 00457F83
/u, xrefs: 00457F76
0x%x, xrefs: 0045805D

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: d723b4d4e63128474f1a7954f42046bb5ea4c3ccf1ebb930fe5345dfcc04232a
Instruction ID: e9c79437d4df6862de8c7cd7f55e60b8630b5ed7fadd4497393df937d865c406
Opcode Fuzzy Hash: d723b4d4e63128474f1a7954f42046bb5ea4c3ccf1ebb930fe5345dfcc04232a
Instruction Fuzzy Hash: AA410670A043086BDB11EFD6D842B8EB7B9AF45705F51407FA904BB292DF789A0D8B19

Function 0044D178 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A9
GetSysColor.USER32(00000014), ref: 0044D1B0
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C8
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1F1
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1FB
GetSysColor.USER32(00000010), ref: 0044D202
SetTextColor.GDI32(00000000,00000000), ref: 0044D21A
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D243
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D26E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
Instruction ID: 8406a00effd73db105afccad7da3796984cf264811f0ddac3e5cace4e0ac1d2b
Opcode Fuzzy Hash: 4054566e8ba3b89cdd91132f39c510e9855df1fb138f21794d8e69447c138b72
Instruction Fuzzy Hash: A021BDB42015047FC710FB2ACD8AE8B6BDCDF19319B05457AB958EB292C67CDD404668

Function 0047778C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004776B4: GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
Part of subcall function 004776B4: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
Part of subcall function 004776B4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5

SendMessageA.USER32(00000000,0000004A,00000000,F{G), ref: 004777C1
GetTickCount.KERNEL32 ref: 00477806
GetTickCount.KERNEL32 ref: 00477810
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 00477865

Strings

F{G, xrefs: 004777B3, 004777B6
CallSpawnServer: Unexpected response: $%x, xrefs: 004777F6
CallSpawnServer: Unexpected status: %d, xrefs: 0047784E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d$F{G
API String ID: 613034392-3657229555
Opcode ID: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
Instruction ID: 2d480610a6b59e2baa88e371a3ce18c9cee9fe0f547c40ec3b8b85eb822a561a
Opcode Fuzzy Hash: 6d97cf5564b98f17fd9f3b8579433905f0e6c95bef7ad8bee9a9e7eacc473beb
Instruction Fuzzy Hash: CB31A234F042159ADB10EBB9C8867EE76A1AB44314F90847BF548EB392D67C9D01CBAD

Function 00496064 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0045092C: SetEndOfFile.KERNEL32(?,?,0045C192,00000000,0045C31D,?,00000000,00000002,00000002), ref: 00450933

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

GetWindowThreadProcessId.USER32(00000000,?), ref: 004960F5
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00496109
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00496123
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 0049612F
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496135
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00496148

Strings

Deleting Uninstall data files., xrefs: 0049606B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
Instruction ID: a2b0394162f9d438edd1a59a6b8f88e08a82a6f464fdedc4f7b2e31c99877ff7
Opcode Fuzzy Hash: 1c14f06cf20906d6098757f7c161041ddb556eb254dcbfb897c76230ada43d7f
Instruction Fuzzy Hash: 5F218570304250AFEB10EB7AFCC6B163798EB54728F52453BB505962D3D67CAC04CA6C

Function 00470070 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D,?,?,?,?,00000000), ref: 004700D7
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,0047016D), ref: 004700EE
AddFontResourceA.GDI32(00000000), ref: 0047010B
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0047011F

Strings

AddFontResource, xrefs: 00470129
Failed to set value in Fonts registry key., xrefs: 004700E0
Failed to open Fonts registry key., xrefs: 004700F5

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: fb5005e48ab5c7daaaac94a0dc4afa742b509cb9d69f51cda3f3c10b282e3f45
Instruction ID: 4679b390ee7f38cc50779b5755f8f256d37ac4db7264feb969586a41c0613652
Opcode Fuzzy Hash: fb5005e48ab5c7daaaac94a0dc4afa742b509cb9d69f51cda3f3c10b282e3f45
Instruction Fuzzy Hash: 1E21F470741204BBD710EA669C42FAE779DDB45704F908077B904EB3C2DA7DEE01962D

Function 00462CA4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416410: GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
Part of subcall function 00416410: UnregisterClassA.USER32(?,00400000), ref: 004164AB
Part of subcall function 00416410: RegisterClassA.USER32(?), ref: 004164CE

GetVersion.KERNEL32 ref: 00462CD4
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462D12
SHGetFileInfo.SHELL32(00462DB0,00000000,?,00000160,00004011), ref: 00462D2F
LoadCursorA.USER32(00000000,00007F02), ref: 00462D4D
SetCursor.USER32(00000000,00000000,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D53
SetCursor.USER32(?,00462D93,00007F02,00462DB0,00000000,?,00000160,00004011), ref: 00462D86

Strings

Explorer, xrefs: 00462CEE

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
Instruction ID: 9dbbc9fa048eb90f76178aab56daef4cc46522196ca1757d39461a436d1c0ce4
Opcode Fuzzy Hash: b2508eec98d805366e2f4507ea44d46b961a44d372cb9f0a28019716940d75e3
Instruction Fuzzy Hash: A521D2707403047AE711BB758D47B9A36989B09708F5004BFF608EA2C3EEBC9801866E

Function 00477E90 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,022D2BDC,?,?,?,022D2BDC,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EA9
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477EAF
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022D2BDC,?,?,?,022D2BDC,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477EC2
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,022D2BDC,?,?,?,022D2BDC), ref: 00477EEC
CloseHandle.KERNEL32(00000000,?,?,?,022D2BDC,00478054,00000000,00478172,?,?,-00000010,?), ref: 00477F0A

Strings

GetFinalPathNameByHandleA, xrefs: 00477E9F
kernel32.dll, xrefs: 00477EA4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 4ac9b8a734794afedd7c4e5dff1684406e57be29ff440d920efac7cf7b76c0e4
Instruction ID: 07fb0e6c3cbff21d125a0516fcac6af2f028e938fd8349bed9720d5bfc433141
Opcode Fuzzy Hash: 4ac9b8a734794afedd7c4e5dff1684406e57be29ff440d920efac7cf7b76c0e4
Instruction Fuzzy Hash: 2101B55074870536E520316A5E86FBF648C8B5477DF548137FB1CEE2D2E9AC9D06026E

Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(0075EA18,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,0075EA18,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(0075FA18,?,00000000,00008000,0075EA18,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Strings

LvLv, xrefs: 00401ADB, 00401AF5, 00401AFD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: LvLv
API String ID: 3782394904-1162934395
Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Function 00459C5C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459DDE,?,00000000,00000000,00000000,?,00000006,?,00000000,004973CD,?,00000000,00497470), ref: 00459D22

Part of subcall function 004543F4: FindClose.KERNEL32(000000FF,004544EA), ref: 004544D9

Strings

Failed to strip read-only attribute., xrefs: 00459CF0
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459CFC
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459D97
Stripped read-only attribute., xrefs: 00459CE4
Failed to delete directory (%d)., xrefs: 00459DB8
Deleting directory: %s, xrefs: 00459CAB
Failed to delete directory (%d). Will retry later., xrefs: 00459D3B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 8aabd4c25723369bf9534759df9b588e5f8490088031ca791ae669e8a2666fca
Instruction ID: 5a692d040748e25b342bfc59b5c440c53b4552d2faa6a9747d6521fe41ba2a01
Opcode Fuzzy Hash: 8aabd4c25723369bf9534759df9b588e5f8490088031ca791ae669e8a2666fca
Instruction Fuzzy Hash: 69419330A04248DACB10DB6A98417AE76B59F8530AF54857BAC05E7383DB7C8D0DC75D

Function 00422E50 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422EA4
GetCapture.USER32 ref: 00422EB3
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB9
ReleaseCapture.USER32 ref: 00422EBE
GetActiveWindow.USER32 ref: 00422ECD
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F4C
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FB0
GetActiveWindow.USER32 ref: 00422FBF

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
Instruction ID: c6261992695b47722d84ffa44129b55dc5b2a4dad2f70b0012283783c1c7b094
Opcode Fuzzy Hash: 3da4ec300de865232a3f60c9f80223c2bbe2427c246ff190c68097af5e341dae
Instruction Fuzzy Hash: 24417230B00245AFDB10EB69DA86B9E77F1EF44304F5540BAF404AB2A2D778AE40DB49

Function 0042F290 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2BA
GetWindowLongA.USER32(?,000000EC), ref: 0042F2D1
GetActiveWindow.USER32 ref: 0042F2DA
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F307
SetActiveWindow.USER32(?,0042F437,00000000,?), ref: 0042F328

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
Instruction ID: ac844ef734d24c76dc9aa96f201b13a865b129e9c1b137beabd8cb6517960092
Opcode Fuzzy Hash: ca0cfe640851e4463c520fee9942c9233ac98ecb3d765a436798e71af7845e74
Instruction Fuzzy Hash: F931D271A00254AFEB01EFA5DD52E6EBBB8EB09304F9144BAF804E3291D73C9D10CB58

Function 00429480 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042948A
GetTextMetricsA.GDI32(00000000), ref: 00429493

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(00000000,00000000), ref: 004294A2
GetTextMetricsA.GDI32(00000000,?), ref: 004294AF
SelectObject.GDI32(00000000,00000000), ref: 004294B6
ReleaseDC.USER32(00000000,00000000), ref: 004294BE
GetSystemMetrics.USER32(00000006), ref: 004294E3
GetSystemMetrics.USER32(00000006), ref: 004294FD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$CreateFontIndirectRelease
String ID:
API String ID: 1583807278-0
Opcode ID: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
Instruction ID: 8a5b62ad3b2811282b00f4aa11bc4c2c065e9b9ae855548013837f5c18493421
Opcode Fuzzy Hash: 62880ac9d08e5d684fd074e0f3ca61438eede96ade4d4e291019075c7fd144c0
Instruction Fuzzy Hash: 0F01C4A17087103BE321767A9CC6F6F65C8DB44358F84043BF686D63D3D96C9C41866A

Function 0041DE24 Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0041DE27
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0041DE31
ReleaseDC.USER32(00000000,00000000), ref: 0041DE3E
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE4D
GetStockObject.GDI32(00000007), ref: 0041DE5B
GetStockObject.GDI32(00000005), ref: 0041DE67
GetStockObject.GDI32(0000000D), ref: 0041DE73
LoadIconA.USER32(00000000,00007F00), ref: 0041DE84

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ObjectStock$CapsDeviceIconLoadRelease
String ID:
API String ID: 225703358-0
Opcode ID: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction ID: 282f56568f1177e4dad385ec7f61a974d29090d827cf1f87eb40c920fa9ca7e8
Opcode Fuzzy Hash: 93123cf7b7da28845296a778695a34f9ae7968dfa7e72d2685fd09fde09bf652
Instruction Fuzzy Hash: 4C1142706457015EE340BFA66E52B6A36A4D725708F40413FF609AF3D1D77A2C448B9E

Function 004630B4 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 004631B8
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046324D), ref: 004631BE
SetCursor.USER32(?,00463235,00007F02,00000000,0046324D), ref: 00463228

Strings

, xrefs: 00463433
, xrefs: 0046344E
Internal error: Item already expanding, xrefs: 00463155

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
Instruction ID: 06b17efc2869e1117ca0a97e11558f018c2dd138a4dd01a316207194f11c04f7
Opcode Fuzzy Hash: 9a907484170bb085a46c4a598b93bfbbd2bc194262705c34c2f461fc244cfbd4
Instruction Fuzzy Hash: 74B1B430A00284DFD711DF69C585B9EBBF0BF04305F1484AAE8459B792DB78EE45CB16

Function 00453D30 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453E17

Strings

WININIT.INI, xrefs: 00453DC5
.tmp, xrefs: 00453DD3
MoveFileEx, xrefs: 00454027
[rename], xrefs: 00453E7A, 00453EB6
NUL, xrefs: 00453ED9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
Instruction ID: 4c4b1d7f09994941c57eaafc4db68242d6a3f6c21ecd3f2b5b8f846a746055a2
Opcode Fuzzy Hash: 4acafb8f8444067680350d3d4e03481623aa06ca7574397e5033f2f4cf45a0b5
Instruction Fuzzy Hash: 40911434E002099BDB01EFA5D842BDEB7F5AF4874AF608466E90077392D7786E49CB58

Function 00476770 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 004767C9
SetWindowLongW.USER32(00000000,000000FC,00476724), ref: 004767F0
GetACP.KERNEL32(00000000,00476A08,?,00000000,00476A32), ref: 0047682D
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00476873

Strings

COMBOBOX, xrefs: 004767C2
Inno Setup: Language, xrefs: 004768FB

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ClassInfoLongMessageSendWindow
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3391662889-4234151509
Opcode ID: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
Instruction ID: bb27e68bfa0a4e6e36c1c9b1f46c00cfa2f47713d75b81585866a7fa3ef15c14
Opcode Fuzzy Hash: 7b097581a500be05759954e33284123b2b89370f46c26a428eff7c4db0c5a69c
Instruction Fuzzy Hash: C0813F746006059FC710EF69D885AEAB7F2FB09304F16C1BAE848E7362D738AD45CB59

Function 00408720 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408968,?,?,?,?,00000000,00000000,00000000,?,0040996F,00000000,00409982), ref: 0040873A

Part of subcall function 00408568: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408633,?,00000000,00408712), ref: 00408586

Part of subcall function 004085B4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087B6,?,?,?,00000000,00408968), ref: 004085C7

Strings

:mm, xrefs: 0040891C
mmmm d, yyyy, xrefs: 0040882B
:mm:ss, xrefs: 00408936
m/d/yy, xrefs: 00408809
AMPM, xrefs: 00408905

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction ID: 5c6fde8006682913ecab3173e7335377554a92ac61a87523d81808753b4ec1a9
Opcode Fuzzy Hash: 99a58aab46255149f4b24f4520dbd6929c7443738739b227c4cc8c7d24f61a81
Instruction Fuzzy Hash: 7D516C24B00108ABDB01FBA69E4169EB7A9DB94308F50C07FA181BB3C3CE3DDA05975D

Function 004116F4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F9), ref: 0041178C
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 0041184A

Part of subcall function 00411AAC: CreatePopupMenu.USER32 ref: 00411AC6

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118D6

Part of subcall function 00411AAC: CreateMenu.USER32 ref: 00411AD0

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118BD

Strings

,, xrefs: 0041179F
?, xrefs: 004117A6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
Instruction ID: ecf66c9774bccec907b621c371347452b74b7622051e058d8a4a73451c3e974f
Opcode Fuzzy Hash: b9a2b6ccc88d9caa62c3975205c07352f987ccdbf84bf9e0cd5a88eec52abf91
Instruction Fuzzy Hash: D7510674A00245ABDB10EF6ADC816EA7BF9AF09304B11857BF904E73A6D738DD41CB58

Function 0041BE63 Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF28
GetObjectA.GDI32(?,00000018,?), ref: 0041BF37
GetBitmapBits.GDI32(?,?,?), ref: 0041BF88
GetBitmapBits.GDI32(?,?,?), ref: 0041BF96
DeleteObject.GDI32(?), ref: 0041BF9F
DeleteObject.GDI32(?), ref: 0041BFA8
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFC5

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction ID: 74cae3b7aa7aab4ce12a2fbd062d204c5c4082198076ec6df892ad84fd278e80
Opcode Fuzzy Hash: dabea464bc85c36b4411cc83672e19ff5768c85fc4c65aec36842f1966395034
Instruction Fuzzy Hash: 6A510671A002199FCB10DFA9C9819EEB7F9EF48314B11416AF914E7395D738AD41CB68

Function 0041CED8 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEFE
GetDeviceCaps.GDI32(00000000,00000026), ref: 0041CF1D
SelectPalette.GDI32(?,?,00000001), ref: 0041CF83
RealizePalette.GDI32(?), ref: 0041CF92
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFFC
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D03A
SelectPalette.GDI32(?,?,00000001), ref: 0041D05F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: PaletteStretch$Select$BitsCapsDeviceModeRealize
String ID:
API String ID: 2222416421-0
Opcode ID: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
Instruction ID: 4b814cf558339e083a7fb5ccd56fb4ffad9fd0a27a4bfdacf16c2dd2476febac
Opcode Fuzzy Hash: c6a16a19dcf28552bada6898b81586dc49cb1edacb7efb66bca37046f5d7e7da
Instruction Fuzzy Hash: D2515EB0604200AFDB14DFA8C985F9BBBE9EF08304F10459AB549DB292C778ED81CB58

Function 00457128 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045717A

Part of subcall function 0042427C: GetWindowTextA.USER32(?,?,00000100), ref: 0042429C

Part of subcall function 0041EEA4: GetCurrentThreadId.KERNEL32 ref: 0041EEF3
Part of subcall function 0041EEA4: EnumThreadWindows.USER32(00000000,0041EE54,00000000), ref: 0041EEF9

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004571E1
TranslateMessage.USER32(?), ref: 004571FF
DispatchMessageA.USER32(?), ref: 00457208

Strings

[Paused] , xrefs: 004571B0

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Message$TextThreadWindow$CurrentDispatchEnumSendTranslateWindows
String ID: [Paused]
API String ID: 1007367021-4230553315
Opcode ID: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
Instruction ID: 9c65c5789669556775cb04b7d8b700a3e8427f17a0623b42c67a15115a154b53
Opcode Fuzzy Hash: fd37f0685e9949bc630816f418b91ae10989fde9f4c26f7dfdebc9041f05c988
Instruction Fuzzy Hash: 3A3196309082449EDB11DFB5EC81FDEBBB8EB49314F5580B7F800E7292D6389909CB69

Function 0046B294 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B3D3), ref: 0046B350
LoadCursorA.USER32(00000000,00007F02), ref: 0046B35E
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B364
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B36E
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B3D3), ref: 0046B374

Strings

CheckPassword, xrefs: 0046B2F8

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
Instruction ID: 12e539274ef1f9e2a04eba0c68275a436143f563f239c7c10787bf1112b5c925
Opcode Fuzzy Hash: 9ec6fbb627a2037d8b10d3b03f13e16da416f17f6db7f06dbaba65bff406c05b
Instruction Fuzzy Hash: 883140347402449FD711DB69C899B9A7BE4EB05304F5580B6BC44DB392D7789E80CB99

Function 004595D4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045968F

Strings

CreateAssemblyCache, xrefs: 00459686
.NET Framework CreateAssemblyCache function failed, xrefs: 004596B2
Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045969A
Failed to load .NET Framework DLL "%s", xrefs: 00459674
Fusion.dll, xrefs: 0045962F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
Instruction ID: 16de9e68b372fd706bfdce8394bce33e03e331de8444419fbf47e642e04e3cf3
Opcode Fuzzy Hash: c76a925808990de0a4edfa3a9bd9e2f18b95e6c6c4d3f27ecf656a26428a2687
Instruction Fuzzy Hash: E1318B71E10605EBCB01EFA9C88159EB7B4EF44315F50857BE814E7382DB389E08C799

Function 0041C148 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C048: GetObjectA.GDI32(?,00000018), ref: 0041C055

GetFocus.USER32 ref: 0041C168
GetDC.USER32(?), ref: 0041C174
SelectPalette.GDI32(?,?,00000000), ref: 0041C195
RealizePalette.GDI32(?), ref: 0041C1A1
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B8
SelectPalette.GDI32(?,00000000,00000000), ref: 0041C1E0
ReleaseDC.USER32(?,?), ref: 0041C1ED

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Palette$Select$BitsFocusObjectRealizeRelease
String ID:
API String ID: 3303097818-0
Opcode ID: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction ID: 25a0b6576c779426e59073023ceed4ef49f3845c1b310514cd4f08ef327de147
Opcode Fuzzy Hash: 26117fda3ddcda01a6cc84f42a4f6ec069d0e010bd6cdd98afb854c6c7779a8d
Instruction Fuzzy Hash: 49116D71A44604BFDF10DBE9CC81FAFB7FCEB48700F50486AB518E7281DA7899008B28

Function 00418C54 Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C70
GetSystemMetrics.USER32(0000000D), ref: 00418C78
6F522980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C7E

Part of subcall function 004107F8: 6F51C400.COMCTL32(0049B628,000000FF,00000000,00418CAC,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004107FC

6F58CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CCE
6F58C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD9
6F58CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000), ref: 00418CEC
6F520860.COMCTL32(0049B628,00418D0F,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D08,?,00000000,0000000D,00000000,0000000E), ref: 00418D02

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MetricsSystem$C400C740F520860F522980
String ID:
API String ID: 2856677924-0
Opcode ID: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction ID: f48c8f8e6a400555c090207229051c9eae11b8a9b20c4da93df477ea8fa1a9e8
Opcode Fuzzy Hash: e2c7fe5230f8d2f143d47c0d6a7892a097693e1c100db4317caf46c6149257f7
Instruction Fuzzy Hash: 6B112475744204BBDB50EBA9EC82FAD73F8DB08704F504066B514EB2C1DAB9AD808759

Function 00483750 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00483808), ref: 004837ED

Strings

ProductType, xrefs: 0048378C
System\CurrentControlSet\Control\ProductOptions, xrefs: 00483774
LanmanNT, xrefs: 004837B7
ServerNT, xrefs: 004837D1
WinNT, xrefs: 0048379D

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
Instruction ID: c613687e0df8eb2305741995cd8b82d1e16d8def3fb188134640bd78fd3b844b
Opcode Fuzzy Hash: 6cffb51fcf675e5b5ff337e99a1a510b156e53e1e1d602fe7582bc6a3ac7d990
Instruction Fuzzy Hash: 7711AFB0B00204AAD700FBA68C12A5EBAE8DB55B09F208877A800E7681E73CDB01875C

Function 0041B462 Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B470
SelectObject.GDI32(?,00000000), ref: 0041B47F
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4AB
SelectObject.GDI32(00000000,00000000), ref: 0041B4B9
SelectObject.GDI32(?,00000000), ref: 0041B4C7
DeleteDC.GDI32(00000000), ref: 0041B4D0
DeleteDC.GDI32(?), ref: 0041B4D9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction ID: 052e9154069abc57648b404522aaf552eddfcc6d95cd3388d63b7ef9ce004286
Opcode Fuzzy Hash: 8542cbb8adbe0fd8af4a730cfe3faeef428ae57c020086fb9cb954466ea4b08d
Instruction Fuzzy Hash: 7B115C72E40619ABDB10DAD9DC86FEFB7BCEF08704F144555B614F7282C678AC418BA8

Function 00423394 Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233AF
WindowFromPoint.USER32(?,?), ref: 004233BC
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233CA
GetCurrentThreadId.KERNEL32 ref: 004233D1
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233EA
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 00423401
SetCursor.USER32(00000000), ref: 00423413

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction ID: 22bb490dc700fc35bbf8fe9eba0271ced42fa0644d0760cf779c582944844a3d
Opcode Fuzzy Hash: 134875e674979cd567c136abb418dc525a6250aa5b529fa10794d0eebf3240cc
Instruction Fuzzy Hash: BA01D4223046103AD6217B755D82E2F26E8DB85B15F50407FF504BB283DA3D9D11937D

Function 00494E9C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00494EAC
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00494EB9
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00494EC6

Strings

MonitorFromRect, xrefs: 00494EB3
user32.dll, xrefs: 00494EA7
GetMonitorInfoA, xrefs: 00494EC0

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
Instruction ID: 92166a125eb2f71293346f1714c1de0d588af794120117df170beecaff70c54b
Opcode Fuzzy Hash: 86a2ddc52e299a4ebb71bf23d73df01b3b4fd34307be7bd5855d98afd1a17bd4
Instruction Fuzzy Hash: 5FF0F65278171627DE1026668C41F7F6ACCDBD5761F050137BE05AB3C2E99C8C0242FD

Function 0045D4D8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D4E1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D4F1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D501

Strings

BZ2_bzDecompressEnd, xrefs: 0045D4FB
BZ2_bzDecompressInit, xrefs: 0045D4DB
BZ2_bzDecompress, xrefs: 0045D4EB

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
Instruction ID: f545bb075b74a91891c18b47f2e11744e93a99b0212facb5d31f4bd58d546edf
Opcode Fuzzy Hash: 0cec18ecd77b334d9913731d687bcbf118ffb91831bb9c9ad7683d7253c977df
Instruction Fuzzy Hash: 6EF0D0B0D01704EAE724DFB6ACC77363A959BA431AF14943B9A0D96263E678044DCF2D

Function 0042EA1C Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,00480DAC), ref: 0042EA35
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA3B
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA4C

Part of subcall function 0042E9AC: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
Part of subcall function 0042E9AC: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
Part of subcall function 0042E9AC: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA60

Strings

ChangeWindowMessageFilterEx, xrefs: 0042EA2B
user32.dll, xrefs: 0042EA30

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction ID: 20967f7a279d57b19857f2ad39d34e10c6be6de8430a8d3efc5b40b14e24a4c3
Opcode Fuzzy Hash: 2e6935975283b392abf6eb535232e6e33c7297ce4864da2c850d0b2669d54df9
Instruction Fuzzy Hash: 99E092A1741B20EAEA10B7B67C86FAA2658EB1076DF500037F100A51F1C3BD1C80CE9E

Function 0044C7DC Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F089), ref: 0044C7EB
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7FC
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C80C

Strings

CreateStdAccessibleObject, xrefs: 0044C806
oleacc.dll, xrefs: 0044C7E6
LresultFromObject, xrefs: 0044C7F6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction ID: d6497c9818d993b67a5702c7731996643d684f189bbd4b702b1f6e54e13363b7
Opcode Fuzzy Hash: 580db4225bb49e0f2395934ae602c4dd6ca827d8c76c18c7318a842ee4a54372
Instruction Fuzzy Hash: 50F0DA70282305CAE750BBB5FDD57263694E3A470AF18277BE841551A2C7B94844CB8C

Function 00478740 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498794), ref: 00478746
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 00478753
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 00478763

Strings

VerSetConditionMask, xrefs: 0047874D
VerifyVersionInfoW, xrefs: 0047875D
kernel32.dll, xrefs: 00478741

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
Instruction ID: d9a2c3c187cd73cba94933972f30ec689a131e62bb2a59a557d4d9670201d7da
Opcode Fuzzy Hash: c231c6f2b70c156a9a87dd751a131f3597001cd76c60e66cfe2a3d12b45a0e7a
Instruction Fuzzy Hash: 79C0C9F02C0700EA9604B7F11CCBA7A2548C500729330803FB19EA6182D97C0C104A6C

Function 0041B66C Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B745
GetDC.USER32(?), ref: 0041B751
SelectPalette.GDI32(00000000,?,00000000), ref: 0041B786
RealizePalette.GDI32(00000000), ref: 0041B792
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041B7C0
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041B7F4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction ID: 38bdddf8d72f5571b31e8017bfcff87152bbfcb95d4f6cd7f9962c0a723fddb9
Opcode Fuzzy Hash: 9b17a45ebd00e155e5aeae17ac6cac102e8e00fd56b9a0d3692e3d2bf0971335
Instruction Fuzzy Hash: 8A512F70A002099FDF11DFA9C881AEEBBF9FF49704F104066F504A7791D7799981CBA9

Function 0041B93C Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA17
GetDC.USER32(?), ref: 0041BA23
SelectPalette.GDI32(00000000,?,00000000), ref: 0041BA5D
RealizePalette.GDI32(00000000), ref: 0041BA69
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BA8D
SelectPalette.GDI32(00000000,00000000,00000000), ref: 0041BAC1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Palette$Select$BitmapCreateFocusRealize
String ID:
API String ID: 3275473261-0
Opcode ID: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction ID: 3fcaffe560058c7771eaec6053d79e0e1924f360d52694d27862de55114c0f48
Opcode Fuzzy Hash: f1b656a7ede54f8d65f93cc35dc493626dae048aef23b352968a277fb398f08e
Instruction Fuzzy Hash: 9D512A74A002189FDB11DFA9C891AAEBBF9FF49700F154066F904EB751D738AD40CBA4

Function 0041B508 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B57E
GetDC.USER32(?), ref: 0041B58A
GetDeviceCaps.GDI32(?,00000068), ref: 0041B5A6
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5C3
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 0041B5DA
ReleaseDC.USER32(?,?), ref: 0041B626

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceFocusRelease
String ID:
API String ID: 2502006586-0
Opcode ID: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction ID: 1753bd22f5710d4f749a3cf2d8329d0f84e6490acb09e3fae29671003709e3a5
Opcode Fuzzy Hash: e956e6ae92597662ed98b2f51c6b506043ab8b509e5ceb21f610fa5f8f95298e
Instruction Fuzzy Hash: D0410631A04258AFDF10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D51CBA5

Function 0045CE9C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045CFD4,?,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF46

Strings

CURRENT_USER, xrefs: 0045CEDB
MACHINE, xrefs: 0045CEEA
USERS, xrefs: 0045CEF9
CLASSES_ROOT, xrefs: 0045CECC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
Instruction ID: 452c5d812052531473411f8275c40b5c85b18bf76fc7955a310c39f58cd58d14
Opcode Fuzzy Hash: 1bdeb0a210bc513e3c49bf4cbd891cc1911c01b4b436513822a1df069e086b30
Instruction Fuzzy Hash: 3811A536204304AFD711DAA1C9C2A9EB69EDB44706F604037AD00A62C7D67C5F0AD52D

Function 0041BD8C Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDD5
GetSystemMetrics.USER32(0000000C), ref: 0041BDDF
GetDC.USER32(00000000), ref: 0041BDE9
GetDeviceCaps.GDI32(00000000,0000000E), ref: 0041BE10
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0041BE1D
ReleaseDC.USER32(00000000,00000000), ref: 0041BE56

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction ID: d5b995c8e3894394b735eabd433659eae54025482fea58e306a85006fdca5b97
Opcode Fuzzy Hash: 3bdc6123dd6674b0137b7fef1a93c0b96d54f33e4692062cf67464f69f8f60e7
Instruction Fuzzy Hash: E5212A74E04648AFEB00EFA9C941BEEB7B4EB48714F10846AF514B7690D7785940CB69

Function 0047E23C Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047E24A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CBBD), ref: 0047E270
GetWindowLongA.USER32(?,000000EC), ref: 0047E280
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047E2A1
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047E2B5
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047E2D1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
Instruction ID: c2beb8629b08809d81cb9269d2d7eee694fde7899d985d279cae8c77c91b058d
Opcode Fuzzy Hash: b4e19ff4e98ab52ecda950bfdcb646100cf30b97dd598c6192f2cb622b5c4e11
Instruction Fuzzy Hash: A40140B1641210ABE610D769DE41F2237DCAB0C360F0907A6BA44EF3E3C728E8408B49

Function 0041B270 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6E0: CreateBrushIndirect.GDI32 ref: 0041A74B

UnrealizeObject.GDI32(00000000), ref: 0041B27C
SelectObject.GDI32(?,00000000), ref: 0041B28E
SetBkColor.GDI32(?,00000000), ref: 0041B2B1
SetBkMode.GDI32(?,00000002), ref: 0041B2BC
SetBkColor.GDI32(?,00000000), ref: 0041B2D7
SetBkMode.GDI32(?,00000001), ref: 0041B2E2

Part of subcall function 0041A058: GetSysColor.USER32(?), ref: 0041A062

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction ID: d03b18a2b949c207061bd18b8e5d47ed8ce294e6be165222704fda36eef26a4f
Opcode Fuzzy Hash: 90af7722afa79acc590a6ee3060039fb524340e2cf7ce152cccbdcb584e8dbde
Instruction Fuzzy Hash: 56F0CD756015009BDE00FFAAD9CBE4B3B989F043097048496B908DF187CA3CD8649B3A

Function 004978CC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

ShowWindow.USER32(?,00000005,00000000,00497B31,?,?,00000000), ref: 00497902

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Part of subcall function 004072A8: SetCurrentDirectoryA.KERNEL32(00000000,?,0049792A,00000000,00497AFD,?,?,00000005,00000000,00497B31,?,?,00000000), ref: 004072B3

Part of subcall function 0042D44C: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4DA,?,?,?,00000001,?,0045607E,00000000,004560E6), ref: 0042D481

Strings

Uninstall, xrefs: 004978E8
.dat, xrefs: 00497949
.msg, xrefs: 00497968
IMsg, xrefs: 004979D6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
Instruction ID: 79fbc7277211ce2bf855d188aeb365c1f4e20c687b9dac3c04c4e1571c34c8ae
Opcode Fuzzy Hash: 7512cdbd572c9146c7922e267a2e3ec6043e3c2241cd3ad81f3df178027fada8
Instruction Fuzzy Hash: 44315E34A10214AFDB01EB65DC92D5E7B75FB89718B91847AF400AB392DB38BD018B58

Function 0042EAA8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EADA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAE0
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB09

Strings

ShutdownBlockReasonCreate, xrefs: 0042EAD0
user32.dll, xrefs: 0042EAD5

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
Instruction ID: 7e091cf0cf0c4dae12ae48626bdfb721f4796128e550bb25d34418d77cfbcdd5
Opcode Fuzzy Hash: dc376cfddf31d7f2fdf241a02509d8c694355095d88693d0378826b1ee5e642a
Instruction Fuzzy Hash: 70F0C8D034061136E620B57F5C82F7B598C8F94759F140436B109E62C2D96CA905426E

Function 00457E48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00457E78
GetExitCodeProcess.KERNEL32(?,?), ref: 00457E99
CloseHandle.KERNEL32(?,00457ECC), ref: 00457EBF

Strings

MsgWaitForMultipleObjects, xrefs: 00457E85
GetExitCodeProcess, xrefs: 00457EA2

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
Instruction ID: b72ead612c96ea1451a2df619a1119c508d9f8e19ef45bb7a80fe0c677849c01
Opcode Fuzzy Hash: 1ea0d3176aedc3e092b8d1903486a3d6a13cecd7bb31937a8215cd8aa9781b6e
Instruction Fuzzy Hash: DA01A235608304AFD711EBA9AC06A1A73A8EB49715F2040B6FC10E73D3D6389E04861D

Function 0042E9AC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA70,00000004,00499934,0045703D,004573E0,00456F94,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9C2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C8
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D9

Strings

user32.dll, xrefs: 0042E9BD
ChangeWindowMessageFilter, xrefs: 0042E9B8

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction ID: c922fa4e85abb1c6873f36dcd01b6443d81c66d6c3501223796626af46e79b09
Opcode Fuzzy Hash: 3254194633b527647525dea76c004eb0f33bc99a9c522dc813bf1be520244ffe
Instruction Fuzzy Hash: 5CE0ECB2740324EADA103B627E8AF663558E724B19F50043BF001751F1C7FD1C80CA9E

Function 004776B4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 004776BC
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,004777B3,0049C0A4,00000000), ref: 004776CF
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004776D5

Strings

user32.dll, xrefs: 004776CA
AllowSetForegroundWindow, xrefs: 004776C5

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
Instruction ID: ee14923c72d036b6004e6d5d181e2ae3dde99fc96f584ef82141a9a0fe8b283c
Opcode Fuzzy Hash: 79b78db4dd9cdf85c2be20cd47b0727ffde78e70408e3af60258cd37bb1d66b3
Instruction Fuzzy Hash: 99D0C7D0249B02AAD910B3F94D47FAF365CA954768794C47B7404E218DDABCDC00D93D

Function 00416C2C Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C52
SaveDC.GDI32(?), ref: 00416C83
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D45), ref: 00416CE4
RestoreDC.GDI32(?,?), ref: 00416D0B
EndPaint.USER32(00000000,?,00416D4C,00000000,00416D45), ref: 00416D3F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction ID: 8164e3b37c2b38cc39b91ef4074089abf19b8963c3e0e5cbd12a4ce3d65b1abe
Opcode Fuzzy Hash: ad781fe6fb59047a66b80eb53a3f65b2019eba16d1c733f202b60e39d660354f
Instruction Fuzzy Hash: A1415070A002049FCB14DBA9C585FAA77F9FF48304F1540AEE8459B362D778DD81CB58

Function 00414800 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 00414836
MulDiv.KERNEL32(?,?,?), ref: 00414850
MulDiv.KERNEL32(?,?,?), ref: 00414879
MulDiv.KERNEL32(?,?,?), ref: 004148A4
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148EC

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction ID: a833d86c80f2fb81cba799e3b93fc1891ddf3ebdd98a67124a25423b7ab76754
Opcode Fuzzy Hash: b6913cb722474124f75cff2ee5949f067bbdde1b56a592e148b6496e85af3d5a
Instruction Fuzzy Hash: 563132746057809FC320EF69C984B9BB7E8AF89354F04491EF9D5C3752C638E8818F19

Function 004297CC Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429808
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429837
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 00429853
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 0042987E
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 0042989C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction ID: 8b65b0e689063cc909dba6714575951256d1ad54ff8cece17fd29570ea6901c2
Opcode Fuzzy Hash: 399f588db94bb8b810bf5b46e1237ea7bfd7cbebe0e15a3dbf36720fb68daebb
Instruction Fuzzy Hash: 6E219D707107057BEB10AB62DC82F5B7AECAB41708F54443EB501AB2D2DFB8AE418228

Function 0041BBB8 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBCA
GetSystemMetrics.USER32(0000000C), ref: 0041BBD4
GetDC.USER32(00000000), ref: 0041BC12
CreateDIBitmap.GDI32(00000000,?,00000004,?,?,00000000), ref: 0041BC59
DeleteObject.GDI32(00000000), ref: 0041BC9A

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MetricsSystem$BitmapCreateDeleteObject
String ID:
API String ID: 1095203571-0
Opcode ID: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction ID: 2a907a32995036c4e239f44386a828d3a2f1e7d44945ead90e55d18394f4d4ff
Opcode Fuzzy Hash: d6ecec59309c4539c21f746b1d4641e0a999657a412e1d938322a226e3514674
Instruction Fuzzy Hash: 5D315C70E00208EFDB04DFA5C941AAEB7F5EB48700F2084AAF514AB781D7789E40DB98

Function 0047344C Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045CE9C: SetLastError.KERNEL32(00000057,00000000,0045CF68,?,?,?,?,00000000), ref: 0045CF07

GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734D9
GetLastError.KERNEL32(00000000,00000000,00000000,00473520,?,?,0049C1DC,00000000), ref: 004734EF

Strings

Failed to set permissions on registry key (%d)., xrefs: 00473500
Could not set permissions on the registry key because it currently does not exist., xrefs: 004734E3
Setting permissions on registry key: %s\%s, xrefs: 0047349E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: 6a97e4f81041aadbe163303a7d14e2778330a35fec2615f3944f9ca16867819a
Instruction ID: f6b37ec0c80c1520313a246a851a493010c524415d82476cd93cad017a8f966b
Opcode Fuzzy Hash: 6a97e4f81041aadbe163303a7d14e2778330a35fec2615f3944f9ca16867819a
Instruction Fuzzy Hash: 76218670A042445FCB10DFA9C8826EEBBE4DF49315F50817BE508E7392D7785E05876D

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: dcd45591e65b03bd276bb2a5b0fabad56ebf76f0c081827c2345b0a7b763a240
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 004143E0 Relevance: 7.6, APIs: 5, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(00000000,00000000,00000000), ref: 00414419
RealizePalette.GDI32(00000000), ref: 00414421
SelectPalette.GDI32(00000000,00000000,00000001), ref: 00414435
RealizePalette.GDI32(00000000), ref: 0041443B
ReleaseDC.USER32(00000000,00000000), ref: 00414446

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Palette$RealizeSelect$Release
String ID:
API String ID: 2261976640-0
Opcode ID: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction ID: 3cc421e061c7a323c9855e33cbe13bf4890882f9e8533d15179bd5f7679f66d2
Opcode Fuzzy Hash: c9c8aa66f6917016d7555c0ac5b3df2d15848593dde74026b2272496f15e705b
Instruction Fuzzy Hash: A2018F7520C3806AE600A63D8C85A9F6BED9FCA718F15446EF495DB282DA7AC8018765

Function 00424CE0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F074: GetActiveWindow.USER32 ref: 0041F077
Part of subcall function 0041F074: GetCurrentThreadId.KERNEL32 ref: 0041F08C
Part of subcall function 0041F074: EnumThreadWindows.USER32(00000000,Function_0001F050), ref: 0041F092

Part of subcall function 004231A8: GetSystemMetrics.USER32(00000000), ref: 004231AA

OffsetRect.USER32(?,?,?), ref: 00424DC9
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E8C
OffsetRect.USER32(?,?,?), ref: 00424E9D

Part of subcall function 00423564: GetCurrentThreadId.KERNEL32 ref: 00423579
Part of subcall function 00423564: SetWindowsHookExA.USER32(00000003,00423520,00000000,00000000), ref: 00423589
Part of subcall function 00423564: CreateThread.KERNEL32(00000000,000003E8,004234D0,00000000,00000000), ref: 004235AD

Part of subcall function 00424B2C: SetTimer.USER32(00000000,00000001,?,004234B4), ref: 00424B47

Strings

vLB, xrefs: 00424CF3, 00424DD1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Thread$CurrentOffsetRectWindows$ActiveCreateDrawEnumHookMetricsSystemTextTimerWindow
String ID: vLB
API String ID: 1477829881-1797516613
Opcode ID: 9987255b0b6c78362164308449554d51e9442941db4b17a29f095a444d8f0f61
Instruction ID: 1a85cd152e58b5c2614c87f396891e2b5808bef0cf689969089b0637ec596c27
Opcode Fuzzy Hash: 9987255b0b6c78362164308449554d51e9442941db4b17a29f095a444d8f0f61
Instruction Fuzzy Hash: C5812675A003188FCB14DFA8D880ADEBBF4FF88314F50416AE905AB296E738AD45CF44

Function 00406FA4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00407003
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040707D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070D5

Strings

Z, xrefs: 0040703C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction ID: 78f4b6eea80f90a9c0d6dbacb1000d6f5057f9b0a0312f2c839bfa0eabc808a5
Opcode Fuzzy Hash: a9e747af3270ad6827a26b5e12e82ea9da9777e5f51a79d453bfa0d7b97e4fbe
Instruction Fuzzy Hash: 14516470E04208AFDB11DF95C951AAFBBB9EF09304F1045BAE500BB3D1D778AE458B5A

Function 0044CFC0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D04E
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D079
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D101

Strings

, xrefs: 0044D033

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
Instruction ID: ac611c4ae9e9b4e435f74cd3b872a097dcdbbef8ea8fa2dc8c743a2ef399c877
Opcode Fuzzy Hash: 3cb455d8176bf3e5231f8dda4285d64bdc155d7a8260b5a0e5f680fe50550aac
Instruction Fuzzy Hash: 18517171E00248AFDB11DFA5C885BDEBBF8BF48308F18447AE845EB252D7789945CB64

Function 0042EF74 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0042EF9E

Part of subcall function 0041A1E8: CreateFontIndirectA.GDI32(?), ref: 0041A2A7

SelectObject.GDI32(?,00000000), ref: 0042EFC1
ReleaseDC.USER32(00000000,?), ref: 0042F0A0

Strings

...\, xrefs: 0042F052

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CreateFontIndirectObjectReleaseSelect
String ID: ...\
API String ID: 3133960002-983595016
Opcode ID: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
Instruction ID: de545d42c11d103cbad381cc3223c2b5efa9fdb4a6e9ae4bb0445229962d8c70
Opcode Fuzzy Hash: 65766ae35a5ff9b042dd79c87bacb89811e544568082cefb05445997e7e8f61e
Instruction Fuzzy Hash: 5A316370B00128AFDB11EB96D841BAEB7F8EB09348F90447BE410A7392D7785E49CA59

Function 004538BC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539AB
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,00496991,_iu,?,00000000,004539F6), ref: 004539BB

Strings

.tmp, xrefs: 0045395F
_iu, xrefs: 0045394D

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
Instruction ID: c819285d1904897ee35e15112b57b1097950df4cd651dd5525fdc5768647a91e
Opcode Fuzzy Hash: 1bf85a80132bbff87a9a827a47fd0c4a75e2f830b03f5f12b130a42208c1e1fd
Instruction Fuzzy Hash: 6531C5B0A00249ABCB11EFA5D842B9EBBB4AF44345F20453AF810B73C2D7785F058B69

Function 00416410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 0041647F
UnregisterClassA.USER32(?,00400000), ref: 004164AB
RegisterClassA.USER32(?), ref: 004164CE

Strings

@, xrefs: 00416429

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 32c7bff64fe8078beb5c73cee1a3f36bf3645a98757bc26b4be27a2261280048
Instruction ID: c77080f262680b7bd3c4c6a37e0a11d074b1995aa9dd52ebf92fb76dd285a693
Opcode Fuzzy Hash: 32c7bff64fe8078beb5c73cee1a3f36bf3645a98757bc26b4be27a2261280048
Instruction Fuzzy Hash: B8316D702042409BD720EF69C981B9B77E5AB89308F04457FF949DB392DB39DD44CB6A

Function 00497D80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497DF0
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,004986D0,00000000,00497E76,?,?,00000000,0049B628), ref: 00497E19
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 00497E32

Strings

isRS-%.3u.tmp, xrefs: 00497DCF

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: c8ffd91a69648c323ebec4846a0c95b9f63ed5ce66c8394ab64ce5c1dd8b2d9f
Instruction ID: d3b1e0af9bc01606b4acbc4251c5ccfb03fd27bd09466a3f7c53cc9bc4e4fae9
Opcode Fuzzy Hash: c8ffd91a69648c323ebec4846a0c95b9f63ed5ce66c8394ab64ce5c1dd8b2d9f
Instruction Fuzzy Hash: F5214F71E14219AFCF11EFA9C881AAFBBB8EF44714F10457BB814B72D1D6389E018B59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Function 00456A48 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C804: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C828

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456A9C
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456AC9

Strings

LoadTypeLib, xrefs: 00456AA7
RegisterTypeLib, xrefs: 00456AD4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
Instruction ID: f320f84dc8d434ac547319b1f88b10c46afed2bb2b034f8a1d5164c41c1038b2
Opcode Fuzzy Hash: c06c5e8b46d4cc008794e6ef7648282b6775267df5f2c1a0af32ed40ef5fa1a3
Instruction Fuzzy Hash: CE118430B00604AFDB11DFA6CD55A5AB7BDEB89705F518476FD04D3652DA389E04CA14

Function 00456FA0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00456FBA
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 00457057

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00456FE6
Failed to create DebugClientWnd, xrefs: 00457020

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
Instruction ID: 7b454b92cb1dfb233f50f2560aabdc39b6abe04e8f027f2194e5078dec578530
Opcode Fuzzy Hash: 6dc4dd13ffff63052e532ec2970cf3a172fdf6ef35738a55e650b02f86b7c4d3
Instruction Fuzzy Hash: 571127706083409BE310ABA8DC81B5FBBD89B14719F01403AFE849B3C3D7795818C7AE

Function 0047820C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242C4: SetWindowTextA.USER32(?,00000000), ref: 004242DC

GetFocus.USER32 ref: 00478277
GetKeyState.USER32(0000007A), ref: 00478289
WaitMessage.USER32(?,00000000,004782B0,?,00000000,004782D7,?,?,00000001,00000000,?,?,?,0047FEE6,00000000,00480DAC), ref: 00478293

Strings

Wnd=$%x, xrefs: 0047825B

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
Instruction ID: 17992b3effc84475d262d1a309b63da61542e22f0e105337c9737e95fd9359ad
Opcode Fuzzy Hash: f1958697a4901136eb243dbe20eb39cbb326672f79de8de72c1a435ff1b0447b
Instruction Fuzzy Hash: B811A730644644AFC701FF65DC5999E7BB8EB49304F9184FAF408E7692DB386900CA69

Function 0046E484 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E48C
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E49B

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E510
(invalid), xrefs: 0046E51E

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
Instruction ID: a22b2a007e2cf2d6de8f80eb00497e2bff53ee2dc74e74251f844a221e221b1c
Opcode Fuzzy Hash: 2c82eb517319c4feb0678a2222fa1caa0c7cc9d70da35f771929cd42352f02e5
Instruction Fuzzy Hash: 3711F8A440C3919ED340DF6AC44432BBAE4AB89708F44496EF9C8D6381E77AC948DB67

Function 00453F76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F83

Part of subcall function 00406F50: DeleteFileA.KERNEL32(00000000,0049B628,00498261,00000000,004982B6,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F5B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453FA8

Part of subcall function 0045349C: GetLastError.KERNEL32(00000000,00454031,00000005,00000000,00454066,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,00497F15,00000000), ref: 0045349F

Strings

MoveFile, xrefs: 00453FB1
DeleteFile, xrefs: 00453F94

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
Instruction ID: b5871bee3d194af1fa843ac656f6d820fc0ba16d57580c91db5694710367c43f
Opcode Fuzzy Hash: 75fc53fd0ddaa48128ef6cce4dae119495c42920ad3f5386662393d2e6d8c133
Instruction Fuzzy Hash: AEF062716142045BD701FBA2D84266EA7ECDB8435EF60443BB900BB6C3DA3C9E094529

Function 004591B4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592F1,00000000,004594A9,?,00000000,00000000,00000000), ref: 00459201

Strings

.NET Framework not found, xrefs: 00459210
InstallRoot, xrefs: 004591F0
SOFTWARE\Microsoft\.NETFramework, xrefs: 004591D4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
Instruction ID: d749d17306166952b18a3f7a40743e5d4d539800c31903ae925bcb827c574b5e
Opcode Fuzzy Hash: 7bfc696592b003d8a6b238063e783ff3189b4dca7eb8d211325608debd19b0e7
Instruction Fuzzy Hash: EEF0C231700150EBCB10EB9AD895B4E7398DB95356F50453BF980CB263C63CCC0ACA6E

Function 004836A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004836E9
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 0048370C

Strings

CSDVersion, xrefs: 004836E0
System\CurrentControlSet\Control\Windows, xrefs: 004836B6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: b08de6e064ab0066fdf25e92b32557c09a13beb56fb99f55e24ba5929372f4fd
Instruction ID: e2e1efa57e06e253ed5c33608a99233e6d60fcd3e82f395225068b7938859aaf
Opcode Fuzzy Hash: b08de6e064ab0066fdf25e92b32557c09a13beb56fb99f55e24ba5929372f4fd
Instruction Fuzzy Hash: 07F036F5A40209B6DF10EBD1CC45B9F77FC9B04B05F108567E910E7280E678DB048B59

Function 0042D8F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B5A,00000000,00453BFD,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FED,00000000), ref: 0042D90A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D910

Strings

GetSystemWow64DirectoryA, xrefs: 0042D900
kernel32.dll, xrefs: 0042D905

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction ID: 657275fb9dfacbe144619f02b172540cf2f0c5a6f4252bec6bd03a25d2dd35a2
Opcode Fuzzy Hash: 3965e48138ab8598cb17ff311cd558fd433aca8a834515e354a81fb776e31baf
Instruction Fuzzy Hash: A5E0DFE0B40B0122D70032BA1C82B6B108D4B84728F90053B3894E62D6DDBCD9840A6D

Function 0042EB54 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAD0), ref: 0042EB62
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB68

Strings

user32.dll, xrefs: 0042EB5D
ShutdownBlockReasonDestroy, xrefs: 0042EB58

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction ID: e1ec077e445c8734ae54db5ffdd633522f5c412f0b7fee52e54de0d29bb4c321
Opcode Fuzzy Hash: 88ce12e330a2fc51ece58c284b54de3a76b504cb94a4c995bd1a3fb2c6ea0693
Instruction Fuzzy Hash: A2D0C793311732665D10B1F73CD1EAB058C891527935404B7F515E5641D55DEC1115AD

Function 0044F744 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,00498762), ref: 0044F77F
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F785

Strings

NotifyWinEvent, xrefs: 0044F775
user32.dll, xrefs: 0044F77A

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction ID: 5e946f17392c81a4f172a46fe169fb9a1f72c9003761a5edf28bd31acc2f1150
Opcode Fuzzy Hash: f97c3de5cacafbf63d36e16939e29d51eb7e912e87a0fb2b79f6fc39cd446e20
Instruction Fuzzy Hash: 59E012F0E417049AFF00BBB57B86B1A3A90E764719B00057FF414A6292DB7C481C4F9D

Function 004984D8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,004987B8,00000001,00000000,004987DC), ref: 004984E2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 004984E8

Strings

DisableProcessWindowsGhosting, xrefs: 004984D8
user32.dll, xrefs: 004984DD

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
Instruction ID: 53974a48addda20669242eeec291eced9f9b3ea586a0102388b68221815f3be9
Opcode Fuzzy Hash: 0a6869f336692cffb72a3d37b5043cace6ddfe1b26e102b83d1b95de8ab3ca94
Instruction Fuzzy Hash: 8EB092C0280703689C8032BA0C02F1F08484C4272CB10003F3810A40C7ED6CDC00083D

Function 00464468 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B658: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F775,00498762), ref: 0044B67F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B697
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A9
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6BB
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6CD
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6DF
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6F1
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B703
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B715
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B727
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B739
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B74B
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B75D
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B76F
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B781
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B793
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B7A5
Part of subcall function 0044B658: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7B7

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,0049878A), ref: 00464477
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 0046447D

Strings

SHPathPrepareForWriteA, xrefs: 0046446D
shell32.dll, xrefs: 00464472

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
Instruction ID: aee408708d02c77079155b2370532760acd370d0883c3ae68736bebce920fed0
Opcode Fuzzy Hash: 43e9449c42c64eafa185df201a3e78782dc27b2a49daecccd0491a4bbbb3dbf6
Instruction Fuzzy Hash: 73B09290681740A8CA007BB2289BB0F2A4894B072E7A2463B7008710C6EF7C84204A6E

Function 0047D16C Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544), ref: 0047D2BC
FindClose.KERNEL32(000000FF,0047D2E7,0047D2E0,?,?,?,?,00000000,0047D435,?,?,?,00000000,?,0047D544,00000000), ref: 0047D2DA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
Instruction ID: 813c4c7e096b0537259228c6ce98783779beb739e450e2ccca0bb42f0b61749a
Opcode Fuzzy Hash: 1bb33653f71372efa694325d8d6b641fbfb84b71fff8fb7ce2a7bf965ad77fdb
Instruction Fuzzy Hash: 6A813B30D0024D9FDF11DFA5C845ADFBBB9EF49304F5080EAE808A3292D639AA46CF55

Function 00475420 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE30: GetTickCount.KERNEL32 ref: 0042EE36

Part of subcall function 0042EC88: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECBD

GetLastError.KERNEL32(00000000,00475595,?,?,0049C1DC,00000000), ref: 0047547E

Strings

MoveFileEx, xrefs: 004754E3
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 00475553
, xrefs: 004754B6, 004754D1

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: c178663150e68b17ede051a88a8c0b8e52ebf449323b5d146d45458d51117132
Instruction ID: cb6e190203de8706f01eb9277cb95c8d8a5d25c2e0fbb05709c61410d89611bd
Opcode Fuzzy Hash: c178663150e68b17ede051a88a8c0b8e52ebf449323b5d146d45458d51117132
Instruction Fuzzy Hash: 9E41B770A006099BCB10EFA5D882AEE77B5EF48314F608537E404BB355D7789A418BAD

Function 00413CF8 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D46
GetDesktopWindow.USER32 ref: 00413DFE

Part of subcall function 00418EC0: 6F58C6F0.COMCTL32(?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EDC
Part of subcall function 00418EC0: ShowCursor.USER32(00000001,?,00000000,00413FC3,00000000,004140D3,?,?,0049B628), ref: 00418EF9

SetCursor.USER32(00000000,?,?,?,?,00413AF3,00000000,00413B06), ref: 00413E3C

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction ID: d0219f8535474b9b7e790bb207accfb6dce16a9ac66decbe361331da1304c66b
Opcode Fuzzy Hash: 48e3412c1a46991eea637d4b1b247886da5b7466a2ee9d80c19fa9edf3c8b710
Instruction Fuzzy Hash: 91412C75600210AFC710DF2AFA84B56B7E1EB65329B16817BE405CB365DB38DD81CF98

Function 00408A54 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A75
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AE4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B7F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BBE

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction ID: 7d65b0a5aa49ad722f3f3263bbe29e3330acee4661d9e2153cfe083702b22da2
Opcode Fuzzy Hash: ede814ba8b2c905ab74f80468cae56b5ab65d73ed59c96bbcc76a4520df8398d
Instruction Fuzzy Hash: 1F3123716083849AD370EB65C945BDF77D89B85704F40483FB6C8E72D1EB7859048B6B

Function 0044E8C4 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E90D

Part of subcall function 0044CF50: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF82

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E991

Part of subcall function 0042BBB4: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC8

IsRectEmpty.USER32(?), ref: 0044E953
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E976

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
Instruction ID: f7bad605b8f68185b4e834990bb8ca2287257270a928060092b59a923d315d7c
Opcode Fuzzy Hash: e9e3cf1fe88063870224b64a3ffaafaa7ea9294743723d0f52b5b35edb71e9c8
Instruction Fuzzy Hash: E5114A71B0030067E650BA7B8C86B5B76C9AB88748F15083FB545EB387DE7DDD094299

Function 00495494 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 004954F8
OffsetRect.USER32(?,00000000,?), ref: 00495513
OffsetRect.USER32(?,?,00000000), ref: 0049552D
OffsetRect.USER32(?,00000000,?), ref: 00495548

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
Instruction ID: 0cb6fc954a72117405a3be1f948335ff5a15e1e1cf1cb616ea1ff77106a83dd0
Opcode Fuzzy Hash: 189e9286564265d853a06d191ff0450012ffb6c3854856ebd751307d5f0fca29
Instruction Fuzzy Hash: 372181B6700601AFCB00DE69CD85E6B77DAEBC4344F248A2AF944C7249D638ED448755

Function 00417218 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417260
SetCursor.USER32(00000000), ref: 004172A3
GetLastActivePopup.USER32(?), ref: 004172CD
GetForegroundWindow.USER32(?), ref: 004172D4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 0923a2c161fc1a9e066ccd67b54e00c3a39e3c999bff849f93405dbd13ead463
Instruction ID: de3f0dc6b436800086b9427ec8ddd2ec86eeedce3a35093462374e80c8eda50e
Opcode Fuzzy Hash: 0923a2c161fc1a9e066ccd67b54e00c3a39e3c999bff849f93405dbd13ead463
Instruction Fuzzy Hash: C52183313086118AD720AFA9E945AE733F1EF44754B0544ABF8558B352DB3DDC82CB9E

Function 0049514C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,00000008,?), ref: 00495161
MulDiv.KERNEL32(?,00000008,?), ref: 00495175
MulDiv.KERNEL32(?,00000008,?), ref: 00495189
MulDiv.KERNEL32(?,00000008,?), ref: 004951A7

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction ID: ece1589fda812a565620013fcb1ed5a997ef569cae5724ba48b6fbd062de1f9b
Opcode Fuzzy Hash: b0bc83cb44cddb6cfb83e9cff79c84a8c4632dee95d4fc6912c32f85648e17c5
Instruction Fuzzy Hash: E8115172A05104AFCB40DEA9D8C5E8B7BECEF4D320B24416AF908DB346D634EC408BA4

Function 0041F480 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F470,?), ref: 0041F4A1
UnregisterClassA.USER32(0041F470,00400000), ref: 0041F4CA
RegisterClassA.USER32(00499598), ref: 0041F4D4
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F50F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
Instruction ID: 7a0dc659497f48f9aad4428a0df7724adcaf244520b53866b591a9b3b5545ee4
Opcode Fuzzy Hash: 2789f09181fedf2aa8f29be774d1bfe7920984f559ea6f8e8637ed1726722249
Instruction Fuzzy Hash: F6011B72240104AADA10EBACED81E9B33999729314B11423BB615E72A2D6399C558BAC

Function 0040D010 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D027
LoadResource.KERNEL32(00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648,0000000A,00000000), ref: 0040D041
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?,?,0047C648), ref: 0040D05B
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A7C8,00400000,00000001,00000000,?,0040CF84,00000000,?,00000000,?), ref: 0040D065

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction ID: ce77ce8360aa458f47a01e9b0563465317cd85cc21d7bcd45488e041df035c61
Opcode Fuzzy Hash: f701ce4f04cb0ebdd1143b5585c75acb70ffd029a82b31343d3be87257736b7b
Instruction Fuzzy Hash: 49F04F726056046F9B14EE59A881D5B77ECDE88268310013AF908E7286DA38DD018B68

Function 00401548 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00100000,00002000,00000004,0049B450,?,?,?,004018B4), ref: 00401566
VirtualAlloc.KERNEL32(?,?,00002000,00000004,?,00100000,00002000,00000004,0049B450,?,?,?,004018B4), ref: 0040158B
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00100000,00002000,00000004,0049B450,?,?,?,004018B4), ref: 004015B1

Strings

LvLv, xrefs: 00401599

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: LvLv
API String ID: 3668210933-1162934395
Opcode ID: 4da9ee4765cce6e6c7be3d7cc9adf05dad1d6bab5239e3db9b33b19d934b365d
Instruction ID: ed10fda1d5a177d2a0c43996bc0be7fa2989f050302610c9045c0a13ae1d279a
Opcode Fuzzy Hash: 4da9ee4765cce6e6c7be3d7cc9adf05dad1d6bab5239e3db9b33b19d934b365d
Instruction Fuzzy Hash: AFF0C8716403206AEB315A294C85F133AD4DBC5754F104075BE09FF3DAD6B8980082AC

Function 00470414 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 00470465

Strings

Unsetting NTFS compression on file: %s, xrefs: 0047044B
Setting NTFS compression on file: %s, xrefs: 00470433
Failed to set NTFS compression state (%d)., xrefs: 00470476

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: a714ca870f106a0b299b69b708085a280bfeb4b7d5a8dbea3a6d3b5799a23f26
Instruction ID: 5508092d392c29e30f7e419f1558a5efa53bd64671fa73d33ea5aa8feab5f6e0
Opcode Fuzzy Hash: a714ca870f106a0b299b69b708085a280bfeb4b7d5a8dbea3a6d3b5799a23f26
Instruction Fuzzy Hash: CA016730E1924896CB14D7AD54812EDBBF49F49308F44C1EFA55DE7382DA781A08879A

Function 0046FC68 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FCB9

Strings

Setting NTFS compression on directory: %s, xrefs: 0046FC87
Failed to set NTFS compression state (%d)., xrefs: 0046FCCA
Unsetting NTFS compression on directory: %s, xrefs: 0046FC9F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: d08b5e621045cc5cd0e44a77b6b1f6d9ef736be1227186b37ca663e00f32494c
Instruction ID: 966577c707f49859c08c22ad5a588f09726d737875f6d95343439a3241496ead
Opcode Fuzzy Hash: d08b5e621045cc5cd0e44a77b6b1f6d9ef736be1227186b37ca663e00f32494c
Instruction Fuzzy Hash: 55011720D1824C56CB14D7AD74812DDBBB4AF49314F54C1BFA899E7342EB791A0C879B

Function 00455D9C Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000,0045B625), ref: 00455DD8
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5FE,?,?,?,?,?,00000000), ref: 00455DE1
RemoveFontResourceA.GDI32(00000000), ref: 00455DEE
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455E02

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
Instruction ID: 71ccc6c4ad223293e5fa71c014565a1ca4f3f808124b73c5b0663eb55104ffd2
Opcode Fuzzy Hash: 876c7f592335f26f534d3a610f48d9a4b9bf1bdf8c7f8d73d654af2b8de839a9
Instruction Fuzzy Hash: 57F0BEB174070036EA10B6BAAC4BF2B26CC8F54745F10883ABA00EF2C3D97CDC04962D

Function 0047C838 Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047C859
GetLastError.KERNEL32 ref: 0047C863
GetTickCount.KERNEL32 ref: 0047C86D
Sleep.KERNEL32(00000032), ref: 0047C87D

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: a059845960953a09b5437104de94e4f2c0855e1466d2a7ed8765463934732ab9
Instruction ID: 6dd2862dcb574814dc985a52fd8bef393983683767be68f312e29577703bd9fd
Opcode Fuzzy Hash: a059845960953a09b5437104de94e4f2c0855e1466d2a7ed8765463934732ab9
Instruction Fuzzy Hash: C4E0E5623291114D862935FE18D25AF4984CBC23A6B2A453FE088D6242C8584D05467F

Function 00477D24 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B,00000000), ref: 00477D2D
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC,?,?,?,?,?,0049884B), ref: 00477D33
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D55
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,00480DAC), ref: 00477D66

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
Instruction ID: 7d1e0899fa26f13c2a6683c6024d2156ea27cbafc883e2ae306b9283f9cebe78
Opcode Fuzzy Hash: 3a93110a626b43f3eadaa74cf541c0290f0e8f026231ea58c1b57ecd76d8e3ea
Instruction Fuzzy Hash: 85F037616447007BD610E6B58C81E6B73DCEF44754F04893A7E94C72C1D678D8089726

Function 00424240 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 0042424C
IsWindowVisible.USER32(?), ref: 0042425D
IsWindowEnabled.USER32(?), ref: 00424267
SetForegroundWindow.USER32(?), ref: 00424271

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
Instruction ID: 2c5ff33fc315f6eb6fab431e1453bcb0e66c5aaaa6596e28cc8dc28fd0b03a53
Opcode Fuzzy Hash: f5eb756bdd9929eb0187d31ee3fb53ef02cbc66ad04bc69917a7cf098bede398
Instruction Fuzzy Hash: C7E0EC61B02672D6AE31FA7B2881A9F518C9D45BE434641EBBC04FB38ADB2CDC1141BD

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnlock.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalLock.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Function 00479D3C Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047B625,?,00000000,00000000,00000001,00000000,00479FD9,?,00000000), ref: 00479F9D

Strings

Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00479E11
Failed to parse "reg" constant, xrefs: 00479FA4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
Instruction ID: 47cfa27444033e2517bbb80e4c41b37ce2323e10df06c4a21d1f595548a21c80
Opcode Fuzzy Hash: 16d8054e143327fe44f194470e69b7b3affe626307b8d2e4c87d8a967639857b
Instruction Fuzzy Hash: EB814F74E00108AFCB10EFA5D881ADEBBF9EF49314F50816AE814E7391D7389E45CB98

Function 00483070 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830A9
SetActiveWindow.USER32(?,00000000,004831FA,?,00000000,0048323B,?,?,?,?,00000000,00000000,00000000,?,0046BC0D), ref: 004830BB

Strings

Will not restart Windows automatically., xrefs: 004831DA

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 5dc678ddc73231bd7f3deb4895ee9687ce670b7cd050f2935782a4b7fd108cc5
Instruction ID: 14d12ce259a9d91e5540598a1459cb212717435f7278461c6eeed3650d71e2e9
Opcode Fuzzy Hash: 5dc678ddc73231bd7f3deb4895ee9687ce670b7cd050f2935782a4b7fd108cc5
Instruction Fuzzy Hash: E7415530304280AEE701FF64DDAAB6DBBA0AB56F05F104CB7E8404B3A2C67D1A01DB5D

Function 0046CA80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; showing wizard., xrefs: 0046CBAC
Failed to proceed to next wizard page; aborting., xrefs: 0046CB98

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
Instruction ID: f767aec7694c3a706269651ece3f491ea64dc64c3ef09eb99a1787ebd09846f2
Opcode Fuzzy Hash: 5c21498a53a12cfa8e7fd6d0fca4a53d4e4662c611673a7e38899ae354c5c1cd
Instruction Fuzzy Hash: A7317230604204DFD711EB99D5C6BA977E5AB05704F5500BBE048AB392D778BE40CB5E

Function 004789B8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE1C: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,004836C7,?,00000001,?,?,004836C7,?,00000001,00000000), ref: 0042DE38

RegCloseKey.ADVAPI32(?,00478A9E,?,?,00000001,00000000,00000000,00478AB9), ref: 00478A87

Strings

%s\%s_is1, xrefs: 00478A30
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478A12

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
Instruction ID: dc80809357616fc60b3df9076f922e914a3229883baf2cade8178dd1eb90c67d
Opcode Fuzzy Hash: cbbb33293de64dd8a9f9caa67a5b3cda024617d485473e40b666104571127f40
Instruction Fuzzy Hash: C2218170B042446FDB01DFA9CC55ADEBBE8EB88304F90847BE508E7381DA789D01CB59

Function 00450168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501FD
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 0045022E

Strings

open, xrefs: 00450221

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction ID: 7f57506e0c07b49dd0b520b237e7736b759e9f4ed638734fb0c833ac5abbff07
Opcode Fuzzy Hash: ea446b968c091deb5619fe0c64f284e9fafe3e6cb185d1fb8701354efc215884
Instruction Fuzzy Hash: A1216074E00204AFDB10DFA9C896B9EBBF8EB44705F1081BAB404E7292D678DE45CA59

Function 00455290 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 0045532C
GetLastError.KERNEL32(0000003C,00000000,00455375,?,?,?), ref: 0045533D

Part of subcall function 0042D8C4: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8D7

Strings

<, xrefs: 004552E6

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: eda88bca0edbb1d4d60b2465a169ef4fc32f774dfe42a6a5e367270b0e7eae9d
Instruction ID: 92df0b2f1231c5c49ece4c570041ef31d6ed92e86db86b93cafb864a5026e18c
Opcode Fuzzy Hash: eda88bca0edbb1d4d60b2465a169ef4fc32f774dfe42a6a5e367270b0e7eae9d
Instruction Fuzzy Hash: 172167B0600609ABDB10EF65C8926AE7BE8AF44355F54403AFC44E7291D7789E49CB98

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02337BD4,?,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: e007287126da8fa7f668c9e0dd370e3762efe765c6f58c3167b97aa7cf6c64ab
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Function 0049669E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 004966D9

Strings

/INITPROCWND=$%x , xrefs: 00496704
@, xrefs: 004966A4

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
Instruction ID: 2823dcf8e8ddb1ccfa98fa5e384fb34ae0e14248cce506d77a4005fc3c11fa4c
Opcode Fuzzy Hash: b4f4c19a8bc55ff90c2e9b73843465f76c245e37ca3079c0cf601615490e7546
Instruction Fuzzy Hash: 4711A531A042089FDF01DFA4D851BAE7FE8EB48318F5144BBE504E7291DB7C9905C658

Function 00447414 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474C6

Strings

NIL Interface Exception, xrefs: 00447468
Unknown Method, xrefs: 0044749F

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
Instruction ID: eb0132878ffe7144b3db707554455947565e11d0cdd4dc78092451a8fec87e99
Opcode Fuzzy Hash: 4f43f2048f3271615f10b1acac82c539bd88d3f79065c454e3b767f871ffd8a8
Instruction Fuzzy Hash: 8011B9706082089FEB10DFA58C52A6EBBBCEB09704F91407AF504F7681D77C9D01CB69

Function 00495F10 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000,00495FB3), ref: 00495F7E
CloseHandle.KERNEL32(00496018,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495FD8,?,00495FCC,00000000), ref: 00495F95

Part of subcall function 00495E68: GetLastError.KERNEL32(00000000,00495F00,?,?,?,?), ref: 00495E8C

Strings

D, xrefs: 00495F58

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
Instruction ID: f27f12c2402a3b04c6ef5f500e2c30b4f6e8a0b8f5398e8f95c33b3eb070371b
Opcode Fuzzy Hash: 2cac3968973140c3bf288dcd51b8fea51afb9ccec72b099e887b62547fa5ce6a
Instruction Fuzzy Hash: FC015EB1644648AFDF05DBA2DD42E9EBBACDB08714F61003AF904E72C5D6789E048B68

Function 0042DD64 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD78
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB8

Strings

Inno Setup: No Icons, xrefs: 0042DD76

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction ID: 8d080c6700cf8453afd411d185ff7d2dd707f59376968ad674d2e7d16536e1ed
Opcode Fuzzy Hash: 36a0b08f46d91d09f38f531e186592c2a543f82488f0210131226a48688c00be
Instruction Fuzzy Hash: 1B012B33B55B7179FB3045256D01F7B57889B82B60F64013BF942EA2C0D6999C04936E

Function 004973D4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 004555E4: GetCurrentProcess.KERNEL32(00000028), ref: 004555F3
Part of subcall function 004555E4: OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555F9

SetForegroundWindow.USER32(?), ref: 00497406

Strings

Restarting Windows., xrefs: 004973E3
Not restarting Windows because Uninstall is being run from the debugger., xrefs: 00497431

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Process$CurrentForegroundOpenTokenWindow
String ID: Not restarting Windows because Uninstall is being run from the debugger.$Restarting Windows.
API String ID: 3179053593-4147564754
Opcode ID: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
Instruction ID: 81a48865aaf16d48f947dda4b05133a8651c2c420a775bb83d5095b98b759fde
Opcode Fuzzy Hash: 4193847a8af397455179383c4cf3c5e93af51966d3aee1b0e62b09f4ca4c6cf6
Instruction Fuzzy Hash: 1C01B5B0618244AAEB01FB66E992B983F989B44308F80407BF5446B2D3C73C994AC75D

Function 00497B74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047CBBC: FreeLibrary.KERNEL32(74600000,00481513), ref: 0047CBD2

Part of subcall function 0047C88C: GetTickCount.KERNEL32 ref: 0047C8D6

Part of subcall function 004570E0: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004570FF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,004984CB), ref: 00497BC9
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,004984CB), ref: 00497BCF

Strings

Detected restart. Removing temporary directory., xrefs: 00497B83

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
Instruction ID: d50bc6c630895905583a3a2fadab6dc9590d78cbbd3fad9bb3e23ee4b0713a5b
Opcode Fuzzy Hash: edd495a3eb806bce708dfd09f75f47a0044e32d2cd5383a21bd3adb2a5963435
Instruction Fuzzy Hash: C8E0E57221C7042EDA1177B7BC62A573F8CD74576C761447FF90881992C42D6810C67D

Function 00455674 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455693
Sleep.KERNEL32(?), ref: 004556A3
GetLastError.KERNEL32 ref: 004556B6
GetLastError.KERNEL32 ref: 004556C0

Memory Dump Source

Source File: 00000001.00000002.3885361434.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.3885333908.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885423315.0000000000499000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885443684.000000000049A000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885462890.000000000049B000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.3885481615.00000000004AB000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_Ni2ghr9eUJ.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 6f2b27bda8ca5cc9560dd93be1cc0b104f7b92667656e0278d509a2706482566
Instruction ID: f31041694d7e6b08a2ea33ec2b58b28b25921f40701f973673b956735a8b67d8
Opcode Fuzzy Hash: 6f2b27bda8ca5cc9560dd93be1cc0b104f7b92667656e0278d509a2706482566
Instruction Fuzzy Hash: 42F02B32705F58A78B21B56A889157FB2A8DB81366750012BFC0CD7313C878CC058BBC

Analysis Process: videominimizer32.exePID: 5528, Parent PID: 4408COMMON

Execution Graph

Execution Coverage:	2.5%
Dynamic/Decrypted Code Coverage:	65.2%
Signature Coverage:	19.2%
Total number of Nodes:	500
Total number of Limit Nodes:	25

Executed Functions

Function 00AC5E4F Relevance: 79.0, APIs: 40, Strings: 5, Instructions: 210
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(00AF4FC8), ref: 00AC5E83
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 00AC5E9A
GetProcAddress.KERNEL32(00000000), ref: 00AC5EA3
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 00AC5EB2
GetProcAddress.KERNEL32(00000000), ref: 00AC5EB5
GetTickCount.KERNEL32 ref: 00AC5EC9

Part of subcall function 00AC59FA: _malloc.LIBCMT ref: 00AC5A08

GetVersionExA.KERNEL32(00AF4E18), ref: 00AC5EF6
_memset.LIBCMT ref: 00AC5F15
_malloc.LIBCMT ref: 00AC5F22

Part of subcall function 00AD1FAC: __FF_MSGBANNER.LIBCMT ref: 00AD1FC3
Part of subcall function 00AD1FAC: __NMSG_WRITE.LIBCMT ref: 00AD1FCA
Part of subcall function 00AD1FAC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 00AD1FEF

_malloc.LIBCMT ref: 00AC5F32
_malloc.LIBCMT ref: 00AC5F3D
_malloc.LIBCMT ref: 00AC5F48
_malloc.LIBCMT ref: 00AC5F53
_malloc.LIBCMT ref: 00AC5F5E
_malloc.LIBCMT ref: 00AC5F69
_malloc.LIBCMT ref: 00AC5F75
GetProcessHeap.KERNEL32(00000000,00000004), ref: 00AC5F8C
RtlAllocateHeap.NTDLL(00000000), ref: 00AC5F95
GetProcessHeap.KERNEL32(00000000,00000400), ref: 00AC5FA1
RtlAllocateHeap.NTDLL(00000000), ref: 00AC5FA4
GetProcessHeap.KERNEL32(00000000,00000400), ref: 00AC5FAF
RtlAllocateHeap.NTDLL(00000000), ref: 00AC5FB2
_memset.LIBCMT ref: 00AC5FC2
_memset.LIBCMT ref: 00AC5FCE
_memset.LIBCMT ref: 00AC5FDB
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC5FE9
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC5FF6
_malloc.LIBCMT ref: 00AC6017
_malloc.LIBCMT ref: 00AC6025
_malloc.LIBCMT ref: 00AC602C
_malloc.LIBCMT ref: 00AC604D
QueryPerformanceCounter.KERNEL32(00000200), ref: 00AC6059
Sleep.KERNEL32(00000000), ref: 00AC6067
_malloc.LIBCMT ref: 00AC6073
_malloc.LIBCMT ref: 00AC6083
_memset.LIBCMT ref: 00AC6098
_memset.LIBCMT ref: 00AC60A8
Sleep.KERNEL32(0000EA60), ref: 00AC60F5
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC6100
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC6111

Strings

strcat, xrefs: 00AC5EA5
ntdll.dll, xrefs: 00AC5E8F, 00AC5E99, 00AC5EAA
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 00AC611A
sprintf, xrefs: 00AC5E94
gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d, xrefs: 00AC6034

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$_memset$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$gpt=%.8x&advizor=%d&box=%d&hp=%x&lp=%x&line=%d&os=%d.%d.%04d&flag=%d&itd=%d$ntdll.dll$sprintf$strcat
API String ID: 1856495841-1038016512
Opcode ID: 7dcfdf5ec2053162cd1fa90073667b890369fa1cb5147638893c031d0611e72c
Instruction ID: 7b72f9dc2f113299268bd15d8bb2824b6ae41cff73fec21ace6d37b55c40c473
Opcode Fuzzy Hash: 7dcfdf5ec2053162cd1fa90073667b890369fa1cb5147638893c031d0611e72c
Instruction Fuzzy Hash: 6871C4B1D087806FD310EFB4BC49B6B7BE4AF89710F05081AF28997391DB785A05CB96

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

iphlpapi.dll, xrefs: 00401B58
o, xrefs: 00401BF2
GetAdaptersInfo, xrefs: 00401B6E

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
Instruction ID: a9f54c968f2091474e8feb0d981771773be25d9c6ef5ebc30493122ab1168d3f
Opcode Fuzzy Hash: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
Instruction Fuzzy Hash: E821B870904209AEDF219F65C9447EF7FB8EF45345F0440BAE604B62A1E7389A85CB69

Function 00ACE99C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00ACE9B2
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00ACE9CB
GetAdaptersInfo.IPHLPAPI(?,?), ref: 00ACE9F0
FreeLibrary.KERNEL32(00000000), ref: 00ACEA79

Strings

GetAdaptersInfo, xrefs: 00ACE9C5
iphlpapi.dll, xrefs: 00ACE9A6

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: 017720563723c8c48e41b07213958d1bd2a750156c9d9f8a5047947f1ba7ece8
Instruction ID: 24865416888cd573b42dcb2c470c4a871896c92e1d9ddc9c0aee4496d142392a
Opcode Fuzzy Hash: 017720563723c8c48e41b07213958d1bd2a750156c9d9f8a5047947f1ba7ece8
Instruction Fuzzy Hash: 3521B175E042099FDB10DBA9D884FEEBBB8BF49351F1500ADE509E7241E7309E45CBA4

Function 00AC2B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 00AC2BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 00AC2C07

Part of subcall function 00AC94FE: WSAGetLastError.WS2_32(00000000,?,?,00AC2A51), ref: 00AC950C

WSASetLastError.WS2_32 ref: 00AC2CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 00AC2CE7

Strings

3', xrefs: 00AC2C85

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: c61680a5b6bfa52c0ea0f83cc2fde87f1b90c03a1a17b87ed3ed995045910965
Instruction ID: bf26cfcd1595ce8a6764c2c647b4cd2ff8947d3bc1d7b818bc31f576e8c51785
Opcode Fuzzy Hash: c61680a5b6bfa52c0ea0f83cc2fde87f1b90c03a1a17b87ed3ed995045910965
Instruction Fuzzy Hash: AC41BFB0A083018FDB20DF74D555B6BBBE9AF94354F124D2EF895C7291EB70D8408B92

Function 00ACE898 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00ACE8B7
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 00ACE8F5
GetLastError.KERNEL32 ref: 00ACE956
CloseHandle.KERNEL32(?), ref: 00ACE98D

Strings

\\.\PhysicalDrive0, xrefs: 00ACE8B0

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: ea3417cdae7dad9fecb1efb65d154b931ebfbf873e931abf473b0eb518d8caa2
Instruction ID: 00a6f2f069cd040d29d836ebf7c7af3efacf6952e674691004ce31393d88f384
Opcode Fuzzy Hash: ea3417cdae7dad9fecb1efb65d154b931ebfbf873e931abf473b0eb518d8caa2
Instruction Fuzzy Hash: A3316971E00219EBDB24DFA8D884FAEFBB8EB05714F21416EE505A7280D7B05E05CBA0

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNEL32(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
CloseHandle.KERNEL32(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
Instruction ID: ae54cd8959710a424601ffd4623f532e2396a469a493930b182490efebea7a61
Opcode Fuzzy Hash: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
Instruction Fuzzy Hash: 50318D71D01118EECB21EF95CD809EFBBB8EF45750F20807AE514B22A0E7785E45CB98

Function 00AC636A Relevance: 68.9, APIs: 27, Strings: 12, Instructions: 622
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00AC6AF6
block, xrefs: 00AC6634
auth_ip, xrefs: 00AC65F0, 00AC685C
updurls, xrefs: 00AC64EF
disconnect, xrefs: 00AC64BC, 00AC67C3
connect, xrefs: 00AC64AB, 00AC6509
idle, xrefs: 00AC64CD, 00AC6817
%d;, xrefs: 00AC6886
updips, xrefs: 00AC64DE, 00AC683B
<htm, xrefs: 00AC643B
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 00AC611A
auth_swith, xrefs: 00AC65C4

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID:
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
API String ID: 0-2823103634
Opcode ID: fc5c475b59f451c10b83511d117d7eaf61b927c72fef4735e895669d6cc76bb6
Instruction ID: a737d35ac7176422893209eeadf897a59de763658ad84ae9c6e8c942c6853854
Opcode Fuzzy Hash: fc5c475b59f451c10b83511d117d7eaf61b927c72fef4735e895669d6cc76bb6
Instruction Fuzzy Hash: 80224531608381AFD724EB24D856FAF7BE4AFC6310F11491EF5899B392EB709845CB52

Function 00AC6415 Relevance: 54.6, APIs: 21, Strings: 10, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00AC6471
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC6494
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC64A5
_malloc.LIBCMT ref: 00AC652C
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC653E
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC654A
_memset.LIBCMT ref: 00AC6564
_memset.LIBCMT ref: 00AC6573
_memset.LIBCMT ref: 00AC6583
_memset.LIBCMT ref: 00AC6592
_memset.LIBCMT ref: 00AC65A1
_malloc.LIBCMT ref: 00AC661B
_memset.LIBCMT ref: 00AC662C
_strtok.LIBCMT ref: 00AC664C
_swscanf.LIBCMT ref: 00AC6663
_strtok.LIBCMT ref: 00AC667A
_free.LIBCMT ref: 00AC6686

Strings

block, xrefs: 00AC6634
auth_ip, xrefs: 00AC65F0
updurls, xrefs: 00AC64EF
disconnect, xrefs: 00AC64BC
connect, xrefs: 00AC64AB, 00AC6509
idle, xrefs: 00AC64CD
updips, xrefs: 00AC64DE
<htm, xrefs: 00AC643B
Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 00AC611A
auth_swith, xrefs: 00AC65C4

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: _memset$CriticalSection$EnterLeave_malloc_strtok$_free_swscanf
String ID: <htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls
API String ID: 3441009308-1437582238
Opcode ID: 8bc894b22851b3d030460d4bdb6db6f73ba7aca8668a8afc4180fdd3125f5524
Instruction ID: e67b455d4da4ffb1de75c066455d4c4e12e88857bb8cabae0ec238da5c70021a
Opcode Fuzzy Hash: 8bc894b22851b3d030460d4bdb6db6f73ba7aca8668a8afc4180fdd3125f5524
Instruction Fuzzy Hash: D6A186326483806BD724EB34AD16F6F7BE4AFCA724F15081EF585AB3D2DB218900C356

Function 00AC1CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00AC1D11
GetLastError.KERNEL32 ref: 00AC1D23

Part of subcall function 00AC1712: __EH_prolog.LIBCMT ref: 00AC1717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00AC1D59
GetLastError.KERNEL32 ref: 00AC1D6B
__beginthreadex.LIBCMT ref: 00AC1DB1
GetLastError.KERNEL32 ref: 00AC1DC6
CloseHandle.KERNEL32(00000000), ref: 00AC1DDD
CloseHandle.KERNEL32(00000000), ref: 00AC1DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00AC1E14
CloseHandle.KERNEL32(00000000), ref: 00AC1E1B

Strings

thread, xrefs: 00AC1DFB
thread.entry_event, xrefs: 00AC1D3C
thread.exit_event, xrefs: 00AC1D84

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$CreateEvent$H_prologObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 831262434-3017686385
Opcode ID: f3a5b3159984347ed662b322cc667d47d4ed2174d001c1bbdea87cfa9d986336
Instruction ID: 64bb5d2b06cb251216f5de92a3fb3ff48db0e1ac50ebfbedfa6011b7d2c729ce
Opcode Fuzzy Hash: f3a5b3159984347ed662b322cc667d47d4ed2174d001c1bbdea87cfa9d986336
Instruction Fuzzy Hash: 2B317C71A007019FD700EF60D888F2BBBA4EF85754F11492DF8558B292EB309D4ACBD2

Function 00AC4D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00AC4D8B
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC4DB7
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC4DC3

Part of subcall function 00AC4BED: __EH_prolog.LIBCMT ref: 00AC4BF2
Part of subcall function 00AC4BED: InterlockedExchange.KERNEL32(?,00000000), ref: 00AC4CF2

RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC4E93
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC4E99
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC4EA0
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC4EA6
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC50A7
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC50AD
RtlEnterCriticalSection.NTDLL(00AF4FC8), ref: 00AC50B8
RtlLeaveCriticalSection.NTDLL(00AF4FC8), ref: 00AC50C1

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: 36b06af6db3acdb7f986bd00f3bf6d4b047844b2f4aa27c249bc2604064afbb9
Instruction ID: 1e8dbc9c433c2cc98f4b63c58809c6f594aa0438dbf47c0664f644f35f99c892
Opcode Fuzzy Hash: 36b06af6db3acdb7f986bd00f3bf6d4b047844b2f4aa27c249bc2604064afbb9
Instruction Fuzzy Hash: 52B15831D0425D9FDF21DFA0D841FEEBBB4AF08314F21405EE509AA281DB756A89CFA1

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNEL32(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
Instruction ID: b01298f5e92dfabffd3260d40ec81ee59ee3d80feb476c4020a7475af27d6630
Opcode Fuzzy Hash: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
Instruction Fuzzy Hash: 60315C32900255EFDB105FB89F8896F7B68EF45344B10807AFA86F7281DA748941C7A8

Function 00AC26DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00AC2706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 00AC272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE3163), ref: 00AC2738

Part of subcall function 00AC1712: __EH_prolog.LIBCMT ref: 00AC1717

SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 00AC2778
RtlLeaveCriticalSection.NTDLL(?), ref: 00AC27D9

Strings

timer, xrefs: 00AC2745

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: 9ddd641013923f10bc9c149052d01f35111e0b69c88626b327de046a9eddc2c7
Instruction ID: 530ae35c7ca86f39bf526f6a32a4d7ea9944af8bc8d54a9a37f4879fc1504ed3
Opcode Fuzzy Hash: 9ddd641013923f10bc9c149052d01f35111e0b69c88626b327de046a9eddc2c7
Instruction Fuzzy Hash: 0631CEB1904B01AFD310DF75D984F16BBE8FB48764F004A2EF81587A80E770E801CB91

Function 00AC1BA7 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 00AC1BAC
RtlEnterCriticalSection.NTDLL ref: 00AC1BBC
RtlLeaveCriticalSection.NTDLL ref: 00AC1BEA
RtlEnterCriticalSection.NTDLL ref: 00AC1C13
RtlLeaveCriticalSection.NTDLL ref: 00AC1C56

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: 545f734722256fe86ba57054e5030fc6a28f85ddb603000c2aab3576e9c8184f
Instruction ID: ac1d06c77898c8ef0416b5d798f5c7d213a2c0ed412cdaff0dc225857165496d
Opcode Fuzzy Hash: 545f734722256fe86ba57054e5030fc6a28f85ddb603000c2aab3576e9c8184f
Instruction Fuzzy Hash: ED217675A04644DFCB14CFA8D884BAABBB4FF89314F11814DE8199B302D775AD05CBE0

Function 00AC6B8A Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 00AC611A

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID:
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
API String ID: 0-1923541051
Opcode ID: 509c42ebfd3d6e5fd024c13ea2cb5184e32b69eea61241fd01720f078140515b
Instruction ID: 1725b03ac09807ba7c2e623bdf4e389ecbc27e366ea3df7f3b12c15da03fcdb9
Opcode Fuzzy Hash: 509c42ebfd3d6e5fd024c13ea2cb5184e32b69eea61241fd01720f078140515b
Instruction Fuzzy Hash: 7E419B7224D3958FD712DB78D844ADA7F61EB17360349459ED0C1CF193D721880BC790

Function 0040D171 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 105
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExA.KERNEL32(?,Common AppData), ref: 0040D24F

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040D1A4

Memory Dump Source

Source File: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: QueryValue
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 3660427363-2036018995
Opcode ID: d1409ce8a04974f07b35f483d05f6e81119043874a569f1d7135be82ee309a1c
Instruction ID: 78f1f3d2651f8922f1f2a01d89227eb1346f92508422d736d25cd9280e2fc7e1
Opcode Fuzzy Hash: d1409ce8a04974f07b35f483d05f6e81119043874a569f1d7135be82ee309a1c
Instruction Fuzzy Hash: 21317B32C086559BD7118F70DE843E67BB5EF45360F14863AC892B72E2C73A590ED798

Function 00403310 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00403336

Part of subcall function 00404454: HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465
Part of subcall function 00404454: HeapDestroy.KERNEL32 ref: 004044A4

GetCommandLineA.KERNEL32 ref: 00403384
GetStartupInfoA.KERNEL32(?), ref: 004033AF
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004033D2

Part of subcall function 0040342B: ExitProcess.KERNEL32 ref: 00403448

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
Instruction ID: a936b3102d24e78b19d7c169988c3063d29dd1dd2c17feae02d4b7387c8d63d1
Opcode Fuzzy Hash: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
Instruction Fuzzy Hash: 172183B1900615AED704AFB5DE45A6E7F68EF44705F10413EF901B72D2DB385900CB58

Function 00AC2EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 00AC2EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 00AC2EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 00AC2F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 00AC2F36

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 4bfbfb744bd566761bcd7ce1e00dba7ff0725de4c2ab2e637797dc946aaa4da6
Instruction ID: ca4202ce2d74b231626979538a2ccf7603b0113d6c02707869dbaa545e96e25d
Opcode Fuzzy Hash: 4bfbfb744bd566761bcd7ce1e00dba7ff0725de4c2ab2e637797dc946aaa4da6
Instruction Fuzzy Hash: 78017571A00204BFDB209FA5DC88F9A7BA9DF85765F018569FA188B151D7708C008BA0

Function 00AC2DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC2D39: WSASetLastError.WS2_32(00000000), ref: 00AC2D47
Part of subcall function 00AC2D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 00AC2D5C

WSASetLastError.WS2_32(00000000), ref: 00AC2E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 00AC2E83

Strings

3', xrefs: 00AC2E22

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: 4503d2fa8d7910da44bdd3051d53aa741242c5f8e1cb7426f9eba828af5f1d44
Instruction ID: 367b328e27b095114f02766b83a0e1cb2710b47c360c2558b59440856f24c120
Opcode Fuzzy Hash: 4503d2fa8d7910da44bdd3051d53aa741242c5f8e1cb7426f9eba828af5f1d44
Instruction Fuzzy Hash: 4831EFB0E002099FDF11DFA4D915FEEBBF9AF14354F02856DE805A7241E7B099418BA0

Function 00AC2AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 00AC2AEA
connect.WS2_32(?,?,?), ref: 00AC2AF5

Strings

3', xrefs: 00AC2B3B

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: 31135b33b0fe0442bab42439965bbf13965f70b3e0b2747ec7923d8359be3490
Instruction ID: 8c2cc5b14afd3fa73d92f101ed80883817f0d77cebf9e0c7eafd25db7c6def2a
Opcode Fuzzy Hash: 31135b33b0fe0442bab42439965bbf13965f70b3e0b2747ec7923d8359be3490
Instruction Fuzzy Hash: 5321F671E00204AFCF14EFA4D515FAEBBF9AF44324F0185ADE81897281EB744E019BA0

Function 00402CA7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,Common AppData), ref: 0040D24F
RegCloseKey.KERNEL32(?), ref: 0040DCA0

Strings

Common AppData, xrefs: 00402CA7

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CloseQueryValue
String ID: Common AppData
API String ID: 3356406503-2574214464
Opcode ID: 7fb426fbc1daea728e0292a6f56f5ffc517f2730cea52d2236219cd6951a695f
Instruction ID: b56edbcec1431f3f013adad2ea631c62a19a0754f6dc0b3eadc1950556951285
Opcode Fuzzy Hash: 7fb426fbc1daea728e0292a6f56f5ffc517f2730cea52d2236219cd6951a695f
Instruction Fuzzy Hash: 4FD05E30D48101EBCB015FE08F0EB6E7A70AE543407218437A512B00E0CBFCA90AF61E

Function 00AC353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC3543

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 973711a4a26d700a00cf97d70f8536b07274cc385c8313d222946bdaf9f5ecf5
Instruction ID: caa85478d9f2397a06b5edb280a7bc3f5ea575801f9547564143c9c36f72bf20
Opcode Fuzzy Hash: 973711a4a26d700a00cf97d70f8536b07274cc385c8313d222946bdaf9f5ecf5
Instruction Fuzzy Hash: E6512CB1A04246DFCF08DF68D551BAABBB0FF09320F11C15EE8299B381D7759A11CB91

Function 00AC369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 00AC36A7

Part of subcall function 00AC2420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00AC2432
Part of subcall function 00AC2420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 00AC2445
Part of subcall function 00AC2420: RtlEnterCriticalSection.NTDLL(?), ref: 00AC2454
Part of subcall function 00AC2420: InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2469
Part of subcall function 00AC2420: RtlLeaveCriticalSection.NTDLL(?), ref: 00AC2470

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: 0252e983dea508e6042902b719aa6674ff07298eb1bf9c0c67820126ad8162a4
Instruction ID: 0116121af64dd4f3985a862bf9ca8e6cf37be9cce3cd7e9a16334dbbd4647616
Opcode Fuzzy Hash: 0252e983dea508e6042902b719aa6674ff07298eb1bf9c0c67820126ad8162a4
Instruction Fuzzy Hash: EF11E7B6100208EBDF21DF58DC85FAA3BA5EF04354F21C11EFE16CA290C775D9609B94

Function 00AD10F0 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 00AD1106
CloseHandle.KERNEL32(?,?,?,?,?,00000002,00AC997E,00000000), ref: 00AD1137
ResumeThread.KERNEL32(?,?,?,?,?,00000002,00AC997E,00000000), ref: 00AD1145

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: 5b24a8e0e1f7d0d767caf5569f7a4fe1ec1c8e763714cc8c1d65d7a9097e66e2
Instruction ID: 672cef939e1ba0c5acb016b97cce984245640576d21aebb450900d8f730cf6a6
Opcode Fuzzy Hash: 5b24a8e0e1f7d0d767caf5569f7a4fe1ec1c8e763714cc8c1d65d7a9097e66e2
Instruction Fuzzy Hash: 80F06271200201ABDB209FA8DCC5F95B3E8AF59725F24066FF655DB390C7B1AC92DB90

Function 00AC1AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00AF529C), ref: 00AC1ABA
WSAStartup.WS2_32(00000002,00000000), ref: 00AC1ACB
InterlockedExchange.KERNEL32(00AF52A0,00000000), ref: 00AC1AD7

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: d5d3a1c106bf1938140c4994792375ba90bd182749de5b54aaf6443b3e7a4ff8
Instruction ID: 6d2a8eac291c97bd061dc8016b8aa7a7a2b2f8d5a002b00fda99e68626f3f7ec
Opcode Fuzzy Hash: d5d3a1c106bf1938140c4994792375ba90bd182749de5b54aaf6443b3e7a4ff8
Instruction Fuzzy Hash: F2D05E31D44A486FD220B7F4BD8EEB87B6CE70672AF400755FF64C81D1EA51691086A6

Function 00B09210 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(2D396D40), ref: 00B2C21B

Strings

([wO, xrefs: 00B2C1F9

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: DeleteFile
String ID: ([wO
API String ID: 4033686569-2721458860
Opcode ID: f4f15dbc9dbfdfeeff2d6407ee082574d23fa3484512b7124d145fd0e46dc967
Instruction ID: 49281c203f7c7aeded59bf5b7b727b760715406c1d4205a17d7a84445f15deb7
Opcode Fuzzy Hash: f4f15dbc9dbfdfeeff2d6407ee082574d23fa3484512b7124d145fd0e46dc967
Instruction Fuzzy Hash: C02153F251C600AFE318AF08E88177EB7E5EF94310F15893DE2C987754EA35A8518B97

Function 00AC4BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC4BF2

Part of subcall function 00AC1BA7: __EH_prolog.LIBCMT ref: 00AC1BAC
Part of subcall function 00AC1BA7: RtlEnterCriticalSection.NTDLL ref: 00AC1BBC
Part of subcall function 00AC1BA7: RtlLeaveCriticalSection.NTDLL ref: 00AC1BEA
Part of subcall function 00AC1BA7: RtlEnterCriticalSection.NTDLL ref: 00AC1C13
Part of subcall function 00AC1BA7: RtlLeaveCriticalSection.NTDLL ref: 00AC1C56

Part of subcall function 00ACD0ED: __EH_prolog.LIBCMT ref: 00ACD0F2
Part of subcall function 00ACD0ED: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00ACD171

InterlockedExchange.KERNEL32(?,00000000), ref: 00AC4CF2

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: b691f549213f05005741e6fedc9b98a85bef1520afe7d378796851950bf84c16
Instruction ID: 3efeda11cb1f004f6101dbdbdfcab663d464288baebb3519eb9af75d09f5640b
Opcode Fuzzy Hash: b691f549213f05005741e6fedc9b98a85bef1520afe7d378796851950bf84c16
Instruction Fuzzy Hash: E251F471D042489FDB15DFA8C595BEEBBB4EF08310F15816EE906AB352DB319A44CB60

Function 00AC2D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 00AC2D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 00AC2D5C

Part of subcall function 00AC94FE: WSAGetLastError.WS2_32(00000000,?,?,00AC2A51), ref: 00AC950C

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 57fdbbc5e6962b88f80b181f29b82fd98599099c88fab196f96da6839023d418
Instruction ID: 8435f39ac2e2dc45faf3658cd14b944a86474ee2751178f025645b4d35fa720f
Opcode Fuzzy Hash: 57fdbbc5e6962b88f80b181f29b82fd98599099c88fab196f96da6839023d418
Instruction Fuzzy Hash: CF01D4B1500205EFDB21AFA4D984F6BBBFCEF543A4721452DF85A93200EB308D0097A1

Function 00404454 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465

Part of subcall function 0040430C: GetVersionExA.KERNEL32 ref: 0040432B

HeapDestroy.KERNEL32 ref: 004044A4

Part of subcall function 0040482B: HeapAlloc.KERNEL32(00000000,00000140,0040448D,000003F8), ref: 00404838

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
Instruction ID: 6792b556898a49359456169ba0c82f011abfeecbff717d74d0c7f117a7ac5838
Opcode Fuzzy Hash: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
Instruction Fuzzy Hash: 90F065F0A01302DAEB206B70AE4572A3695DBC0755F20483BFA04F51E0EA788884A91D

Function 00AC5119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC511E

Part of subcall function 00AC3D7E: htons.WS2_32(?), ref: 00AC3DA2
Part of subcall function 00AC3D7E: htonl.WS2_32(00000000), ref: 00AC3DB9
Part of subcall function 00AC3D7E: htonl.WS2_32(00000000), ref: 00AC3DC0

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: 4dd8870243faed31b5f41decbb9274b035c6fc456e9efd1dc9c2eb574316effa
Instruction ID: 1e4b0cc3f72edb6d9660210992d550e70c87b738db06bff786193846edd49a32
Opcode Fuzzy Hash: 4dd8870243faed31b5f41decbb9274b035c6fc456e9efd1dc9c2eb574316effa
Instruction Fuzzy Hash: 598145B2D0424ACECF05DFA8D590AEEBBB5AF48310F10815EE854BB241EB756A45CF74

Function 00B0BBA6 Relevance: 1.7, APIs: 1, Instructions: 157fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?), ref: 00B40017

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f4f38f64a14dbcfe46d1e0b787a36e3c7dd3148164560d73121a484e0546f2db
Instruction ID: b95de37c5640ceaa19fffdc93e562cc5bc39d2ee831ebec9ce3729e7b8f18b01
Opcode Fuzzy Hash: f4f38f64a14dbcfe46d1e0b787a36e3c7dd3148164560d73121a484e0546f2db
Instruction Fuzzy Hash: A64193F251C6049FE305BF19EC85BBABBE5EF84720F16492DE6C4C3704EA3154408A97

Function 00B03B1A Relevance: 1.6, APIs: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?), ref: 00B48B10

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 42788c546b1fa8fef704cb9ae2bf918df8932be7db3fb0186e8b16ad0200b4c2
Instruction ID: aadf4f5d72a50230b313a170b74f49c6a4590b806895a71d8f991ec5def8b2f2
Opcode Fuzzy Hash: 42788c546b1fa8fef704cb9ae2bf918df8932be7db3fb0186e8b16ad0200b4c2
Instruction Fuzzy Hash: 193103B290CA109FE715AF09E8C17AAFBE4EF58714F06492DEAC887350D63558508B9B

Function 00B03AFA Relevance: 1.6, APIs: 1, Instructions: 82fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?), ref: 00B48B10

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b711d4ed3080aeaea50aaf90ab4617c3679a7e2862d5ba283e3f0b99d9d6aff2
Instruction ID: 8bc3ed13e7aec8f7362b8b168674e3b3be59c6dd4c1eb8f395fc74d2247030cf
Opcode Fuzzy Hash: b711d4ed3080aeaea50aaf90ab4617c3679a7e2862d5ba283e3f0b99d9d6aff2
Instruction Fuzzy Hash: 532112B150CA009FE315AF19E8C537AFBE8FF58304F06482CEAC887750E63158509B8B

Function 00ACD9B6 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ACD9BB

Part of subcall function 00AC1A01: TlsGetValue.KERNEL32 ref: 00AC1A0A

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: 1d576158228d3c8e0699b21dfdd8a323c9edb6642b7594322874fc3164acb918
Instruction ID: cd17003fbbc2a083c7820616c85120145c90f263c99eb08c28b2452c58c305d5
Opcode Fuzzy Hash: 1d576158228d3c8e0699b21dfdd8a323c9edb6642b7594322874fc3164acb918
Instruction Fuzzy Hash: E2214AB2904209AFDB04DFA9D941BFFBBF9EF49350F11412EE905A7241D770AA01CBA0

Function 00B42015 Relevance: 1.6, APIs: 1, Instructions: 51filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET ref: 00B4AECB

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 7ded636e2a15437337a4d708464a7ce190717fdd9274865b6de3bc62b96f27c6
Instruction ID: 6c1ac7576449d119b1c83ac1d94c462fa5a6f75424aa17d16638db52dabc85e6
Opcode Fuzzy Hash: 7ded636e2a15437337a4d708464a7ce190717fdd9274865b6de3bc62b96f27c6
Instruction Fuzzy Hash: 0A0180B240C7049FE7087F69EC8967AFBE4EF59710F12452DE2D047644EA74A4408BD7

Function 0040272F Relevance: 1.5, APIs: 1, Instructions: 37fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32(?), ref: 0040D9F1

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 0bf946799e28dabf71ce178a3788fdc4e2c2401dfe351f036eccd73f05517e05
Instruction ID: be7d52d85c0d79c76acb35c1ee0036e51c1adcc54994dfd53098bc7bceb5933f
Opcode Fuzzy Hash: 0bf946799e28dabf71ce178a3788fdc4e2c2401dfe351f036eccd73f05517e05
Instruction Fuzzy Hash: 6EF09EB2604459AFDB088779BDB5AF77BECC719361F014178B683B31D2D1340849DBA5

Function 004029D0 Relevance: 1.5, APIs: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 004029D0

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 473032ac56c0edcb2a817ada094dbdb6c77fedae1932700863a7a3ddd3f60ff4
Instruction ID: 17df461c73795f9fa62887fde36be499ba974af5f892d405074d8ab2cf89a333
Opcode Fuzzy Hash: 473032ac56c0edcb2a817ada094dbdb6c77fedae1932700863a7a3ddd3f60ff4
Instruction Fuzzy Hash: 34F02479D141618BC315AB30AF297E63BA0E305B20B04033AEAC2F76E3C7B84D059748

Function 00ACD546 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ACD54B

Part of subcall function 00AC26DB: RtlEnterCriticalSection.NTDLL(?), ref: 00AC2706
Part of subcall function 00AC26DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 00AC272B
Part of subcall function 00AC26DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00AE3163), ref: 00AC2738
Part of subcall function 00AC26DB: SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 00AC2778
Part of subcall function 00AC26DB: RtlLeaveCriticalSection.NTDLL(?), ref: 00AC27D9

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: a93b77f88f77fdf528d18c367b819766c2038871a429aab580b818af9271e8b2
Instruction ID: 3e775651d979755a5d797d09663c5879868926c7911c7939852fc0178b84abf4
Opcode Fuzzy Hash: a93b77f88f77fdf528d18c367b819766c2038871a429aab580b818af9271e8b2
Instruction Fuzzy Hash: 440193B1910B549FC328CF1AC544946FBF4EF88310B15C5AE94498B722E7B1DA40CFA4

Function 00AFCFCE Relevance: 1.5, APIs: 1, Instructions: 21fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00AFCFCE

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: fea758b9bf1d8447c0e633bdd51968b001f5f52ccbf22cf181a75d56576cb83e
Instruction ID: 28d8b6f4175f3b8cd565337723a9fc96bbf7dd0f57042c41b1541cf8de72227e
Opcode Fuzzy Hash: fea758b9bf1d8447c0e633bdd51968b001f5f52ccbf22cf181a75d56576cb83e
Instruction Fuzzy Hash: D1E086769086209FE741D52ADCC4629B7E3AFC9B00F62C51992C88F618DF35451546D2

Function 00ACD325 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ACD32A

Part of subcall function 00AD27B5: _malloc.LIBCMT ref: 00AD27CD

Part of subcall function 00ACD546: __EH_prolog.LIBCMT ref: 00ACD54B

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: c5aa9fe94f75d9d8fcc230b4846865fa4741352e96896e6c50a22356937a3928
Instruction ID: 5259deaffe4185f87389d6cd676b69fffdb191faf9c1093e48030b0987b70952
Opcode Fuzzy Hash: c5aa9fe94f75d9d8fcc230b4846865fa4741352e96896e6c50a22356937a3928
Instruction Fuzzy Hash: B3E08C71A00149ABCB19DF689D12B6D7BA5EB84300F0041BEB80A96340EF709A008601

Function 00AD2452 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AD48BA: __getptd_noexit.LIBCMT ref: 00AD48BB
Part of subcall function 00AD48BA: __amsg_exit.LIBCMT ref: 00AD48C8

Part of subcall function 00AD2493: __getptd_noexit.LIBCMT ref: 00AD2497
Part of subcall function 00AD2493: __freeptd.LIBCMT ref: 00AD24B1
Part of subcall function 00AD2493: RtlExitUserThread.NTDLL(?,00000000,?,00AD2473,00000000), ref: 00AD24BA

__XcptFilter.LIBCMT ref: 00AD247F

Part of subcall function 00AD7944: __getptd_noexit.LIBCMT ref: 00AD7948

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: 0d41ff97d7fbce92ee8c39a7a7acd261e8db242fa4db543ddc8f7d9185f2b53f
Instruction ID: a43809beaa98bffb8a8e572e59c1572c08bf4986430d4a7b339d8bcb62172657
Opcode Fuzzy Hash: 0d41ff97d7fbce92ee8c39a7a7acd261e8db242fa4db543ddc8f7d9185f2b53f
Instruction Fuzzy Hash: 24E0ECB1944604AFEB08ABA0DA0AF2D77B5EF04315F20059AF1029B3A2DA749940EB24

Function 0040D0F6 Relevance: 1.5, APIs: 1, Instructions: 17registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(?,Common AppData), ref: 0040D24F

Memory Dump Source

Source File: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7e365ee754354f7e7fdc6e846a87b3091bdd5ed6e42f43f651651090f06dfbc2
Instruction ID: ccdc91a9fd20e400ce6b2fe0d7b3789badde77d26290f937d59154620e49623b
Opcode Fuzzy Hash: 7e365ee754354f7e7fdc6e846a87b3091bdd5ed6e42f43f651651090f06dfbc2
Instruction Fuzzy Hash: 16D0A720984621DDCB179AE04A0C7673916A9D0364B3654375416B36D1EF78C90F6179

Function 00402D15 Relevance: 1.5, APIs: 1, Instructions: 17registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32 ref: 00402D15

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8e9bf35af8a4a033b83d167184e8cfbd6c35f971a5b34edfb285b669b7e0d08e
Instruction ID: b1f4734473a9bf99f677c6b4891aeeb61c73ba9f0efb162166277ed58f2dec1e
Opcode Fuzzy Hash: 8e9bf35af8a4a033b83d167184e8cfbd6c35f971a5b34edfb285b669b7e0d08e
Instruction Fuzzy Hash: 0DE0C231908944DBC6004B70FF55BE137B55B11320F140176A6E6361F3D2754E079A0C

Function 004026D3 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32 ref: 0040DE4B

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: c7f2931bae8ced0ef8d04e57fc608a9a22d7688aed52034085a3b275c54fa888
Instruction ID: c69a753baf1f0e3215b43618e79bb5b3c1ef9b61af051a77408c13a941691e87
Opcode Fuzzy Hash: c7f2931bae8ced0ef8d04e57fc608a9a22d7688aed52034085a3b275c54fa888
Instruction Fuzzy Hash: 5ED0C970849415A6D1116A914D4ADA9252CAF2A38AB604077E007740C25ABE4B0A55BF

Function 0040D0A2 Relevance: 1.5, APIs: 1, Instructions: 11libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(?,00000000), ref: 0040DA7F

Memory Dump Source

Source File: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8d3fbdeb9b5e9020e4c44e14a7eacee0b11f97fe52ff3575077653e0dac1fdc5
Instruction ID: 2d06c348b4b4d8bc5f4e0cebcdf0c622ab67855ff40dcde7de2d6608d4a7c495
Opcode Fuzzy Hash: 8d3fbdeb9b5e9020e4c44e14a7eacee0b11f97fe52ff3575077653e0dac1fdc5
Instruction Fuzzy Hash: B4C01274A08212EBC700EFA0DD40BA53FA07B04340F1041329942A6194C3388547AB06

Function 00AFCF99 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32 ref: 00AFCFA2

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AF8000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AF8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_af8000_videominimizer32.jbxd

Similarity

API ID: FolderPathSpecial
String ID:
API String ID: 994120019-0
Opcode ID: 4dc2bb99fbd3d76e2c30b518111cc80d0da41421902418370bf9fa05ba7bc4b9
Instruction ID: 9ec8af6e4dd78c2c18b21ef1777f732f7acc38a78d8c277313b4dc7e7b38cf9e
Opcode Fuzzy Hash: 4dc2bb99fbd3d76e2c30b518111cc80d0da41421902418370bf9fa05ba7bc4b9
Instruction Fuzzy Hash: 61C08C3080C048CFC7088BF0F8DADFD7FF0EA00BA03A04290E816050219B24980BBF00

Function 004028BF Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 004028BF

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 4444665d6fa8f2504967b8ad7925185f6564cdd816bfc9c508967ec05ffacf61
Instruction ID: 66d212404691b7b3d12b4cf143c673829a431b88c72c70207ed8f08321cc64ae
Opcode Fuzzy Hash: 4444665d6fa8f2504967b8ad7925185f6564cdd816bfc9c508967ec05ffacf61
Instruction Fuzzy Hash: 21C01225C18880C7C2054770BB25AE17B7157163207281665A1B6371EBC6754C06A64C

Function 00402B77 Relevance: 1.5, APIs: 1, Instructions: 9registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002), ref: 0040DF73

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a4ca91375b1ae48df5b0da444fc155f7a749ab565cde4b5011a20c6dbe2ae2cb
Instruction ID: 3535159792f43f07d187204692f948a6355b95b3004a34c1134e5b9aebebd85c
Opcode Fuzzy Hash: a4ca91375b1ae48df5b0da444fc155f7a749ab565cde4b5011a20c6dbe2ae2cb
Instruction Fuzzy Hash: EBC09B70604006D5E7445AF18F4CE7762A4AB00344F21587BD423F11D0E77CC90DE55F

Function 00402B29 Relevance: 1.5, APIs: 1, Instructions: 8registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?), ref: 0040DCE6

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6fb5030cd6d02b56b4f4ee684287976b82e9531fbc7d777f7057e3647383cb56
Instruction ID: 8635ef17eb87a6fa1683b5c13994e317c9430567dcd03a3e9d2935e20f46cfb9
Opcode Fuzzy Hash: 6fb5030cd6d02b56b4f4ee684287976b82e9531fbc7d777f7057e3647383cb56
Instruction Fuzzy Hash: AFC00235C44518EBDB025F80EE444ADBB31FB94301F2081B9E596704B4CB750569EB09

Function 0040D03D Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32 ref: 0040D03D

Memory Dump Source

Source File: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: d33c57a1c550a21814bb0d0fc188fc6680594cae9ec31c7a46f1f268c448e4ef
Instruction ID: 25e1d9e9ad01641672f70a648d400c2c205f88fe579fe882400fd4a0b89cadbd
Opcode Fuzzy Hash: d33c57a1c550a21814bb0d0fc188fc6680594cae9ec31c7a46f1f268c448e4ef
Instruction Fuzzy Hash: 239002201144128AC6900E145B9D018366351403163610439D686E00E1CA745449B51E

Function 0040D546 Relevance: 1.5, APIs: 1, Instructions: 3fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 0040D546

Memory Dump Source

Source File: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 5a7f7034557199b2680d4462fdba19ae2dda59a6c23bbc44dfa5c954e8afdf10
Instruction ID: e8b56d19b771765b7ca581a4eb69960d085d1c3f4a7590a9df08b4ab2132a189
Opcode Fuzzy Hash: 5a7f7034557199b2680d4462fdba19ae2dda59a6c23bbc44dfa5c954e8afdf10
Instruction Fuzzy Hash: 2B9002302081019AE2011A215B4C719276855046C531548796447E0090DE74844D651D

Function 0040212F Relevance: 1.3, APIs: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000040,0040909C), ref: 0040D483

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3ce7008aae3c15e0f6c62bd7475aff4cc5e106e967eb0c4da6065f06007ace48
Instruction ID: 3b0c9903b405788c4f8ba55d98c9f62a753efd871ddeee4c855e80a4a272a624
Opcode Fuzzy Hash: 3ce7008aae3c15e0f6c62bd7475aff4cc5e106e967eb0c4da6065f06007ace48
Instruction Fuzzy Hash: 6F012B31D00614BBE7205E64CD46B9A7779BB04B44F51403DEE15371C1C3B8AC5987D6

Function 00AD1160 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00AD0610: OpenEventA.KERNEL32(00100002,00000000,00000000,A7C02D40), ref: 00AD06B0
Part of subcall function 00AD0610: CloseHandle.KERNEL32(00000000), ref: 00AD06C5
Part of subcall function 00AD0610: ResetEvent.KERNEL32(00000000,A7C02D40), ref: 00AD06CF
Part of subcall function 00AD0610: CloseHandle.KERNEL32(00000000,A7C02D40), ref: 00AD0704

TlsSetValue.KERNEL32(00000029,?), ref: 00AD11AA

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: f1de9ab02fcea0e37b947cee87f3c38dab64dc311375733c3a51b17b53ee181b
Instruction ID: 997b85bda6cd22912377bf50a89e870c797289407ca5a222cc15229e699c80a0
Opcode Fuzzy Hash: f1de9ab02fcea0e37b947cee87f3c38dab64dc311375733c3a51b17b53ee181b
Instruction Fuzzy Hash: 45018F71A04248BFC710CF99DD45F5EBBA8FB09770F10472AF925D3380D77569008AA4

Function 004024E9 Relevance: 1.3, APIs: 1, Instructions: 12stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 004024E9

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 0fdbab3f11f60dd5e360b8eafbe38feaba4c970d5c95eeb566e8d1342a049495
Instruction ID: 281a21d4a294a1b2aaf0c05ee390f5ed9614b0b6553d6177e11b6688c48433d1
Opcode Fuzzy Hash: 0fdbab3f11f60dd5e360b8eafbe38feaba4c970d5c95eeb566e8d1342a049495
Instruction Fuzzy Hash: 3DC01230E48001EAE7045BD19F08A352A746A1074073284BBA403761D2D77D9F0A7A1E

Function 0040285F Relevance: 1.3, APIs: 1, Instructions: 5sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 0040285F

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8e4869885fb9d836e5875faa4fa33833557a1e0cdd57285ae0ad36391342807a
Instruction ID: eb94e4fe04d3d04e03cabf1a69d09960326077b20c4ce6e058a3003746771e35
Opcode Fuzzy Hash: 8e4869885fb9d836e5875faa4fa33833557a1e0cdd57285ae0ad36391342807a
Instruction Fuzzy Hash: 1FB01230504400E7C10007606F0CB1039206300308F240036A70A700E08675044A6A0E

Non-executed Functions

Function 6096748C Relevance: 131.0, APIs: 72, Strings: 2, Instructions: 1504COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609674C6

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_step.SQLITE3 ref: 6096755A
sqlite3_malloc.SQLITE3 ref: 6096783A
sqlite3_bind_int64.SQLITE3 ref: 609678A8
sqlite3_column_bytes.SQLITE3 ref: 609678E8
sqlite3_column_blob.SQLITE3 ref: 60967901
sqlite3_column_int64.SQLITE3 ref: 6096791A
sqlite3_column_int64.SQLITE3 ref: 60967931
sqlite3_column_int64.SQLITE3 ref: 60967950
sqlite3_step.SQLITE3 ref: 609679C3
sqlite3_bind_int64.SQLITE3 ref: 60967AA9
sqlite3_step.SQLITE3 ref: 60967AB4
sqlite3_column_int.SQLITE3 ref: 60967AC7
sqlite3_reset.SQLITE3 ref: 60967AD4
sqlite3_bind_int.SQLITE3 ref: 60967B89
sqlite3_step.SQLITE3 ref: 60967B94
sqlite3_column_int64.SQLITE3 ref: 60967BB0
sqlite3_column_int64.SQLITE3 ref: 60967BCF
sqlite3_column_int64.SQLITE3 ref: 60967BE6
sqlite3_column_bytes.SQLITE3 ref: 60967C05
sqlite3_column_blob.SQLITE3 ref: 60967C1E

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED50

sqlite3_bind_int64.SQLITE3 ref: 60967C72
sqlite3_step.SQLITE3 ref: 60967C7D
memcmp.MSVCRT ref: 60967D4C
sqlite3_free.SQLITE3 ref: 60967D69
sqlite3_free.SQLITE3 ref: 60967D74
sqlite3_free.SQLITE3 ref: 60967FF7
sqlite3_free.SQLITE3 ref: 60968002

Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621

sqlite3_reset.SQLITE3 ref: 60967C93

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_reset.SQLITE3 ref: 60967CA7
sqlite3_reset.SQLITE3 ref: 60968035
sqlite3_bind_int64.SQLITE3 ref: 60967B72

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6096809D
sqlite3_bind_int64.SQLITE3 ref: 609680C6
sqlite3_step.SQLITE3 ref: 609680D1
sqlite3_column_int.SQLITE3 ref: 609680F3
sqlite3_reset.SQLITE3 ref: 60968104
sqlite3_step.SQLITE3 ref: 60968139
sqlite3_column_int64.SQLITE3 ref: 60968151
sqlite3_reset.SQLITE3 ref: 6096818A

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED2B
Part of subcall function 6095ECA6: sqlite3_bind_value.SQLITE3 ref: 6095EDDF

sqlite3_reset.SQLITE3 ref: 609679E9

Part of subcall function 609160CD: sqlite3_realloc.SQLITE3 ref: 609160EF

sqlite3_column_bytes.SQLITE3 ref: 60967587

Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4

sqlite3_column_blob.SQLITE3 ref: 60967572

Part of subcall function 6091D57E: sqlite3_value_blob.SQLITE3 ref: 6091D596

sqlite3_reset.SQLITE3 ref: 609675B7
sqlite3_bind_int.SQLITE3 ref: 60967641
sqlite3_step.SQLITE3 ref: 6096764C
sqlite3_column_int64.SQLITE3 ref: 6096766E
sqlite3_reset.SQLITE3 ref: 6096768B
sqlite3_bind_int.SQLITE3 ref: 6096754F

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_bind_int.SQLITE3 ref: 609690B2
sqlite3_bind_blob.SQLITE3 ref: 609690DB
sqlite3_step.SQLITE3 ref: 609690E6
sqlite3_reset.SQLITE3 ref: 609690F1
sqlite3_free.SQLITE3 ref: 60969102
sqlite3_free.SQLITE3 ref: 6096910D

Strings

, xrefs: 60968643
d, xrefs: 6096875D

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_reset$sqlite3_step$sqlite3_column_int64sqlite3_free$sqlite3_bind_int64$sqlite3_bind_int$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mprintf$sqlite3_column_intsqlite3_mutex_leave$memcmpsqlite3_bind_blobsqlite3_bind_valuesqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_initializesqlite3_mutex_entersqlite3_prepare_v2sqlite3_reallocsqlite3_value_blobsqlite3_value_bytes
String ID: $d
API String ID: 2451604321-2084297493
Opcode ID: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction ID: 6b7ea73e19bc996eb6a422b8fcf26663d3cb25e4dd91ceba81a4d6a678ae72ab
Opcode Fuzzy Hash: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction Fuzzy Hash: 2CF2CF74A152288FDB54CF68C980B9EBBF2BF69304F1185A9E888A7341D774ED85CF41

Function 609660FA Relevance: 39.4, APIs: 19, Strings: 3, Instructions: 926COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 60966178
sqlite3_free.SQLITE3 ref: 60966183
sqlite3_value_numeric_type.SQLITE3 ref: 609661AE
sqlite3_value_numeric_type.SQLITE3 ref: 609661DE
sqlite3_value_text.SQLITE3 ref: 60966236
sqlite3_value_int.SQLITE3 ref: 60966274
memcmp.MSVCRT ref: 6096639E

Part of subcall function 60940A5B: sqlite3_malloc.SQLITE3 ref: 60940AA1
Part of subcall function 60940A5B: sqlite3_free.SQLITE3 ref: 60940C1D

sqlite3_mprintf.SQLITE3 ref: 60966B51
sqlite3_mprintf.SQLITE3 ref: 60966B7D

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

Strings

x, xrefs: 609664F1
DESC, xrefs: 60966CB3
ASC, xrefs: 60966CA5

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_numeric_type$memcmpsqlite3_finalizesqlite3_initializesqlite3_mallocsqlite3_value_intsqlite3_value_textsqlite3_vmprintf
String ID: ASC$DESC$x
API String ID: 4082667235-1162196452
Opcode ID: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction ID: 01f4316cc9c65235d83944c747b96ccca9397e1276bdc6c450b31a73d7ca280a
Opcode Fuzzy Hash: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction Fuzzy Hash: AD921274A14319CFEB10CFA9C99079DBBB6BF69304F20816AD858AB342D774E985CF41

Function 6096923E Relevance: 29.3, APIs: 19, Instructions: 779COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,?), ref: 609693A5
sqlite3_step.SQLITE3(?,?), ref: 609693B0
sqlite3_column_int64.SQLITE3(?,?), ref: 609693DC

Part of subcall function 6096A2BD: sqlite3_bind_int64.SQLITE3 ref: 6096A322
Part of subcall function 6096A2BD: sqlite3_step.SQLITE3 ref: 6096A32D
Part of subcall function 6096A2BD: sqlite3_column_int.SQLITE3 ref: 6096A347
Part of subcall function 6096A2BD: sqlite3_reset.SQLITE3 ref: 6096A354

sqlite3_reset.SQLITE3(?,?), ref: 609693F3
sqlite3_malloc.SQLITE3(?), ref: 60969561
sqlite3_malloc.SQLITE3(?), ref: 6096958D
sqlite3_step.SQLITE3(?), ref: 609695D2
sqlite3_column_int64.SQLITE3(?), ref: 609695EA
sqlite3_reset.SQLITE3(?), ref: 60969604
sqlite3_realloc.SQLITE3(?), ref: 609697D0
sqlite3_realloc.SQLITE3(?), ref: 609698A9

Part of subcall function 609129D5: sqlite3_initialize.SQLITE3(?,?,?,60915F55,?,?,?,?,?,?,00000000,?,?,?,60915FE2,00000000), ref: 609129E0

sqlite3_bind_int64.SQLITE3(?,?), ref: 609699B8
sqlite3_bind_int64.SQLITE3(?), ref: 6096934D

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3(?,?), ref: 60969A6A
sqlite3_step.SQLITE3(?,?), ref: 60969A75
sqlite3_reset.SQLITE3(?,?), ref: 60969A80
sqlite3_free.SQLITE3(?), ref: 60969D41
sqlite3_free.SQLITE3(?), ref: 60969D4C
sqlite3_free.SQLITE3(?), ref: 60969D5B

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_freesqlite3_resetsqlite3_step$sqlite3_column_int64sqlite3_mallocsqlite3_realloc$sqlite3_column_intsqlite3_initializesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2
String ID:
API String ID: 961572588-0
Opcode ID: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction ID: dba6eef834311e7f80380fc62c490a647dd1765b4da9a7e0a506f520bf28697a
Opcode Fuzzy Hash: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction Fuzzy Hash: 9872F275A042298FDB24CF69C88078DB7F6FF98314F1586A9D889AB341D774AD81CF81

Function 60963143 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60963159
sqlite3_bind_int64.SQLITE3 ref: 609633E6
sqlite3_mutex_leave.SQLITE3 ref: 609634B6

Strings

indexed, xrefs: 609631F0
foreign key, xrefs: 609631B8
2, xrefs: 60963403

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leavesqlite3_stricmp
String ID: 2$foreign key$indexed
API String ID: 4126863092-702264400
Opcode ID: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction ID: 3d5d194cd292e354de8359ea213fef7e5121ae3f60f7d2d7ba557b44893e8b9c
Opcode Fuzzy Hash: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction Fuzzy Hash: 6BE1B374A142099FDB04CFA8D590A9DBBF2BFA9304F21C129E855AB754DB35ED82CF40

Function 6093323D Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 609334A2
sqlite3_stricmp.SQLITE3 ref: 609334BB

Strings

ORDER BY, xrefs: 60933671
DISTINCT, xrefs: 60933658
USING COVERING INDEX , xrefs: 609333F7

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: USING COVERING INDEX $DISTINCT$ORDER BY
API String ID: 912767213-1308749736
Opcode ID: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction ID: 4f43644a9add5c5df618cbd47cd61ce2203d262f2077f605e752fe25420d36ab
Opcode Fuzzy Hash: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction Fuzzy Hash: 2412D674A08268CFDB25DF28C880B5AB7B3AFA9314F1085E9E8899B355D774DD81CF41

Function 6094B407 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B488
sqlite3_step.SQLITE3 ref: 6094B496
sqlite3_reset.SQLITE3 ref: 6094B4A4
sqlite3_bind_int64.SQLITE3 ref: 6094B4D2
sqlite3_step.SQLITE3 ref: 6094B4E0
sqlite3_reset.SQLITE3 ref: 6094B4EE

Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$memmove
String ID:
API String ID: 4082478743-0
Opcode ID: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
Instruction ID: 9e7f29540a3c6f2d28ce6b101cd1a975f5529a8f599b89b7128c34d749e8d9ce
Opcode Fuzzy Hash: aa77e302053f557c70a8d8c80c1bb3ccc0b69d7e46be98bddd9db9cb48891f7f
Instruction Fuzzy Hash: DD41D2B4A087018FCB50DF69C484A9EB7F6EFA8364F158929EC99CB315E734E8418F51

Function 00ACF8C0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00AC8ACE: __EH_prolog.LIBCMT ref: 00AC8AD3
Part of subcall function 00AC8ACE: _Allocate.LIBCPMT ref: 00AC8B2A
Part of subcall function 00AC8ACE: _memmove.LIBCMT ref: 00AC8B81

_memset.LIBCMT ref: 00ACF939
FormatMessageA.KERNEL32(00001200,00000000,?,00000400,?,00000010,00000000), ref: 00ACF9A2
GetLastError.KERNEL32(?,00000400,?,00000010,00000000), ref: 00ACF9AA

Strings

Unknown error, xrefs: 00ACF9F9
invalid string position, xrefs: 00ACFAF6

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AllocateErrorFormatH_prologLastMessage_memmove_memset
String ID: Unknown error$invalid string position
API String ID: 1854462395-1837348584
Opcode ID: 81e900d060bb4a184b09393951791c1935437ea024094eabeb39eb63bc84881b
Instruction ID: e502dc3104c80948fc0e5c6e18bed26c7787c1e66359348b8f57daab70b0a4e5
Opcode Fuzzy Hash: 81e900d060bb4a184b09393951791c1935437ea024094eabeb39eb63bc84881b
Instruction Fuzzy Hash: 8051CD702083419FEB14DF25C890F2EFBE5BB98384F51492DF486972A2D771E688CB52

Function 6094D33B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6094D354
sqlite3_mutex_leave.SQLITE3 ref: 6094D546

Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905D8B
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DA4
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DB8

sqlite3_stricmp.SQLITE3 ref: 6094D3DA

Strings

INTEGER, xrefs: 6094D462
BINARY, xrefs: 6094D45D, 6094D469

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$INTEGER
API String ID: 317512412-1676293250
Opcode ID: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction ID: cace79839434994537c0410bddb438ad3d501bddbf1b20fcc6a8a8bdb5da7fdd
Opcode Fuzzy Hash: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction Fuzzy Hash: 8E712978A056099BDB05CF69C49079EBBF2BFA8308F11C529EC55AB3A4D734E941CF80

Function 6093F42E Relevance: 6.4, APIs: 4, Instructions: 416COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6093F443

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093F45C

Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA

sqlite3_mutex_leave.SQLITE3 ref: 6093F8CD
sqlite3_mutex_leave.SQLITE3 ref: 6093F8E3

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: memcmpsqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
String ID:
API String ID: 4038589952-0
Opcode ID: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction ID: 916146ddc5613ce70bfe97dc7fabc38680eb49f4f4fdba01105907ea2da9c682
Opcode Fuzzy Hash: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction Fuzzy Hash: 87F13674A046158FDB18CFA9C590A9EB7F7AFA8308F248429E846AB355D774EC42CF40

Function 6096A38C Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int.SQLITE3 ref: 6096A3DE

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_column_int.SQLITE3 ref: 6096A3F3
sqlite3_step.SQLITE3 ref: 6096A435
sqlite3_reset.SQLITE3 ref: 6096A445

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 247099642-0
Opcode ID: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction ID: 69535c0605dcb565d56369453fd68d3a3097adfd173720c6e67b3d4aca8354ad
Opcode Fuzzy Hash: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction Fuzzy Hash: FF2151B0A143148BEB109FA9D88479EB7FAEF64308F00852DE89597350EBB8D845CF51

Function 6096A2BD Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6096A322

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 6096A32D
sqlite3_column_int.SQLITE3 ref: 6096A347

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_reset.SQLITE3 ref: 6096A354

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2sqlite3_resetsqlite3_stepsqlite3_value_int
String ID:
API String ID: 326482775-0
Opcode ID: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction ID: 7c1586c82cd56d85cf32929a5cd575737867df940847ca2bf63216634e784e33
Opcode Fuzzy Hash: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction Fuzzy Hash: 0E214DB0A043049BDB04DFA9C480B9EF7FAEFA8354F04C429E8959B340E778D8418B51

Function 00402812 Relevance: 3.0, APIs: 2, Instructions: 49stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 00402812
StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040DB4C

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CtrlDispatcherServiceStartlstrcmpi
String ID:
API String ID: 369133424-0
Opcode ID: 19f33190339a63abe3a9505e4355435bacf459e85c5e85cb8b10554e4ec765f4
Instruction ID: ec956724a50360e97931a20e988376dad2b8d1267c184e83f8c01ca4eba41c76
Opcode Fuzzy Hash: 19f33190339a63abe3a9505e4355435bacf459e85c5e85cb8b10554e4ec765f4
Instruction Fuzzy Hash: B501D621F0C2808AD7018BB1BE157E67FA45646320755053BC9C3F61E3D238880EEB2D

Function 6090C1D6 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6090C1EA
sqlite3_mutex_leave.SQLITE3 ref: 6090C22F

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction ID: fc120f7ed3300d8301d0f99cb769197b575d5683181bd6b289e4b53452841bc5
Opcode Fuzzy Hash: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction Fuzzy Hash: 6501F4715042548BDB449F2EC4C576EBBEAEF65318F048469DD419B326D374D882CBA1

Function 00AD80DA Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00AD3AF6,?,?,?,00000000), ref: 00AD80DF
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 00AD80E8

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c4a543cce49f51744cc43e5fe47745890e144c9cac899c18677c059b51bf3a02
Instruction ID: 2ad340c7269d0312a6319c2417ba7a24bf7bb03543787e303f57566acac897c9
Opcode Fuzzy Hash: c4a543cce49f51744cc43e5fe47745890e144c9cac899c18677c059b51bf3a02
Instruction Fuzzy Hash: 8DB09231844648AFCB00ABE2FC59B583F28FB0479AF844010F60E480608B6256129BD2

Function 609254B1 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925508

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction ID: ad89f0bb34aa7175efe61e1ac22fb0c12735e6005c3b9edbf096fd229bca234b
Opcode Fuzzy Hash: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction Fuzzy Hash: 5A01A475B107148BCB109F2ACC8164BBBFAEF68254F05991AEC41DB315D775ED458BC0

Function 0040D6C1 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0040DB4C

Memory Dump Source

Source File: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: 8f3c7179455beb700aa62cfc260397040c6e92bf3d65bdc8d8f064786a4936ea
Instruction ID: 07f8ba0d230807385da1a2f011c9864bcf2bf347454c2d9b5b832fe3cc69c9c7
Opcode Fuzzy Hash: 8f3c7179455beb700aa62cfc260397040c6e92bf3d65bdc8d8f064786a4936ea
Instruction Fuzzy Hash: 66F0C821E082808BE704CF71AE547A7BFB4A646320715417BC993F61A3D338890EEF2D

Function 00ACE850 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00ACE864

Part of subcall function 00ACE6EB: _memmove.LIBCMT ref: 00ACE7A9

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: _memmove_memset
String ID:
API String ID: 3555123492-0
Opcode ID: 50ed358c2bc5baa28b61a63f85c8bcfb39f11c9cdbb9bf2bbec23c38127e8fb6
Instruction ID: b081c897ebb0e2f708aae6e7b54b56cb6711099014f5315ac18a082da8c04b5b
Opcode Fuzzy Hash: 50ed358c2bc5baa28b61a63f85c8bcfb39f11c9cdbb9bf2bbec23c38127e8fb6
Instruction Fuzzy Hash: 6AF082B2904309ABD714DF95DA42B8DFBB8EB44310F20816AE508A7381E6707A118B91

Function 004026EC Relevance: 1.5, APIs: 1, Instructions: 10serviceCOMMON

Download Yara Rule

APIs

CreateServiceA.ADVAPI32 ref: 004026EC

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: CreateService
String ID:
API String ID: 1592570254-0
Opcode ID: 62ab1a5cb7093f4c726efbc204c75fc46d0980a7a6192d4040200593d067ca4e
Instruction ID: f39f3afa731ec194884b7d0413bf91e3e0c9854ed3c48728941825add0444bec
Opcode Fuzzy Hash: 62ab1a5cb7093f4c726efbc204c75fc46d0980a7a6192d4040200593d067ca4e
Instruction Fuzzy Hash: BAC04CB1D08005EACE154FA09F4C839363553553207728876E057B71D0C77D6E5FB66E

Function 6090F435 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction ID: aa639d4c52eda77921d109c173628d401b16d57fa3137d2b917a91732d8775c8
Opcode Fuzzy Hash: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction Fuzzy Hash: D7C01265704208574B00E92DE8C154577AA9718164B108039E80B87301D975ED084291

Function 6092642A Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 184COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609264C9
sqlite3_free.SQLITE3 ref: 60926526
sqlite3_free.SQLITE3 ref: 6092652E
sqlite3_free.SQLITE3 ref: 60926550

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

Part of subcall function 6090AFF5: sqlite3_free.SQLITE3 ref: 6090B09A

sqlite3_free.SQLITE3 ref: 60926626
sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6092662E
sqlite3_free.SQLITE3 ref: 60926638
sqlite3_snprintf.SQLITE3 ref: 6092666B
sqlite3_free.SQLITE3 ref: 60926673
sqlite3_snprintf.SQLITE3 ref: 609266B8

Strings

winFullPathname1, xrefs: 609264DE
\, xrefs: 6092668B
winFullPathname4, xrefs: 6092660B
winFullPathname3, xrefs: 609265A1
winFullPathname2, xrefs: 60926543

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_mbcs_to_utf8
String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 937752868-2111127023
Opcode ID: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
Instruction ID: 28f04709130b2e8b140c84fcd32bad5e17fba194e1ccee1aab8ced89c5ccf9cf
Opcode Fuzzy Hash: 76700054f020c8d7fe753577c30eef17e659d67ca67044e42639e839992701d7
Instruction Fuzzy Hash: EA712E706183058FE700AF69D88465DBFF6AFA5748F00C82DE8999B314E778C845DF92

Function 00AC24E1 Relevance: 21.2, APIs: 14, Instructions: 173COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC24E6
InterlockedCompareExchange.KERNEL32(?,00000000,00000001), ref: 00AC24FC
RtlEnterCriticalSection.NTDLL(?), ref: 00AC250E
RtlLeaveCriticalSection.NTDLL(?), ref: 00AC256D
SetLastError.KERNEL32(00000000,?,7591DFB0), ref: 00AC257F
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?,7591DFB0), ref: 00AC2599
GetLastError.KERNEL32(?,7591DFB0), ref: 00AC25A2
InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00AC25F0
InterlockedDecrement.KERNEL32(00000002), ref: 00AC262F
InterlockedExchange.KERNEL32(00000000,00000000), ref: 00AC268E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC2699
InterlockedExchange.KERNEL32(00000000,00000001), ref: 00AC26AD
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,7591DFB0), ref: 00AC26BD
GetLastError.KERNEL32(?,7591DFB0), ref: 00AC26C7

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$ErrorLast$CompareCompletionCriticalQueuedSectionStatus$DecrementEnterH_prologLeavePost
String ID:
API String ID: 1213838671-0
Opcode ID: 4b5d803f69c235caaefcf6c30df30564c7e3f100bb4379b85b574fe4a71dd5a2
Instruction ID: 58e967f0bd55fefc990650fcaed8c692d923a8d3de655cde50ba830ff0a4c44b
Opcode Fuzzy Hash: 4b5d803f69c235caaefcf6c30df30564c7e3f100bb4379b85b574fe4a71dd5a2
Instruction Fuzzy Hash: 44610771900649AFCB14DFA4D988FAEBBB9FF08314F11452EE516E7250EB349A45CBA0

Function 00AC4603 Relevance: 19.9, APIs: 13, Instructions: 442networkCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC4608

Part of subcall function 00AD27B5: _malloc.LIBCMT ref: 00AD27CD

htons.WS2_32(?), ref: 00AC4669
htonl.WS2_32(?), ref: 00AC468C
htonl.WS2_32(00000000), ref: 00AC4693
htons.WS2_32(00000000), ref: 00AC4747
_sprintf.LIBCMT ref: 00AC475D

Part of subcall function 00AC7981: _memmove.LIBCMT ref: 00AC79A1

htons.WS2_32(?), ref: 00AC46B0

Part of subcall function 00AC872C: __EH_prolog.LIBCMT ref: 00AC8731
Part of subcall function 00AC872C: RtlEnterCriticalSection.NTDLL(00000020), ref: 00AC87AC
Part of subcall function 00AC872C: RtlLeaveCriticalSection.NTDLL(00000020), ref: 00AC87CA

Part of subcall function 00AC1BA7: __EH_prolog.LIBCMT ref: 00AC1BAC
Part of subcall function 00AC1BA7: RtlEnterCriticalSection.NTDLL ref: 00AC1BBC
Part of subcall function 00AC1BA7: RtlLeaveCriticalSection.NTDLL ref: 00AC1BEA
Part of subcall function 00AC1BA7: RtlEnterCriticalSection.NTDLL ref: 00AC1C13
Part of subcall function 00AC1BA7: RtlLeaveCriticalSection.NTDLL ref: 00AC1C56

Part of subcall function 00ACCEE8: __EH_prolog.LIBCMT ref: 00ACCEED

htonl.WS2_32(?), ref: 00AC497C
htonl.WS2_32(00000000), ref: 00AC4983
htonl.WS2_32(00000000), ref: 00AC49C8
htonl.WS2_32(00000000), ref: 00AC49CF
htons.WS2_32(?), ref: 00AC49EF
htons.WS2_32(?), ref: 00AC49F9

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSectionhtonl$htons$H_prolog$EnterLeave$_malloc_memmove_sprintf
String ID:
API String ID: 1645262487-0
Opcode ID: e4ec5d61b3795776324b1f3ac52b44f6ed82ec8d59eb47b2d5ad70819172357f
Instruction ID: 2a06b8f9fc7888a1dd07164313aad3970350b7f25e0873d891d92702fc4aed52
Opcode Fuzzy Hash: e4ec5d61b3795776324b1f3ac52b44f6ed82ec8d59eb47b2d5ad70819172357f
Instruction Fuzzy Hash: B7025472C00259EEDF15DFA4C955FEEBBB8AF08304F11415EE505B7281EBB45A88CBA1

Function 004023B3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 75registrysynchronizationthreadCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32(EarnPackage,Function_0000235E), ref: 004023C1
SetServiceStatus.ADVAPI32(0040C448), ref: 00402420
GetLastError.KERNEL32 ref: 00402422
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 0040242F
GetLastError.KERNEL32 ref: 00402450
SetServiceStatus.ADVAPI32(0040C448), ref: 00402480
CreateThread.KERNEL32(00000000,00000000,Function_000022CB,00000000,00000000,00000000), ref: 0040248C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00402495
CloseHandle.KERNEL32 ref: 004024A1
SetServiceStatus.ADVAPI32(0040C448), ref: 004024CA

Strings

EarnPackage, xrefs: 004023BC

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Service$Status$CreateErrorLast$CloseCtrlEventHandleHandlerObjectRegisterSingleThreadWait
String ID: EarnPackage
API String ID: 3346042915-1697690530
Opcode ID: f385e6d1f199bab6c91e86b4ba37154093ba76cc7960b6dc99dda6db9078c1ef
Instruction ID: 2b24e818b802c34ccfa0ad4216f4227abf39361b262b0d10b52f969d0cfb4784
Opcode Fuzzy Hash: f385e6d1f199bab6c91e86b4ba37154093ba76cc7960b6dc99dda6db9078c1ef
Instruction Fuzzy Hash: AB21EA70401244EBC210AF26EFE8A267FBCFB86758711423EE104B62B2C7B91448CF6D

Function 00AD6EE0 Relevance: 18.1, APIs: 12, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?), ref: 00AD6EE8
_free.LIBCMT ref: 00AD6F01

Part of subcall function 00AD1F74: HeapFree.KERNEL32(00000000,00000000,?,00AD4932,00000000,?,?,?,00000000,?,00AD7565,00000018,00AEF398,00000008,00AD74B2,?), ref: 00AD1F88
Part of subcall function 00AD1F74: GetLastError.KERNEL32(00000000,?,00AD4932,00000000,?,?,?,00000000,?,00AD7565,00000018,00AEF398,00000008,00AD74B2,?,?), ref: 00AD1F9A

_free.LIBCMT ref: 00AD6F14
_free.LIBCMT ref: 00AD6F32
_free.LIBCMT ref: 00AD6F44
_free.LIBCMT ref: 00AD6F55
_free.LIBCMT ref: 00AD6F60
_free.LIBCMT ref: 00AD6F84
RtlEncodePointer.NTDLL(007F96C8), ref: 00AD6F8B
_free.LIBCMT ref: 00AD6FA0
_free.LIBCMT ref: 00AD6FB6
_free.LIBCMT ref: 00AD6FDE

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: fcd408e06fefa5dc92b9e48482e55aa32a07a4a580efec5b4f1166fb315d4ffe
Instruction ID: 92518f66e1b61349929f72a55e699f8e0047bc7607c4aad4c16e6aa6e2d0135d
Opcode Fuzzy Hash: fcd408e06fefa5dc92b9e48482e55aa32a07a4a580efec5b4f1166fb315d4ffe
Instruction Fuzzy Hash: 81217F76904611EFCB10EFE5FC4096A7BA4EB0C725319012BF90697361CB3A6D46CB54

Function 609602C8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_malloc.SQLITE3 ref: 60960384
sqlite3_free.SQLITE3 ref: 609605EA
sqlite3_result_error_code.SQLITE3 ref: 6096060D
sqlite3_free.SQLITE3 ref: 60960618
sqlite3_result_text.SQLITE3 ref: 6096063C

Strings

offsets, xrefs: 609602DF

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_result_error_code$sqlite3_bind_int64sqlite3_mallocsqlite3_mprintfsqlite3_resetsqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: offsets
API String ID: 463808202-2642679573
Opcode ID: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction ID: 1101d6838161b799219a4b3d5732631e197d31251dd2d8b91c34f261bd2faa79
Opcode Fuzzy Hash: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction Fuzzy Hash: 72C1D374A183198FDB14CF59C580B8EBBF2BFA8314F2085A9E849AB354D734D985CF52

Function 00406CB7 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00408660,00000001,00000000,00000000,00000103,00000001,00000000,?,00406777,00200020,00000000,?,00000000,00000000), ref: 00406CF9
LCMapStringA.KERNEL32(00000000,00000100,0040865C,00000001,00000000,00000000,?,00406777,00200020,00000000,?,00000000,00000000,00000001), ref: 00406D15
LCMapStringA.KERNEL32(?,?,?,?,wg@ ,?,00000103,00000001,00000000,?,00406777,00200020,00000000,?,00000000,00000000), ref: 00406D5E
MultiByteToWideChar.KERNEL32(00000000,00000002,00000000,00200020,00000000,00000000,00000103,00000001,00000000,?,00406777,00200020,00000000,?,00000000,00000000), ref: 00406D96
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406DEE
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406E04
LCMapStringW.KERNEL32(?,?,?,00000000,wg@ ,?,?,00406777,00200020,00000000,?,00000000), ref: 00406E37
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406E9F

Strings

wg@ , xrefs: 00406EB7, 00406E2A, 00406D4F

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: wg@
API String ID: 352835431-1361311057
Opcode ID: 90a8fa97d36a721e2d6ab5922b5087c3305d1be29b7bad3f41316c8b0411f8bc
Instruction ID: fe6855d79e8c2ab70f35807f81e4dd336cad5c061b1918125c8d30b56be68ba4
Opcode Fuzzy Hash: 90a8fa97d36a721e2d6ab5922b5087c3305d1be29b7bad3f41316c8b0411f8bc
Instruction Fuzzy Hash: 14514A75500609EFCF228F64CD45A9B7FB9FB48750F11412AF912B21A0D73A8921DBA9

Function 6091A3AA Relevance: 16.7, APIs: 11, Instructions: 175COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A3C1
sqlite3_value_bytes.SQLITE3 ref: 6091A3D6
sqlite3_value_text.SQLITE3 ref: 6091A3E4
sqlite3_value_bytes.SQLITE3 ref: 6091A416
sqlite3_value_text.SQLITE3 ref: 6091A424
sqlite3_value_bytes.SQLITE3 ref: 6091A43A
sqlite3_result_text.SQLITE3 ref: 6091A5A2

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_text
String ID:
API String ID: 2903785150-0
Opcode ID: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction ID: 050d84d3da0bd462ad4a4a15df4a38950001fc66f1de33c81d7c2c3a6f7146e7
Opcode Fuzzy Hash: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction Fuzzy Hash: 8971D074E086599FCF00DFA8C88069DBBF2BF59314F1485AAE855AB304E734EC85CB91

Function 00AC3423 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 94libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC3428
GetModuleHandleA.KERNEL32(KERNEL32,CancelIoEx), ref: 00AC346B
GetProcAddress.KERNEL32(00000000), ref: 00AC3472
GetLastError.KERNEL32 ref: 00AC3486
InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 00AC34D7
RtlEnterCriticalSection.NTDLL(00000018), ref: 00AC34ED
RtlLeaveCriticalSection.NTDLL(00000018), ref: 00AC3518

Strings

CancelIoEx, xrefs: 00AC3461
KERNEL32, xrefs: 00AC3466

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSection$AddressCompareEnterErrorExchangeH_prologHandleInterlockedLastLeaveModuleProc
String ID: CancelIoEx$KERNEL32
API String ID: 2902213904-434325024
Opcode ID: 698a63fc4087d9ca138ea4f54b081b562873610e063a2718b1feceb7e0386b12
Instruction ID: a272234a44558163638885087165a48614e9797a36411ead6be7a770ad21f2bd
Opcode Fuzzy Hash: 698a63fc4087d9ca138ea4f54b081b562873610e063a2718b1feceb7e0386b12
Instruction Fuzzy Hash: FB319CB2A00345DFCF01DFA4D994BAA7BF8FF48351F12846DE8059B241C7709A01CBA1

Function 004069D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,?,004047E1,?,Microsoft Visual C++ Runtime Library,00012010,?,00408594,?,004085E4,?,?,?,Runtime Error!Program: ), ref: 004069EA
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 00406A02
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 00406A13
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00406A20

Strings

GetActiveWindow, xrefs: 00406A0D
MessageBoxA, xrefs: 004069FC
user32.dll, xrefs: 004069E5
GetLastActivePopup, xrefs: 00406A15

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: b9c1259c1cb1f605bc636feccf2df680feb13b65237f80a844e963b352f268a2
Instruction ID: ffd0cac4d9863f26947955e4bd001732738a03bdba65de71462ce1206f9d7c8b
Opcode Fuzzy Hash: b9c1259c1cb1f605bc636feccf2df680feb13b65237f80a844e963b352f268a2
Instruction Fuzzy Hash: E3015231700302DBC711EFB95FC0A1B6AD9DA9A780702543AAA45F3290DB7888119F6D

Function 6091C159 Relevance: 14.0, Strings: 11, Instructions: 290COMMON

Download Yara Rule

Strings

COVERING , xrefs: 6091C45B
AND , xrefs: 6091C363
%s USING %sINDEX %s%s, xrefs: 6091C460
)><, xrefs: 6091C392, 6091C434
SEARCH, xrefs: 6091C1A7, 6091C1D1
SCAN, xrefs: 6091C1C7
, xrefs: 6091C4F8
%s USING AUTOMATIC %sINDEX%.0s%s, xrefs: 6091C46E
ANY(, xrefs: 6091C375
0, xrefs: 6091C4E4
rowid, xrefs: 6091C317, 6091C3C1, 6091C400

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID:
String ID: $ AND $%s USING %sINDEX %s%s$%s USING AUTOMATIC %sINDEX%.0s%s$)><$0$ANY($COVERING $SCAN$SEARCH$rowid
API String ID: 0-780898
Opcode ID: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction ID: 1b008e11d07f16b9462ef115b46fd1892196ed4c5360d6a6f9a636b6bab85f9b
Opcode Fuzzy Hash: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction Fuzzy Hash: 46D109B0A087099FD714CF99C19079DBBF2BFA8308F10886AE495AB355D774D982CF81

Function 609061F1 Relevance: 13.9, Strings: 11, Instructions: 114COMMON

Download Yara Rule

Strings

buod, xrefs: 60906279
laer, xrefs: 609062A7
aolf, xrefs: 609062B0
txet, xrefs: 60906237
laer, xrefs: 60906261
aolf, xrefs: 6090626D
bolc, xrefs: 6090622F
bolb, xrefs: 6090623F
tni, xrefs: 6090628D
rahc, xrefs: 60906227
buod, xrefs: 609062B9

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID:
String ID: aolf$aolf$bolb$bolc$buod$buod$laer$laer$rahc$tni$txet
API String ID: 0-2604012851
Opcode ID: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction ID: a78f5df49eecf700eafad7d6eadd6707640e608d2d263d021760269e78388884
Opcode Fuzzy Hash: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction Fuzzy Hash: 2D31B171A891458ADB21891C85503EE7FBB9BE3344F28902EC8B2DB246C735CCD0C3A2

Function 6095F004 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6095F030
sqlite3_value_text.SQLITE3 ref: 6095F03E
sqlite3_stricmp.SQLITE3 ref: 6095F0B3
sqlite3_free.SQLITE3 ref: 6095F180

Part of subcall function 6092E279: strcmp.MSVCRT ref: 6092E2AE
Part of subcall function 6092E279: sqlite3_free.SQLITE3 ref: 6092E3A8

sqlite3_free.SQLITE3 ref: 6095F1BD

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_result_error_code.SQLITE3 ref: 6095F34E

Strings

|, xrefs: 6095F2F5

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_value_text$sqlite3_mutex_entersqlite3_result_error_codesqlite3_stricmpstrcmp
String ID: |
API String ID: 1576672187-2343686810
Opcode ID: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
Instruction ID: c4017fd8acd983bc841f22cdb0f4132ffe50c361176833da1127552c957ad2bb
Opcode Fuzzy Hash: 45796efa6547682f16092b9fa288c01422e20de86ab54653b6df12e990b05c38
Instruction Fuzzy Hash: B2B189B4A08308CBDB01CF69C491B9EBBF2BF68358F148968E854AB355D734EC55CB81

Function 6095D3BB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3 ref: 6095D450

Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375

sqlite3_snprintf.SQLITE3 ref: 6095D4A1
sqlite3_snprintf.SQLITE3 ref: 6095D525

Strings

sqlite_master, xrefs: 6095D57F
)><, xrefs: 6095D3ED
, xrefs: 6095D410
sqlite_temp_master, xrefs: 6095D58A

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_vsnprintf
String ID: $)><$sqlite_master$sqlite_temp_master
API String ID: 652164897-1572359634
Opcode ID: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
Instruction ID: a98725bc65f6cff0ffebef66634980575a39ba2d787d432de3c608a01e11e389
Opcode Fuzzy Hash: 7664a015b2dc01db37cf12657f922778db359f6c70a1ba93bfebbfbe3581116b
Instruction Fuzzy Hash: 5991F275E05219CFCB15CF98C48169DBBF2BFA9308F14845AE859AB314DB34ED46CB81

Function 00406B6E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,00408660,00000001,00000000,00000103,00000001,00000000,00406777,00200020,00000000,?,00000000,00000000,00000001), ref: 00406BAD
GetStringTypeA.KERNEL32(00000000,00000001,0040865C,00000001,?,?,00000000,00000000,00000001), ref: 00406BC7
GetStringTypeA.KERNEL32(00000000,00000000,?,00000000,00200020,00000103,00000001,00000000,00406777,00200020,00000000,?,00000000,00000000,00000001), ref: 00406BFB
MultiByteToWideChar.KERNEL32(wg@ ,00000002,?,00000000,00000000,00000000,00000103,00000001,00000000,00406777,00200020,00000000,?,00000000,00000000,00000001), ref: 00406C33
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001), ref: 00406C89
GetStringTypeW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000001), ref: 00406C9B

Strings

wg@ , xrefs: 00406C30

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: wg@
API String ID: 3852931651-1361311057
Opcode ID: 73c20b80408c2731150791a8f0ffb60182867dc759c5c37580ccdbae40419037
Instruction ID: 1c31e6e413092c9846e78d9c93f9d65032ee798690460e5d0fa75815d388fcd9
Opcode Fuzzy Hash: 73c20b80408c2731150791a8f0ffb60182867dc759c5c37580ccdbae40419037
Instruction Fuzzy Hash: BC418E71500659AFDF209F94DE85EAB3F79FB08354F11053AFA42F6290C73989208B99

Function 004046BD Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 0040472A
GetStdHandle.KERNEL32(000000F4,00408594,00000000,?,00000000,00000000), ref: 00404800
WriteFile.KERNEL32(00000000), ref: 00404807

Strings

Microsoft Visual C++ Runtime Library, xrefs: 004047D6
<program name unknown>, xrefs: 0040473A
Runtime Error!Program: , xrefs: 00404790
..., xrefs: 0040477C

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 4b4ea658e7e284681ff212f77686c73736e9dfb7762f9ff5dee007570cac2872
Instruction ID: 808e0fe921f43d1e0f8f8254dc1870b3a302d21f0365f7837a7e035085890952
Opcode Fuzzy Hash: 4b4ea658e7e284681ff212f77686c73736e9dfb7762f9ff5dee007570cac2872
Instruction Fuzzy Hash: 3931A6B2A00218AFDF24EA61CD45F9A776CEB8A304F10047FF545F71D1EA78AA44CA5D

Function 6091B05A Relevance: 12.3, APIs: 8, Instructions: 349COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091B06E
sqlite3_result_error_toobig.SQLITE3 ref: 6091B178
sqlite3_result_error_nomem.SQLITE3 ref: 6091B197
sqlite3_result_text.SQLITE3 ref: 6091B5A3

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
String ID:
API String ID: 2352520524-0
Opcode ID: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
Instruction ID: 99f21b63ad5c9672efebb0dd762c853f70c7e366ddc85f9db9da2d733c13ec0c
Opcode Fuzzy Hash: bf61c68f4ce88464188c3b4ec21cbec410585f797eaf5b0aff599f1fc01aebfc
Instruction Fuzzy Hash: F9E16B71E4C2199BDB208F18C89039EBBF7AB65314F1584DAE8A857351D738DCC19F82

Function 6096A481 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

sqlite3_exec.SQLITE3 ref: 6096A4D7

Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8

sqlite3_result_text.SQLITE3 ref: 6096A5D3

Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445

sqlite3_exec.SQLITE3 ref: 6096A523
sqlite3_exec.SQLITE3 ref: 6096A554
sqlite3_exec.SQLITE3 ref: 6096A57F
sqlite3_result_error_code.SQLITE3 ref: 6096A5E1

Strings

optimize, xrefs: 6096A498

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_exec$sqlite3_bind_intsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_resetsqlite3_result_error_codesqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: optimize
API String ID: 3659050757-3797040228
Opcode ID: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction ID: 653702cfcd2f061f0588c77de086fc27204f9fc351fc8b4992cba684a546c14d
Opcode Fuzzy Hash: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction Fuzzy Hash: E831C3B11187119FE310DF24C49570FBBE6ABA1368F10C91DF9968B350E7B9D8459F82

Function 609644FC Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609645D9

Part of subcall function 60928099: sqlite3_malloc.SQLITE3 ref: 609280ED

sqlite3_free.SQLITE3 ref: 609647C5

Part of subcall function 60963D35: memcmp.MSVCRT ref: 60963E74

sqlite3_free.SQLITE3 ref: 6096476B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6096477B
sqlite3_free.SQLITE3 ref: 60964783

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc$memcmpsqlite3_mutex_enter
String ID:
API String ID: 571598680-0
Opcode ID: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction ID: 53ad94a03898eae12f4127695087571842428d6fdffc19c65fee49adcf86f1ae
Opcode Fuzzy Hash: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction Fuzzy Hash: 5E91F674E14228CFEB14CFA9D890B9EBBB6BB99304F1085AAD849A7344D734DD81CF51

Function 00404002 Relevance: 12.1, APIs: 8, Instructions: 132COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00403394), ref: 0040401D
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00403394), ref: 00404031
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00403394), ref: 0040405D
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00403394), ref: 00404095
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00403394), ref: 004040B7
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00403394), ref: 004040D0
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00403394), ref: 004040E3
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 00404121

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 1df0f63653f2c582b1a59f9773a4f32edd17bab0814429921780f540f0098883
Instruction ID: 1fea9efe2a7337632a7950ca7a518bae1c26db98393e563ce5720337bd5df1fa
Opcode Fuzzy Hash: 1df0f63653f2c582b1a59f9773a4f32edd17bab0814429921780f540f0098883
Instruction Fuzzy Hash: 2331F4F25081256ED7303F74ADC883B769CEAD9344715053BF741F7281DA795C8242AE

Function 00AD0610 Relevance: 10.6, APIs: 7, Instructions: 132COMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00100002,00000000,00000000,A7C02D40), ref: 00AD06B0
CloseHandle.KERNEL32(00000000), ref: 00AD06C5
ResetEvent.KERNEL32(00000000,A7C02D40), ref: 00AD06CF
CloseHandle.KERNEL32(00000000,A7C02D40), ref: 00AD0704
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,A7C02D40), ref: 00AD077A
CloseHandle.KERNEL32(00000000), ref: 00AD078F

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateOpenReset
String ID:
API String ID: 1285874450-0
Opcode ID: 84120977ae938c5a8c157126985bf6441147431eecfbc824b9eeeca31f308437
Instruction ID: 5b98e620e0f7e148d76318b68e68db5b06587af2eb590d785e95187e1de76159
Opcode Fuzzy Hash: 84120977ae938c5a8c157126985bf6441147431eecfbc824b9eeeca31f308437
Instruction Fuzzy Hash: 52414E71D00748AFDF20DFA5DC49BADBBB8BF45714F10421AE81AAB380D770A905CBA1

Function 00AC2081 Relevance: 10.6, APIs: 7, Instructions: 116timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 00AC20AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 00AC20CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC20D8
InterlockedDecrement.KERNEL32(?), ref: 00AC213E
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000001F4,?), ref: 00AC217A
InterlockedDecrement.KERNEL32(?), ref: 00AC2187
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC21A6

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$Decrement$CompletionQueuedStatusTimerWaitable
String ID:
API String ID: 1171374749-0
Opcode ID: 7467983ef487f82f25ff61c647608b454785b7812a78996268f66dcc2e19a463
Instruction ID: 19f820d68c852164588a148e439506db99016ccf6e8b6a0dca32dbdab11e9199
Opcode Fuzzy Hash: 7467983ef487f82f25ff61c647608b454785b7812a78996268f66dcc2e19a463
Instruction Fuzzy Hash: 80414575504B41AFC320DF66D884E6BBBE9FBC8714F054A1EF49682251DB30E906CBA2

Function 00AD0722 Relevance: 10.6, APIs: 7, Instructions: 107synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00AD0ED0: OpenEventA.KERNEL32(00100002,00000000,?,?,?,00AD072E,?,?), ref: 00AD0EFF
Part of subcall function 00AD0ED0: CloseHandle.KERNEL32(00000000,?,?,00AD072E,?,?), ref: 00AD0F14
Part of subcall function 00AD0ED0: SetEvent.KERNEL32(00000000,00AD072E,?,?), ref: 00AD0F27

OpenEventA.KERNEL32(00100002,00000000,00000000,A7C02D40), ref: 00AD06B0
CloseHandle.KERNEL32(00000000), ref: 00AD06C5
ResetEvent.KERNEL32(00000000,A7C02D40), ref: 00AD06CF
CloseHandle.KERNEL32(00000000,A7C02D40), ref: 00AD0704
__CxxThrowException@8.LIBCMT ref: 00AD0735

Part of subcall function 00AD31BA: RaiseException.KERNEL32(?,?,00ACEB54,?,?,?,?,?,?,?,00ACEB54,?,00AEECA8,?), ref: 00AD320F

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,A7C02D40), ref: 00AD077A
CloseHandle.KERNEL32(00000000), ref: 00AD078F

Part of subcall function 00AD0C10: GetCurrentProcessId.KERNEL32(?), ref: 00AD0C69

WaitForSingleObject.KERNEL32(00000000,000000FF,A7C02D40), ref: 00AD079F

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Event$CloseHandle$Open$CreateCurrentExceptionException@8ObjectProcessRaiseResetSingleThrowWait
String ID:
API String ID: 2227236058-0
Opcode ID: e9688dc32bf8feabca6384cfad906d00def4d0e14d98e78f8f9b089b950d58fc
Instruction ID: a2c8542822ad1fd8c439df61823ce5159361e150137d2893a33794d05d95382d
Opcode Fuzzy Hash: e9688dc32bf8feabca6384cfad906d00def4d0e14d98e78f8f9b089b950d58fc
Instruction Fuzzy Hash: EC317C71D00749ABEF20DBE4DC89FADB7B8AF44710F14021AE81AEB381D770AD158B61

Function 609634F0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_blob_reopen.SQLITE3 ref: 60963510

Part of subcall function 60962F28: sqlite3_log.SQLITE3 ref: 60962F5D

sqlite3_mprintf.SQLITE3 ref: 60963534
sqlite3_blob_open.SQLITE3 ref: 6096358B
sqlite3_blob_bytes.SQLITE3 ref: 609635A3
sqlite3_malloc.SQLITE3 ref: 609635BB
sqlite3_blob_read.SQLITE3 ref: 60963602
sqlite3_free.SQLITE3 ref: 60963621

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_blob_bytessqlite3_blob_opensqlite3_blob_readsqlite3_blob_reopensqlite3_freesqlite3_logsqlite3_mallocsqlite3_mprintf
String ID:
API String ID: 4276469440-0
Opcode ID: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction ID: 177081cd506585250240414a33056f89eeda992db91a315aff795e5fc91eaf1e
Opcode Fuzzy Hash: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction Fuzzy Hash: C641E5B09087059FDB40DF29C48179EBBE6AF98354F01C87AE898DB354E734D841DB92

Function 6091A226 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A240
sqlite3_value_text.SQLITE3 ref: 6091A24E
sqlite3_value_bytes.SQLITE3 ref: 6091A25A
sqlite3_value_text.SQLITE3 ref: 6091A27C

Strings

ESCAPE expression must be a single character, xrefs: 6091A293
LIKE or GLOB pattern too complex, xrefs: 6091A267

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_bytes
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 4080917175-264706735
Opcode ID: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction ID: 7e7232241edcba55bc41816b79a09feadaac9d75cc2fb544db44a2248cbef301
Opcode Fuzzy Hash: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction Fuzzy Hash: A4214C74A182198BCB00DF79C88165EBBF6FF64354B108AA9E864DB344E734DCC6CB95

Function 609250BB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB

sqlite3_mutex_enter.SQLITE3 ref: 609250E7
sqlite3_value_text16.SQLITE3 ref: 60925100
sqlite3_value_text16.SQLITE3 ref: 6092512C
sqlite3_mutex_leave.SQLITE3 ref: 6092513E

Strings

out of memory, xrefs: 609250C6, 609250EC
library routine called out of sequence, xrefs: 609250D8

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: library routine called out of sequence$out of memory
API String ID: 2019783549-3029887290
Opcode ID: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction ID: f6310061860eb79c45c0a7b6efb00bde58ba827c5a391e7df96a4cb3fbc4cfa9
Opcode Fuzzy Hash: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction Fuzzy Hash: 81014C70A083049BDB14AF69C9C170EBBE6BF64248F0488A9EC958F30EE775D8818B51

Function 00AD49F4 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00AD49F4

Part of subcall function 00AD70B0: RtlEncodePointer.NTDLL(00000000), ref: 00AD70B3
Part of subcall function 00AD70B0: __initp_misc_winsig.LIBCMT ref: 00AD70CE
Part of subcall function 00AD70B0: GetModuleHandleW.KERNEL32(kernel32.dll,?,00AEF248,00000008,00000003,00AEEC8C,?,00000001), ref: 00AD7E33
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00AD7E47
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00AD7E5A
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00AD7E6D
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00AD7E80
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00AD7E93
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00AD7EA6
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00AD7EB9
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00AD7ECC
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00AD7EDF
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00AD7EF2
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00AD7F05
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00AD7F18
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00AD7F2B
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00AD7F3E
Part of subcall function 00AD70B0: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00AD7F51

__mtinitlocks.LIBCMT ref: 00AD49F9
__mtterm.LIBCMT ref: 00AD4A02

Part of subcall function 00AD4A6A: RtlDeleteCriticalSection.NTDLL(00000000), ref: 00AD74E6
Part of subcall function 00AD4A6A: _free.LIBCMT ref: 00AD74ED
Part of subcall function 00AD4A6A: RtlDeleteCriticalSection.NTDLL(00AF1978), ref: 00AD750F

__calloc_crt.LIBCMT ref: 00AD4A27
__initptd.LIBCMT ref: 00AD4A49
GetCurrentThreadId.KERNEL32 ref: 00AD4A50

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 1305bf0d7d2bf254eb588cc6eb2e6381b837265ed60640169b48f8542ca321b8
Instruction ID: 49e4a9993432cf976777d8fc37edc1ae7792e229990af7dd59e96406ac8364fe
Opcode Fuzzy Hash: 1305bf0d7d2bf254eb588cc6eb2e6381b837265ed60640169b48f8542ca321b8
Instruction Fuzzy Hash: 7FF06D32188B115FE628BBB87D0766A3A809F467B4B204A1BF467C67E5FF3188024598

Function 00AD24C1 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,00AD2473,00000000), ref: 00AD24DB
GetProcAddress.KERNEL32(00000000), ref: 00AD24E2
RtlEncodePointer.NTDLL(00000000), ref: 00AD24EE
RtlDecodePointer.NTDLL(00000001), ref: 00AD250B

Strings

RoInitialize, xrefs: 00AD24CA
combase.dll, xrefs: 00AD24D6

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: ebac165880838037c6c34b13e34d050028807bb566fc68e58d682711065520f2
Instruction ID: 08859a827c17d3b47ab55d2449432d4580da67180d5268f3b5ee0948144dfba1
Opcode Fuzzy Hash: ebac165880838037c6c34b13e34d050028807bb566fc68e58d682711065520f2
Instruction Fuzzy Hash: BFE01271990240BFDB20ABF1FC8DB353AB4B75475AF105520B201D91E0CBB94546CF10

Function 00AD2596 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00AD24B0), ref: 00AD25B0
GetProcAddress.KERNEL32(00000000), ref: 00AD25B7
RtlEncodePointer.NTDLL(00000000), ref: 00AD25C2
RtlDecodePointer.NTDLL(00AD24B0), ref: 00AD25DD

Strings

combase.dll, xrefs: 00AD25AB
RoUninitialize, xrefs: 00AD259F

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 98b6e202f39998ffe603b84ecdbd83c270de695e790909f330f4f11e9b0b7387
Instruction ID: 0be26e4f36ad317427047f195c4577fb83f83193e34e98a3afe8359c79b8d513
Opcode Fuzzy Hash: 98b6e202f39998ffe603b84ecdbd83c270de695e790909f330f4f11e9b0b7387
Instruction Fuzzy Hash: 95E0B670A40740AFDB20EBF0BD4DB263A64B718709F101914F206EA1B4DFBC5586CB14

Function 00AD0F30 Relevance: 10.2, APIs: 8, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000029,A7C02D40,?,?,?,?,00000000,00AE40D8,000000FF,00AD11CA), ref: 00AD0F6A
TlsSetValue.KERNEL32(00000029,00AD11CA,?,?,00000000), ref: 00AD0FD7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00AD1001
HeapFree.KERNEL32(00000000), ref: 00AD1004

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: HeapValue$FreeProcess
String ID:
API String ID: 1812714009-0
Opcode ID: 1e0d3b3af2df5205bf4d18c53cc33f394e9a5412e13bb0d20e609cf2bf713d31
Instruction ID: 08c7b79302b8c32137db5b269a0bbacbdd43b0806148ba183684f329b2100b8f
Opcode Fuzzy Hash: 1e0d3b3af2df5205bf4d18c53cc33f394e9a5412e13bb0d20e609cf2bf713d31
Instruction Fuzzy Hash: 8751D331904384AFD720EF68D988B2677E4FF48764F19865AF85A9B390D735EC40CB91

Function 00AE2C90 Relevance: 9.3, APIs: 6, Instructions: 276COMMONLIBRARYCODE

Download Yara Rule

APIs

_ValidateScopeTableHandlers.LIBCMT ref: 00AE2DA0
__FindPESection.LIBCMT ref: 00AE2DBA

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: FindHandlersScopeSectionTableValidate
String ID:
API String ID: 876702719-0
Opcode ID: 1f239299513cc05b34702cc1b298740de653f8f0fc68bec5fd59737cde43be33
Instruction ID: 41f4d231d516a10a95100760e5e1a3289e5a8b21c837e2fa9a444755eaae8f1d
Opcode Fuzzy Hash: 1f239299513cc05b34702cc1b298740de653f8f0fc68bec5fd59737cde43be33
Instruction Fuzzy Hash: 13A19371E006598FCB15CFAAD980BADBBB9FB44310F294669E905EB351E731EC41CB90

Function 60947378 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 609476DD

Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446

sqlite3_log.SQLITE3 ref: 609498F5

Strings

d, xrefs: 609474ED
List of tree roots: , xrefs: 60947599
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_freesqlite3_logsqlite3_mutex_leave
String ID: List of tree roots: $d$|
API String ID: 3709608969-1164703836
Opcode ID: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
Instruction ID: c91562837ba2d96ae21b52ab8334c840e7cbe23d8154f1acff92b465618a0bd4
Opcode Fuzzy Hash: 316fa83f4dc1e403b3b617744d66ff6f9af545e53e2752a9ff9486d467efffaf
Instruction Fuzzy Hash: 3FE10570A043698BDB22CF18C88179DFBBABF65304F1185D9E858AB251D775DE81CF81

Function 00AC1C91 Relevance: 9.0, APIs: 6, Instructions: 39synchronizationthreadinjectionCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 00AC1CB1
CloseHandle.KERNEL32(?), ref: 00AC1CBA
InterlockedExchangeAdd.KERNEL32(00AF5264,00000000), ref: 00AC1CC6
TerminateThread.KERNEL32(?,00000000), ref: 00AC1CD4
QueueUserAPC.KERNEL32(00AC1E7C,?,00000000), ref: 00AC1CE1
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00AC1CEC

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Wait$CloseExchangeHandleInterlockedMultipleObjectObjectsQueueSingleTerminateThreadUser
String ID:
API String ID: 1946104331-0
Opcode ID: 30195a94cbeec0d55cbc85b331b34165ca9f2549d6c0fa53cf0df66e9eea2521
Instruction ID: 40306fece0a63ba11690ad496afef92ac6f60c64703e222de5b0d338ed9e0eb4
Opcode Fuzzy Hash: 30195a94cbeec0d55cbc85b331b34165ca9f2549d6c0fa53cf0df66e9eea2521
Instruction Fuzzy Hash: E5F0A431A04644BFD7109BE5EC4DD5B7FBCEF86721700461DF529C61A0DB709801CBA0

Function 60960052 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_column_int64.SQLITE3 ref: 609600BA
sqlite3_column_text.SQLITE3 ref: 609600EF
sqlite3_free.SQLITE3 ref: 6096029A

Strings

e, xrefs: 60960227

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_resetsqlite3_result_error_codesqlite3_step
String ID: e
API String ID: 786425071-4024072794
Opcode ID: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction ID: e80500568aa73e744b5c90812a7938b6c4ac38b40afb48beb036dafaf3e7d002
Opcode Fuzzy Hash: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction Fuzzy Hash: 6291E270A18609CFDB04CF99C494B9EBBF2BF98314F108529E869AB354D774E885CF91

Function 0040430C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 0040432B
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00404360
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 004043C0

Strings

__MSVCRT_HEAP_SELECT, xrefs: 0040435B
__GLOBAL_HEAP_SELECTED, xrefs: 0040439A

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 58ca66314c6e6523d112f31b40a161e639e5c5e5cc0c8fdd41d9b20179a014b4
Instruction ID: 440e8359a9bd41544a90eb43b727e0322616448b85f146c99cf20e36fe429ed3
Opcode Fuzzy Hash: 58ca66314c6e6523d112f31b40a161e639e5c5e5cc0c8fdd41d9b20179a014b4
Instruction Fuzzy Hash: 8B312AF1A412986DEF3196705C41BDB37689B82704F2410FBE785F62C2D63C9E898B19

Function 609470DE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 6094716D

Strings

sqlite_master, xrefs: 609470E7
sqlite_temp_master, xrefs: 609470F1
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_exec
String ID: sqlite_master$sqlite_temp_master$|
API String ID: 2141490097-2247242311
Opcode ID: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction ID: 9143400cfb6dc20a8edc2ca7c04099347fc9d468871a1d2187ae3123f936d49a
Opcode Fuzzy Hash: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction Fuzzy Hash: C551B6B09083289BDB26CF18C885799BBFABF59304F108599E498A7351D775DA84CF41

Function 00AD0930 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00AD097F

Part of subcall function 00AD14D3: std::exception::_Copy_str.LIBCMT ref: 00AD14EC

Part of subcall function 00ACFD50: __CxxThrowException@8.LIBCMT ref: 00ACFDAE

std::exception::exception.LIBCMT ref: 00AD09DE

Strings

boost unique_lock has no mutex, xrefs: 00AD096E
boost unique_lock owns already the mutex, xrefs: 00AD09CD
$, xrefs: 00AD09E3

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Copy_strException@8Throwstd::exception::_
String ID: $$boost unique_lock has no mutex$boost unique_lock owns already the mutex
API String ID: 2140441600-46888669
Opcode ID: a40e6f0aa8156094a07db936cd8c1e64044b2b5764e3d7543f428066fa6e5828
Instruction ID: 77b98bef7f37045cd40a8ba67cc88fbfc25f8d9921e49ac81e7a5b7a7b17ad0d
Opcode Fuzzy Hash: a40e6f0aa8156094a07db936cd8c1e64044b2b5764e3d7543f428066fa6e5828
Instruction Fuzzy Hash: 61212BB14083809FD710DF25C559B5BBBE4BF84758F004E1EF4A687391D7B99808CB92

Function 00AD36DC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00AD36E0

Part of subcall function 00AD48D2: GetLastError.KERNEL32(00000000,?,00AD4AC0,00AD2033,00000000,?,00AD7678,?,?,?,00000000,?,00AD7565,00000018,00AEF398,00000008), ref: 00AD48D4
Part of subcall function 00AD48D2: __calloc_crt.LIBCMT ref: 00AD48F5
Part of subcall function 00AD48D2: __initptd.LIBCMT ref: 00AD4917
Part of subcall function 00AD48D2: GetCurrentThreadId.KERNEL32 ref: 00AD491E
Part of subcall function 00AD48D2: SetLastError.KERNEL32(00000000,00AD7678,?,?,?,00000000,?,00AD7565,00000018,00AEF398,00000008,00AD74B2,?,?,?,00AD47E8), ref: 00AD4936

__calloc_crt.LIBCMT ref: 00AD3703
__get_sys_err_msg.LIBCMT ref: 00AD3721
__invoke_watson.LIBCMT ref: 00AD373E

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00AD36EB, 00AD3711

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt$CurrentThread__get_sys_err_msg__getptd_noexit__initptd__invoke_watson
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 109275364-798102604
Opcode ID: b72d2af984dcf39ca78f89369aeb5b7e24fa562930509a61565d4efecafac7a7
Instruction ID: 5d69eab23afe0a2b1b4ad5e670f2c78c574db8836ef137f2d8e8dbf91d030593
Opcode Fuzzy Hash: b72d2af984dcf39ca78f89369aeb5b7e24fa562930509a61565d4efecafac7a7
Instruction Fuzzy Hash: D6F0B4B3A44E147BAF216B2A5D4196B729CDB507B0B000827FE4796302FB21DE0102A6

Function 00AC2341 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2350
InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2360
PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AC2370
GetLastError.KERNEL32 ref: 00AC237A

Part of subcall function 00AC1712: __EH_prolog.LIBCMT ref: 00AC1717

Strings

pqcs, xrefs: 00AC2388

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionErrorH_prologLastPostQueuedStatus
String ID: pqcs
API String ID: 1619523792-2559862021
Opcode ID: ab49019092149cde85cb8501eb20d3903020922c89f9e1372d61621871c426c8
Instruction ID: 057c03df74c25b32019516e6b5bdf53427f74c9a4a1b9b7f980f300892326b79
Opcode Fuzzy Hash: ab49019092149cde85cb8501eb20d3903020922c89f9e1372d61621871c426c8
Instruction Fuzzy Hash: BAF09A70A40344AFDB20EFB0AD49FAA7BBCEB00305B01052DF805CA510FB70D9058B91

Function 00AC4030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC4035
GetProcessHeap.KERNEL32(00000000,?), ref: 00AC4042
RtlAllocateHeap.NTDLL(00000000), ref: 00AC4049
std::exception::exception.LIBCMT ref: 00AC4063

Part of subcall function 00AC96BF: __EH_prolog.LIBCMT ref: 00AC96C4
Part of subcall function 00AC96BF: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 00AC96D3
Part of subcall function 00AC96BF: __CxxThrowException@8.LIBCMT ref: 00AC96F2

Strings

bad allocation, xrefs: 00AC4058

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prologHeap$AllocateConcurrency::cancellation_token::_Exception@8FromImplProcessThrowstd::exception::exception
String ID: bad allocation
API String ID: 3112922283-2104205924
Opcode ID: 6112596bfe15463d50485d0e8ed1830c2570657bca5349dc1a575f5a84e07764
Instruction ID: a26b96550136eda903c8307d63f183f885a7cc146347d561cc0f8c95e2b1ef11
Opcode Fuzzy Hash: 6112596bfe15463d50485d0e8ed1830c2570657bca5349dc1a575f5a84e07764
Instruction Fuzzy Hash: 41F08CB1D00289EFCB10FFE0DD49BEEB778EB14305F008419FA15A6281DB7846188B91

Function 6094B137 Relevance: 7.7, APIs: 5, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 6090A0D5: sqlite3_free.SQLITE3 ref: 6090A118

sqlite3_malloc.SQLITE3 ref: 6094B1D1
sqlite3_value_bytes.SQLITE3 ref: 6094B24C
sqlite3_malloc.SQLITE3 ref: 6094B272
sqlite3_value_blob.SQLITE3 ref: 6094B298
sqlite3_free.SQLITE3 ref: 6094B2C8

Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_stepsqlite3_value_blobsqlite3_value_bytes
String ID:
API String ID: 683514883-0
Opcode ID: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
Instruction ID: 83940ce9cf0a2bab7a741171fc95cc3a005d2848f59039768723a80715f2adcb
Opcode Fuzzy Hash: 3036fcfce1ee653ed62d56f61367963e4d2afc4bfe1ca560103df060be3b8356
Instruction Fuzzy Hash: E19133B1A052099FCB04CFA9D490B9EBBF6FF68314F108569E855AB341DB34ED81CB91

Function 6093A1DD Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A200
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A391
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A3A3
sqlite3_free.SQLITE3 ref: 6093A3BA
sqlite3_free.SQLITE3 ref: 6093A3C2

Part of subcall function 6093A0C5: sqlite3_mutex_enter.SQLITE3 ref: 6093A114
Part of subcall function 6093A0C5: sqlite3_mutex_free.SQLITE3 ref: 6093A152
Part of subcall function 6093A0C5: sqlite3_mutex_leave.SQLITE3 ref: 6093A162
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1A4
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_free$sqlite3_mutex_enter
String ID:
API String ID: 1903298374-0
Opcode ID: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction ID: f6c450fbbadf2e04ab128defb7df19fdb2a161b4e6cf4e71623f80625393026f
Opcode Fuzzy Hash: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction Fuzzy Hash: EB513870A047218BDB58DF69C8C074AB7A6BF65318F05896CECA69B305D735EC41CF91

Function 00404134 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 0040418D
GetFileType.KERNEL32(00000800), ref: 00404233
GetStdHandle.KERNEL32(-000000F6), ref: 0040428C
GetFileType.KERNEL32(00000000), ref: 0040429A
SetHandleCount.KERNEL32 ref: 004042D1

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID:
API String ID: 1710529072-0
Opcode ID: ed1883bb41cf2a6538e878717ee987e985851a4402a3f4a4dac1a5c459e3c3dd
Instruction ID: 5076e45d40c96a969624e0b2b2ebc88830731c081e7bcd8c89b481d83d14dc41
Opcode Fuzzy Hash: ed1883bb41cf2a6538e878717ee987e985851a4402a3f4a4dac1a5c459e3c3dd
Instruction Fuzzy Hash: FA5124B17042108BD7219B28CD887673B94AB913A4F1543BEF6A7FB2E1C73C9845C74A

Function 00AD0C80 Relevance: 7.6, APIs: 5, Instructions: 117COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00AD0A50: CloseHandle.KERNEL32(00000000,A7C02D40), ref: 00AD0AA1
Part of subcall function 00AD0A50: WaitForSingleObject.KERNEL32(?,000000FF,A7C02D40,?,?,?,?,A7C02D40,00AD0A23,A7C02D40), ref: 00AD0AB8

ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00AD0D1E
ReleaseSemaphore.KERNEL32(?,?,00000000), ref: 00AD0D3E
CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00AD0D77
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?), ref: 00AD0DCB
SetEvent.KERNEL32(?), ref: 00AD0DD2

Part of subcall function 00AC418C: CloseHandle.KERNEL32(00000000,?,00AD0D05), ref: 00AC41B0

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ReleaseSemaphore$EventObjectSingleWait
String ID:
API String ID: 4166353394-0
Opcode ID: db63d69b7d3ae61a03544249ca0a87fa282445ddf41fab8b3f31e207de05b268
Instruction ID: 20b27023c707b4da8cffaed33f1bc61c17b5c71cb5ec6a063b0919beb493c435
Opcode Fuzzy Hash: db63d69b7d3ae61a03544249ca0a87fa282445ddf41fab8b3f31e207de05b268
Instruction Fuzzy Hash: FF4103716007019FDB269F68CC80F2BB7A5EF45720F19066AEC5AEB395D734EC018BA5

Function 00AC207B Relevance: 7.6, APIs: 5, Instructions: 99timeCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000001), ref: 00AC20AC
SetWaitableTimer.KERNEL32(00000000,?,00000001,00000000,00000000,00000000), ref: 00AC20CD
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC20D8
InterlockedDecrement.KERNEL32(?), ref: 00AC213E
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC21A6

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Interlocked$Exchange$DecrementTimerWaitable
String ID:
API String ID: 1611172436-0
Opcode ID: fb7a36ced1cb33ab8f7bc4233aa1f85c8c70e260723724e251f4d6bc0275fcfa
Instruction ID: c07b740bea85fc9e8a1d8ae702f51042a83d472fb73d596d0041ecff5e4e1a54
Opcode Fuzzy Hash: fb7a36ced1cb33ab8f7bc4233aa1f85c8c70e260723724e251f4d6bc0275fcfa
Instruction Fuzzy Hash: 0D315772604B01AFC314DF65D885F6BBBF9FBD8710F150A2EB49682651D730E906CB92

Function 6093A0C5 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093A114
sqlite3_mutex_free.SQLITE3 ref: 6093A152
sqlite3_mutex_leave.SQLITE3 ref: 6093A162
sqlite3_free.SQLITE3 ref: 6093A1A4
sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
String ID:
API String ID: 1894464702-0
Opcode ID: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction ID: 8ebadd1dc7ee404a0f141fd21885e91e0aa1156a5a6df10951b92a0b718128ce
Opcode Fuzzy Hash: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction Fuzzy Hash: CF313C70B086118BDB18DF79C8C1A1A7BFBBFB2704F148468E8418B219EB35DC419F91

Function 00ACD0ED Relevance: 7.6, APIs: 5, Instructions: 92COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ACD0F2

Part of subcall function 00AC1A01: TlsGetValue.KERNEL32 ref: 00AC1A0A

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00ACD171
RtlEnterCriticalSection.NTDLL(?), ref: 00ACD18D
InterlockedIncrement.KERNEL32(00AF30F0), ref: 00ACD1B2
RtlLeaveCriticalSection.NTDLL(?), ref: 00ACD1C7

Part of subcall function 00AC27F3: SetWaitableTimer.KERNEL32(00000000,?,000493E0,00000000,00000000,00000000,00000000,00000000,0000000A,00000000), ref: 00AC284E

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$EnterExchangeH_prologIncrementLeaveTimerValueWaitable
String ID:
API String ID: 1578506061-0
Opcode ID: fc4b9ee480c91cdd914bfe12db549357f40d8d729939b1ac18a6370a01e98daf
Instruction ID: eb17b9fa8ecd23d152295a5cf9c75ff5d81d24ead05a2d23d5d5d2f405ac79b3
Opcode Fuzzy Hash: fc4b9ee480c91cdd914bfe12db549357f40d8d729939b1ac18a6370a01e98daf
Instruction Fuzzy Hash: D23138B1D017449FCB10DFA9D944BAEBBF8BF48314F15852EE44AD7601E774AA05CBA0

Function 6092535E Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,609254CC), ref: 6092538E
sqlite3_mutex_leave.SQLITE3 ref: 609253C4
sqlite3_log.SQLITE3 ref: 609253E2
sqlite3_log.SQLITE3 ref: 60925406
sqlite3_mutex_leave.SQLITE3 ref: 60925443

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_leave$sqlite3_mutex_enter
String ID:
API String ID: 3336957480-0
Opcode ID: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction ID: a100dd02d465b32589d57b5b9efe4db3cd483c3b5de54de748c9b161d5d001e2
Opcode Fuzzy Hash: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction Fuzzy Hash: D3315A70228704DBDB00EF28D49575ABBE6AFA1358F00886DE9948F36DD778C885DB02

Function 60961389 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_result_blob.SQLITE3 ref: 609613D0
sqlite3_column_int.SQLITE3 ref: 6096143A
sqlite3_data_count.SQLITE3 ref: 60961465
sqlite3_column_value.SQLITE3 ref: 60961476
sqlite3_result_value.SQLITE3 ref: 60961482

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_column_intsqlite3_column_valuesqlite3_data_countsqlite3_result_blobsqlite3_result_value
String ID:
API String ID: 3091402450-0
Opcode ID: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction ID: 8b12398a3b1f37ca0d2e1a8d549e1f0529ecbd38da511dd0edd3444da8e5cc4d
Opcode Fuzzy Hash: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction Fuzzy Hash: 72314DB19082058FDB00DF29C48064EB7F6FF65354F19856AE8999B361EB34E886CF81

Function 00AC29EE Relevance: 7.6, APIs: 5, Instructions: 79networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 00AC2A3B
closesocket.WS2_32 ref: 00AC2A42
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 00AC2A89
WSASetLastError.WS2_32(00000000,?,8004667E,00000000), ref: 00AC2A97
closesocket.WS2_32 ref: 00AC2A9E

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocket$ioctlsocket
String ID:
API String ID: 1561005644-0
Opcode ID: 2dcaf1fb8f2e5881fd2c9df6f41741557bda31f7217120add1329939c624f40d
Instruction ID: a8ee354108678845de70e627819245473764f1d7bd752b5c8a6f4824b5f46215
Opcode Fuzzy Hash: 2dcaf1fb8f2e5881fd2c9df6f41741557bda31f7217120add1329939c624f40d
Instruction Fuzzy Hash: C6212271E00205AFDB20EBF8D998F6EB7E9AF44355F12896EE505C7291EB708D418760

Function 60939097 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609390AC
sqlite3_mutex_enter.SQLITE3 ref: 609390B7
sqlite3_free.SQLITE3 ref: 60939120
sqlite3_mutex_leave.SQLITE3 ref: 6093912D
sqlite3_mutex_leave.SQLITE3 ref: 60939138

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction ID: 8e14962182cb4ba31828fc05f1b37fa5954e33605a362b2e641de35f96add61e
Opcode Fuzzy Hash: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction Fuzzy Hash: 022137B46087158BC709AF68C48570ABBF6FFA5318F10895DEC958B345DB74E940CB82

Function 6091A2E8 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 6091A31E
sqlite3_value_text.SQLITE3 ref: 6091A349
sqlite3_value_bytes.SQLITE3 ref: 6091A356
sqlite3_value_text.SQLITE3 ref: 6091A37B
sqlite3_value_bytes.SQLITE3 ref: 6091A387

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
String ID:
API String ID: 4225432645-0
Opcode ID: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction ID: 24a20a1669ecabf1c8c9e0f75de4e20f6480f0c3e20d7f4799920e66bb4c3c2a
Opcode Fuzzy Hash: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction Fuzzy Hash: 3F21CF71B086588FDB009F29C48075E7BE7AFA4254F0484A8E894CF305EB34DC86CB91

Function 00ADE894 Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00ADE8A0

Part of subcall function 00AD1FAC: __FF_MSGBANNER.LIBCMT ref: 00AD1FC3
Part of subcall function 00AD1FAC: __NMSG_WRITE.LIBCMT ref: 00AD1FCA
Part of subcall function 00AD1FAC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 00AD1FEF

_free.LIBCMT ref: 00ADE8B3

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 93972e13f177af5301b10914a1787457bd72fe8d27ffb1407032b2704dd86bcf
Instruction ID: 88ae34b44c41e719e2bcf75b26b047f84513a98b293700de863351025cb24d82
Opcode Fuzzy Hash: 93972e13f177af5301b10914a1787457bd72fe8d27ffb1407032b2704dd86bcf
Instruction Fuzzy Hash: 0611C232805615AFCF20BFF4AD59A5E7794AF083A0B104527F90B9E3A1DB348881D7D4

Function 00AC21D5 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC21DA
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC21ED
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000001), ref: 00AC2224
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,00000001), ref: 00AC2237
TlsSetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00AC2261

Part of subcall function 00AC2341: InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2350
Part of subcall function 00AC2341: InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2360
Part of subcall function 00AC2341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AC2370
Part of subcall function 00AC2341: GetLastError.KERNEL32 ref: 00AC237A

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: b5e52a751aa9b7dda908e042131c3adec7c851930403872af3194c03356f853d
Instruction ID: 863850b00e04acb51c5ca06ccd9fb49df0320a59d3288cffcb9b965a2deb32f7
Opcode Fuzzy Hash: b5e52a751aa9b7dda908e042131c3adec7c851930403872af3194c03356f853d
Instruction Fuzzy Hash: 66115C71D00154EFCB11DFA9ED44BEEBBBAEB44310B11422AE91196260DB718A52DB90

Function 00AC2298 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC229D
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00AC22B0
TlsGetValue.KERNEL32 ref: 00AC22E7
TlsSetValue.KERNEL32(?), ref: 00AC2300
TlsSetValue.KERNEL32(?,?,?), ref: 00AC231C

Part of subcall function 00AC2341: InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2350
Part of subcall function 00AC2341: InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2360
Part of subcall function 00AC2341: PostQueuedCompletionStatus.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AC2370
Part of subcall function 00AC2341: GetLastError.KERNEL32 ref: 00AC237A

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedValue$CompletionErrorH_prologLastPostQueuedStatus
String ID:
API String ID: 1856819132-0
Opcode ID: bda69ee3116826a3d2618d5f8ea0776d47f4b9a470c86e925a9d78b33cd658e4
Instruction ID: 0d6674ed16f67c8a63b3500884666c3838d683de6e3d84bd9dccfc9ae08bbf69
Opcode Fuzzy Hash: bda69ee3116826a3d2618d5f8ea0776d47f4b9a470c86e925a9d78b33cd658e4
Instruction Fuzzy Hash: 32114C71D00158EFCB01DFA5DD44AAEBFBAEF44310F01412AA801A7221D7758A52DB90

Function 00ACAD07 Relevance: 7.5, APIs: 5, Instructions: 45synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00ACA15A: __EH_prolog.LIBCMT ref: 00ACA15F

__CxxThrowException@8.LIBCMT ref: 00ACAD24

Part of subcall function 00AD31BA: RaiseException.KERNEL32(?,?,00ACEB54,?,?,?,?,?,?,?,00ACEB54,?,00AEECA8,?), ref: 00AD320F

WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,00AEFA1C,?,00000001), ref: 00ACAD3A
InterlockedExchange.KERNEL32(?,00000001), ref: 00ACAD4D
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000001,00000000,?,?,?,00AEFA1C,?,00000001), ref: 00ACAD5D
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00ACAD6B

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ExchangeInterlocked$CompletionExceptionException@8H_prologObjectPostQueuedRaiseSingleStatusThrowWait
String ID:
API String ID: 2725315915-0
Opcode ID: 554de2a044d434356ec9983cfca1b26bbfdea59949e8cfda80c3014bff7471ab
Instruction ID: 139809322cbc847960b57510e5ff9ef039bd54bd6b3c116bbc1ccac473f9c13f
Opcode Fuzzy Hash: 554de2a044d434356ec9983cfca1b26bbfdea59949e8cfda80c3014bff7471ab
Instruction Fuzzy Hash: F701D6B6900208AFCF10DBF4ECC9F5677ACEF14369F004529F616DB690D6A0E8058750

Function 00AC2420 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 00AC2432
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 00AC2445
RtlEnterCriticalSection.NTDLL(?), ref: 00AC2454
InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2469
RtlLeaveCriticalSection.NTDLL(?), ref: 00AC2470

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalExchangeInterlockedSection$CompareCompletionEnterLeavePostQueuedStatus
String ID:
API String ID: 747265849-0
Opcode ID: c01c8a9c32fc10d582748512af936ef800ecb115a0653981c35a18d0b2e69a99
Instruction ID: c1cbf4107909637baba5dcedb40708bf0237ac62a91f5cce0d2b2959e7acbe1e
Opcode Fuzzy Hash: c01c8a9c32fc10d582748512af936ef800ecb115a0653981c35a18d0b2e69a99
Instruction Fuzzy Hash: F3F0F472640A04BFD604EBB0EE89FDA772CFB44716F804026F601DA491DB61A956CBA0

Function 00AC1EC7 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 00AC1ED2
PostQueuedCompletionStatus.KERNEL32(?,?,?,00000000,00000000,?), ref: 00AC1EEA
RtlEnterCriticalSection.NTDLL(?), ref: 00AC1EF9
InterlockedExchange.KERNEL32(?,00000001), ref: 00AC1F0E
RtlLeaveCriticalSection.NTDLL(?), ref: 00AC1F15

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalInterlockedSection$CompletionEnterExchangeIncrementLeavePostQueuedStatus
String ID:
API String ID: 830998967-0
Opcode ID: 5ba629f349156fc12630db00b5a710bf63270ea7bd97e3a7c58646684e148abf
Instruction ID: f52b554b63c33db834187d08fce70ce8509949fdb689a4a44401950757415a97
Opcode Fuzzy Hash: 5ba629f349156fc12630db00b5a710bf63270ea7bd97e3a7c58646684e148abf
Instruction Fuzzy Hash: CFF01772600A04BFD700EFB1ED88FD6B76CFF5431AF000016F6019A451DB61A966CBE0

Function 609441F6 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

(, xrefs: 6094449C
|, xrefs: 609499CF
string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_log
String ID: ($string or blob too big$|
API String ID: 632333372-2398534278
Opcode ID: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction ID: 3c3a64a58f66130c0c9aec06ea77be0954bd7b4098f3428da06b6372deec6608
Opcode Fuzzy Hash: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction Fuzzy Hash: 5DC10CB5A043288FCB66CF28C981789B7BABB59304F1085D9E958A7345C775EF81CF40

Function 00AC7744 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00AC77AC
_memmove.LIBCMT ref: 00AC785A

Strings

string too long, xrefs: 00AC77DF, 00AC7881
invalid string position, xrefs: 00AC77D5

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964f1d278adb898e42f7eceb9cbba9dcce995e2e7c18328a7485d8b35d442f3d
Instruction ID: 3568ad4557df92233e9dbfef42877c4dfd56b91c7192b6781f1f96d5c54d28b8
Opcode Fuzzy Hash: 964f1d278adb898e42f7eceb9cbba9dcce995e2e7c18328a7485d8b35d442f3d
Instruction Fuzzy Hash: F341B2317047149BDB34DF6AD988F6EB7A9EF41750B11492DF95687281CB70EC44CBA0

Function 00AC30AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 00AC30C3
WSAStringToAddressA.WS2_32(?,?,00000000,?,?), ref: 00AC3102
_memcmp.LIBCMT ref: 00AC3141

Strings

255.255.255.255, xrefs: 00AC3139

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastString_memcmp
String ID: 255.255.255.255
API String ID: 1618111833-2422070025
Opcode ID: 03b63cce2a8ea8bd432c5ead7e0812f604a95b6a088a2fc66987d70ec67fac3a
Instruction ID: 73f6b058c54a0b8f87693afae0407de6807cb6bfc0cb128551fe294dc24dfb92
Opcode Fuzzy Hash: 03b63cce2a8ea8bd432c5ead7e0812f604a95b6a088a2fc66987d70ec67fac3a
Instruction Fuzzy Hash: A431F372A00304DFCF20AF74C880F6EB7B5AF41354F16C66DE8659B280D7719E418B90

Function 6096D170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6096D1A1
VirtualProtect.KERNEL32 ref: 6096D1E3
VirtualProtect.KERNEL32 ref: 6096D21E

Strings

@, xrefs: 6096D1C8

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: Virtual$Protect$Query
String ID: @
API String ID: 3618607426-2766056989
Opcode ID: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction ID: 11fd3fd6c91f2e29dbdaed7331fdf7a08ef8f1da01c53322037319a40d79a89e
Opcode Fuzzy Hash: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction Fuzzy Hash: 003141B5E15208AFEB14DFA9D48158EFFF5EF99254F10852AE868E3310E371D940CB52

Function 60928335 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 60928353

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_realloc.SQLITE3 ref: 609283A0
sqlite3_free.SQLITE3 ref: 609283B6

Strings

d, xrefs: 6092836D

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID: d
API String ID: 211589378-2564639436
Opcode ID: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction ID: 0830c2115c9ea807631a831f7f1165b0ee40d8a8a94356aa67113494a68d5982
Opcode Fuzzy Hash: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction Fuzzy Hash: 222137B0A04205CFDB14DF59D4C078ABBF6FF69314F158469D8889B309E3B8E841CBA1

Function 00AC1F56 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC1F5B
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,000000FF,?,00000000), ref: 00AC1FC5
GetLastError.KERNEL32(?,00000000), ref: 00AC1FD2

Part of subcall function 00AC1712: __EH_prolog.LIBCMT ref: 00AC1717

Strings

iocp, xrefs: 00AC1FE0

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$CompletionCreateErrorLastPort
String ID: iocp
API String ID: 998023749-976528080
Opcode ID: 143e5a0f56379abd549eb33052bff8a3aea732e351cc44e8ab19ed91f7854b55
Instruction ID: 5cdeba362567b849618d1470598ac54f56e9c788070476e168bdd8e912549fcc
Opcode Fuzzy Hash: 143e5a0f56379abd549eb33052bff8a3aea732e351cc44e8ab19ed91f7854b55
Instruction Fuzzy Hash: A321E5B1901B449FC720DF6AD54495BFBF8FFA5720B108A1FE4A687A60D7B0A604CF91

Function 00406DCB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00200020,?,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406DEE
LCMapStringW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406E04
LCMapStringW.KERNEL32(?,?,?,00000000,wg@ ,?,?,00406777,00200020,00000000,?,00000000), ref: 00406E37
LCMapStringW.KERNEL32(00000000,?,?,?,?,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406E9F
WideCharToMultiByte.KERNEL32(?,00000220,?,00000000,wg@ ,?,00000000,00000000,?,00000000,?,00406777,00200020,00000000,?,00000000), ref: 00406EC4

Strings

wg@ , xrefs: 00406E2A

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: wg@
API String ID: 352835431-1361311057
Opcode ID: f1f8d2d67377f96248cd3247033a7f7d4242d90f19275a8a8973a36c20068efa
Instruction ID: 8815b535790b1756bb2d4afebfd9ccfa00f2ce00910cef048d347d949d0464e8
Opcode Fuzzy Hash: f1f8d2d67377f96248cd3247033a7f7d4242d90f19275a8a8973a36c20068efa
Instruction Fuzzy Hash: BA112536900249EFCF228F94CD04ADEBBB6FF48750F15816AFA21721A0D3368D61DB94

Function 00AD27B5 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00AD27CD

Part of subcall function 00AD1FAC: __FF_MSGBANNER.LIBCMT ref: 00AD1FC3
Part of subcall function 00AD1FAC: __NMSG_WRITE.LIBCMT ref: 00AD1FCA
Part of subcall function 00AD1FAC: RtlAllocateHeap.NTDLL(007F0000,00000000,00000001), ref: 00AD1FEF

std::exception::exception.LIBCMT ref: 00AD27EB
__CxxThrowException@8.LIBCMT ref: 00AD2800

Part of subcall function 00AD31BA: RaiseException.KERNEL32(?,?,00ACEB54,?,?,?,?,?,?,?,00ACEB54,?,00AEECA8,?), ref: 00AD320F

Strings

bad allocation, xrefs: 00AD27E0

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: 6383dd12a539f959d334929c772f15c495aeec1b2e2ccf32d3f8056b4388c56f
Instruction ID: 713173607eb54f7ab37879bcaaa385f5610f89a864f710a58901c8813fe77024
Opcode Fuzzy Hash: 6383dd12a539f959d334929c772f15c495aeec1b2e2ccf32d3f8056b4388c56f
Instruction Fuzzy Hash: A2E0E57490020EB6CF10FF60CD05AAE7778AB10310F104857B81266781DF719A04D6D1

Function 00AC37B1 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC37B6
__localtime64.LIBCMT ref: 00AC37C1

Part of subcall function 00AD1600: __gmtime64_s.LIBCMT ref: 00AD1613

std::exception::exception.LIBCMT ref: 00AC37D9

Part of subcall function 00AD14D3: std::exception::_Copy_str.LIBCMT ref: 00AD14EC

Part of subcall function 00AC951D: __EH_prolog.LIBCMT ref: 00AC9522
Part of subcall function 00AC951D: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 00AC9531
Part of subcall function 00AC951D: __CxxThrowException@8.LIBCMT ref: 00AC9550

Strings

could not convert calendar time to UTC time, xrefs: 00AC37CE

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Copy_strException@8FromImplThrow__gmtime64_s__localtime64std::exception::_std::exception::exception
String ID: could not convert calendar time to UTC time
API String ID: 1963798777-2088861013
Opcode ID: d3e94eea5bf0f377f8a7f1b52734fd9542a88e24d16c78e04f6c439b865ceb09
Instruction ID: 4fbd33df0a91c081c02baef8aa1882714adb8a17d8f55d906fb67c65b2f24d00
Opcode Fuzzy Hash: d3e94eea5bf0f377f8a7f1b52734fd9542a88e24d16c78e04f6c439b865ceb09
Instruction Fuzzy Hash: 23E06DF2C0024DAACF00EF91D905BEEB778EF04340F00856AE822A3241DB7596198B80

Function 60901184 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6090119B
GetProcAddress.KERNEL32 ref: 609011B0

Strings

libgcj-11.dll, xrefs: 60901194
_Jv_RegisterClasses, xrefs: 609011A5

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-11.dll
API String ID: 1646373207-2713375476
Opcode ID: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction ID: e6822cb61b404b68644b44a252d8259deade1a358cfa59fcc717d95409d4d83a
Opcode Fuzzy Hash: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction Fuzzy Hash: 0DE04F7062D30586FB443F794D923297AEB5F72549F00081CD9929B240EBB4D440D753

Function 004035BA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,004032CA), ref: 004035BF
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 004035CF

Strings

KERNEL32, xrefs: 004035BA
IsProcessorFeaturePresent, xrefs: 004035C9

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 9e3184260247bb682de86deda7832bfa8ed340def0682ebd0b0602d774616e76
Instruction ID: ad2d92bcbb19eb94234426a2b997c27209dd56d7d671bda433ba6b8f24694311
Opcode Fuzzy Hash: 9e3184260247bb682de86deda7832bfa8ed340def0682ebd0b0602d774616e76
Instruction Fuzzy Hash: 53C01260380A0176EAB02FB21F0AB26290C0B04B03F10007EA289F40E0CE7CC200846D

Function 0040507C Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,?,00000000,?,?,0040449A), ref: 0040509D
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,00000000,?,?,0040449A), ref: 004050C1
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,00000000,?,?,0040449A), ref: 004050DB
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?,?,0040449A), ref: 0040519C
HeapFree.KERNEL32(00000000,00000000,?,00000000,?,?,0040449A), ref: 004051B3

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: 4898a1a10d3df8c53a66b9d87a918938818d161d70c2138f643a963ed7b51b89
Instruction ID: c46144ebe3c33e08270293431cd91daed3a720a60363197bafe5d8e1620d9662
Opcode Fuzzy Hash: 4898a1a10d3df8c53a66b9d87a918938818d161d70c2138f643a963ed7b51b89
Instruction Fuzzy Hash: FC31F070A40B019BE3209F24ED45B27B7E0EB48754F14863AE959BB6E1E778AC44CF4C

Function 00AD9C89 Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00AD9D1A
_memmove.LIBCMT ref: 00AD9D8E
___AdjustPointer.LIBCMT ref: 00AD9DDF
_memmove.LIBCMT ref: 00AD9DE8

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AdjustPointer_memmove
String ID:
API String ID: 1721217611-0
Opcode ID: d872bf4812afaf9f66623732201d3a8094050d63a32b2d342b5f3c8fc2ad0f8c
Instruction ID: 5f6b891b104fd837e69567b0e75e66463336872617ce1c24605fb9effd6ac51f
Opcode Fuzzy Hash: d872bf4812afaf9f66623732201d3a8094050d63a32b2d342b5f3c8fc2ad0f8c
Instruction Fuzzy Hash: 164182352043465EEB289F25E942B7B37A5AF05710F24002FE9478BBD2EF72E881D610

Function 00AD0320 Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00AC4149), ref: 00AD03BF

Part of subcall function 00AC3FDC: __EH_prolog.LIBCMT ref: 00AC3FE1
Part of subcall function 00AC3FDC: CreateEventA.KERNEL32(00000000,?,?,00000000), ref: 00AC3FF3

CloseHandle.KERNEL32(00000000), ref: 00AD03B4
CloseHandle.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,00AC4149), ref: 00AD0400
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00AC4149), ref: 00AD04D1

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$CreateH_prolog
String ID:
API String ID: 2825413587-0
Opcode ID: 2cdf585fb65c0c52e546da30f78b255883efaa17eeeb4dd9200d91cafcb80518
Instruction ID: e2a45cc2d0e12f01fe980164c352898fc89413c590e8ffc70a10341aae7c2ddc
Opcode Fuzzy Hash: 2cdf585fb65c0c52e546da30f78b255883efaa17eeeb4dd9200d91cafcb80518
Instruction Fuzzy Hash: D351BEB16003458BDB10DF28C884F5A7BE4BF89328F19462AF96AAB391D735DD05CB91

Function 00ADE2A5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00ADE2DB
__isleadbyte_l.LIBCMT ref: 00ADE309
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,00000000,00000000,?,?,?), ref: 00ADE337
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,00000000,00000000,?,?,?), ref: 00ADE36D

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c0ece7a0aa54933572b00cfc44ba6eb270728b5117f9f8f97bd1f0d380992c2b
Instruction ID: 44b1dbf7e2ebaf5b7a4521975821c4eb986afc3520c8ee95d5cbc13df902cddc
Opcode Fuzzy Hash: c0ece7a0aa54933572b00cfc44ba6eb270728b5117f9f8f97bd1f0d380992c2b
Instruction Fuzzy Hash: D4318F31604286EFDF21EF75C885BBA7BB9BF41350F15452AE8668F2A0D731D850DB90

Function 609292DA Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 60929311
sqlite3_value_text.SQLITE3 ref: 60929358
sqlite3_value_bytes.SQLITE3 ref: 60929364
sqlite3_malloc.SQLITE3 ref: 60929374

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_freesqlite3_mallocsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 1648232842-0
Opcode ID: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction ID: a01add595a6c287de5924383f0ed77e5cc34082cd65fcd393cbe5beac3228527
Opcode Fuzzy Hash: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction Fuzzy Hash: 4531C0B4A042058FDB04DF29C094B5ABBE2FF98354F1484A9EC498F349D779E846CBA0

Function 60961492 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3 ref: 609614AB
sqlite3_reset.SQLITE3 ref: 609614BF

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_column_int64.SQLITE3 ref: 609614D4

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_column_int64sqlite3_mutex_entersqlite3_mutex_leavesqlite3_resetsqlite3_step
String ID:
API String ID: 3429445273-0
Opcode ID: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction ID: 62863439de2fabb71fd3664abc4fbfc11ff04353a6e6e3e42574d1c19fb7889d
Opcode Fuzzy Hash: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction Fuzzy Hash: AE316470A183408BEF15CF69C1C5749FBA6AFA7348F188599DC864F30AD375D884C752

Function 00AC3D7E Relevance: 6.1, APIs: 4, Instructions: 57networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 00AC3DA2

Part of subcall function 00AC3BD3: __EH_prolog.LIBCMT ref: 00AC3BD8
Part of subcall function 00AC3BD3: std::bad_exception::bad_exception.LIBCMT ref: 00AC3BED

htonl.WS2_32(00000000), ref: 00AC3DB9
htonl.WS2_32(00000000), ref: 00AC3DC0
htons.WS2_32(?), ref: 00AC3DD4

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: htonlhtons$H_prologstd::bad_exception::bad_exception
String ID:
API String ID: 3882411702-0
Opcode ID: 134eb3ee68a4821978c3902d10e659eb2f8c248bc285eeb09a9fa92a94304af9
Instruction ID: 718c2fe596f690a7fcabc7aa4cf190d108176a5115262e9854ffa9ba86423a71
Opcode Fuzzy Hash: 134eb3ee68a4821978c3902d10e659eb2f8c248bc285eeb09a9fa92a94304af9
Instruction Fuzzy Hash: 0911AC36A00348EBCF01AFA4E885E9AB7B8EF09314B01845AFD05DF211DA719A0487A1

Function 609034B2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 609034D8
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903521
sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 6090354A
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903563

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction ID: 848dca46e936c6e01d33e08870ae11aa620bd8b24bdb606da7ea596206f2e213
Opcode Fuzzy Hash: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction Fuzzy Hash: 44111F726186218FDB00EF7DC8817597FEAFB66308F00842DE865E7362E779D8819741

Function 00AC239D Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000), ref: 00AC23D0
RtlEnterCriticalSection.NTDLL(?), ref: 00AC23DE
InterlockedExchange.KERNEL32(?,00000001), ref: 00AC2401
RtlLeaveCriticalSection.NTDLL(?), ref: 00AC2408

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 3975aed2c47988c00549ebb8a8d90d95a1d9f7b5b78be485b6d7724b19d89eae
Instruction ID: 8f3fbdf077d4734038d07e80a3feb56672efe17d1c6931304818d74f0b73de27
Opcode Fuzzy Hash: 3975aed2c47988c00549ebb8a8d90d95a1d9f7b5b78be485b6d7724b19d89eae
Instruction Fuzzy Hash: 61117C72600204AFDB14DFA0D984FA6B7B8FF54719F11406DF9019A251D7B5E946CBA0

Function 00ADA0DB Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00ADA0FF

Part of subcall function 00ADA7E6: __fltout2.LIBCMT ref: 00ADA80F

__cftog_l.LIBCMT ref: 00ADA125
__cftoe_l.LIBCMT ref: 00ADA157

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 09de19b32c3a685a57147e367e1b77d34ca1e6295ab6b317d717812c7470ba85
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 2201403640014ABBCF125F94CC418EE3F72BB29354F588516FE1A59231D336C9B1AB82

Function 6092A43E Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6092A450

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 6092A466
sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
sqlite3_memory_used.SQLITE3 ref: 6092A4BA

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_leave
String ID:
API String ID: 2673540737-0
Opcode ID: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction ID: c4988029ba64cfb2248a7cf0c790324acf4c13eb0f9cd3f15fdedc175ef3c91a
Opcode Fuzzy Hash: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction Fuzzy Hash: F9019276E143148BCB00EF79D88561ABFE7FBA5324F008528EC9497364E735DC408B81

Function 6092A3C4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6092A3D8
sqlite3_value_text.SQLITE3 ref: 6092A3FA
sqlite3_load_extension.SQLITE3 ref: 6092A418
sqlite3_free.SQLITE3 ref: 6092A431

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_load_extension
String ID:
API String ID: 3526213481-0
Opcode ID: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction ID: 98199466554994e62e20ad809be6129e3c08b78dd6d8c38fc18f61524e73aad2
Opcode Fuzzy Hash: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction Fuzzy Hash: 4101E9B5A043059BCB00EF69D485AAFBBF5EF68654F10C529EC9497304E774D841CF91

Function 60969133 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3 ref: 60969166
sqlite3_errmsg.SQLITE3 ref: 60969172

Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5

sqlite3_errcode.SQLITE3 ref: 6096918A

Part of subcall function 609251AA: sqlite3_log.SQLITE3 ref: 609251E8

sqlite3_step.SQLITE3 ref: 60969197

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_log$sqlite3_errcodesqlite3_errmsgsqlite3_preparesqlite3_step
String ID:
API String ID: 2877408194-0
Opcode ID: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction ID: d4ebd4c9a05a553e526e78eaaf80584f3afcfe73b3175c4c6dada352db343273
Opcode Fuzzy Hash: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction Fuzzy Hash: 9F0186B091C3059BE700EF29C88525DFBE9EFA5314F11892DA89987384E734C940CB86

Function 00AC247D Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 00AC24A9
RtlEnterCriticalSection.NTDLL(?), ref: 00AC24B8
InterlockedExchange.KERNEL32(?,00000001), ref: 00AC24CD
RtlLeaveCriticalSection.NTDLL(?), ref: 00AC24D4

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompletionEnterExchangeInterlockedLeavePostQueuedStatus
String ID:
API String ID: 4018804020-0
Opcode ID: 17a55359ca9c6cc6ccbeef620be7f1ccfd8aecbb599d70e951b47de9de0b6abd
Instruction ID: 27afd5b9d2f5a229d1fce30a4a48719efd1bd7221e43c296f8d134e84d7f76c3
Opcode Fuzzy Hash: 17a55359ca9c6cc6ccbeef620be7f1ccfd8aecbb599d70e951b47de9de0b6abd
Instruction Fuzzy Hash: 61F03C72600604AFDB00EFA5EC85F9ABBACFF54715F008029FA04CA152D771E951CBA0

Function 609084D1 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609084E9
sqlite3_mutex_leave.SQLITE3 ref: 60908518
sqlite3_mutex_enter.SQLITE3 ref: 60908528
sqlite3_mutex_leave.SQLITE3 ref: 6090855B

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction ID: c41a4d3f3efa942db11cbd34a9101edfe28f26dd6f673ba1da0d5803e4a0adbd
Opcode Fuzzy Hash: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction Fuzzy Hash: FD01A4B05093048BDB40AF25C5D97CABBA5EF15718F0884BDEC894F34AD7B9D5448BA1

Function 00AC2004 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC2009
RtlDeleteCriticalSection.NTDLL(?), ref: 00AC2028
CloseHandle.KERNEL32(00000000), ref: 00AC2037
CloseHandle.KERNEL32(00000000), ref: 00AC204E

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: CloseHandle$CriticalDeleteH_prologSection
String ID:
API String ID: 2456309408-0
Opcode ID: 786d13a1e0fd4b106b28de1503d8a918e36b6a56c4c67d4b9d3ee7b9f2424bf5
Instruction ID: e58349de9036ae8eff5d1cbb2737d171e9197caed32d5b02c7c9d186608194a9
Opcode Fuzzy Hash: 786d13a1e0fd4b106b28de1503d8a918e36b6a56c4c67d4b9d3ee7b9f2424bf5
Instruction Fuzzy Hash: D6018171400B449FC734EF64E948B9ABBB5FF04305F00452EF446835A1CBB06A45CB95

Function 00AC1E26 Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC1E2B
SetEvent.KERNEL32(00000000), ref: 00AC1E3F
SetEvent.KERNEL32(?), ref: 00AC1E58
SleepEx.KERNEL32(000000FF,00000001), ref: 00AC1E62

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Event$H_prologSleep
String ID:
API String ID: 1765829285-0
Opcode ID: 9bb257c773ee5cb904c7b34a40d183cacc504d2a06b4779023bd6adb55966a2c
Instruction ID: 7a88a07298ced49d6007488cd78438a627353e80fb24b3a5584f23d10092b7bb
Opcode Fuzzy Hash: 9bb257c773ee5cb904c7b34a40d183cacc504d2a06b4779023bd6adb55966a2c
Instruction Fuzzy Hash: 2EF03A36600550EFCB00DFA4ECC8B9CBBA4FF09311F1481A9FA0A9B291C7749940CBA1

Function 609481BF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

into, xrefs: 60948285
out of, xrefs: 60948277

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_log
String ID: into$out of
API String ID: 632333372-1114767565
Opcode ID: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction ID: de20b162988cb891a2f8fbcf22309076e3e21d241eadb06c465d82de9f0e8d92
Opcode Fuzzy Hash: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction Fuzzy Hash: 91910170A043149BDB26CF28C88175EBBBABF65308F0481E9E858AB355D7B5DE85CF41

Function 00AC8F4A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC8F4F
_memmove.LIBCMT ref: 00AC9049

Strings

&', xrefs: 00AC9030

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmove
String ID: &'
API String ID: 3529519853-655172784
Opcode ID: e7a4da47479f1114e63210eff5b651698084638072baf3b60e06279668084b61
Instruction ID: d04e53d4be776f46822edaa7b50a580c317d4120a19739f9c3d28e20c654b2d8
Opcode Fuzzy Hash: e7a4da47479f1114e63210eff5b651698084638072baf3b60e06279668084b61
Instruction Fuzzy Hash: C9616B71D00249DFDF20EFA8CA85FEEBBB5AF44310F11816EE515AB251DB709A05CBA1

Function 60919123 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 60918408: sqlite3_value_text.SQLITE3 ref: 60918426

sqlite3_free.SQLITE3 ref: 609193A3

Strings

NULL, xrefs: 60919165
(NULL), xrefs: 60919157

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_freesqlite3_value_text
String ID: (NULL)$NULL
API String ID: 2175239460-873412390
Opcode ID: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction ID: 63658e955800b40111a930d2026d12727b3b294c4be858d68b3f7c51d7abf176
Opcode Fuzzy Hash: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction Fuzzy Hash: E3514B31F0825A8EEB258A68C89479DBBB6BF66304F1441E9C4A9AB241D7309DC6CF01

Function 0040648F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 004064A3

Strings

, xrefs: 004064C8
, xrefs: 004064EC

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: f00a1f3feb4df0bc39dc764619c4565e68d8850cfc3749823aa9a69b34e6f853
Instruction ID: 9cb53df14236292cf19f588c1dd4f01283293c5d5303746c669e552a403b4f4c
Opcode Fuzzy Hash: f00a1f3feb4df0bc39dc764619c4565e68d8850cfc3749823aa9a69b34e6f853
Instruction Fuzzy Hash: 8E412631004258AAEB119724DE89BFB3FE9EB02B04F1505F6D587F71D2C2394968DB6A

Function 60942334 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

|, xrefs: 609499CF
string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_log
String ID: string or blob too big$|
API String ID: 632333372-330586046
Opcode ID: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction ID: 65a9847582dc10a4f4f17f1c4fc8d82f10366072c52f03016cacc5a11d353e3e
Opcode Fuzzy Hash: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction Fuzzy Hash: 4D51B9749083689BCB22CF28C985789BBF6BF59314F1086D9E49897351C775EE81CF41

Function 609480BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 609480E2
sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_logsqlite3_value_text
String ID: string or blob too big
API String ID: 2320820228-2803948771
Opcode ID: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction ID: 1f8da1134a73d261049fdcd83983d84c916c8a3f87851362e697cdb17b1d2bab
Opcode Fuzzy Hash: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction Fuzzy Hash: F631D9B0A083249BCB25DF28C881799B7FABF69304F0085DAE898A7301D775DE81CF45

Function 00AC865E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000,?,?,?,?,?,?,?,00AC73C8,?,?,00000000), ref: 00AC86C5
getsockname.WS2_32(?,?,?), ref: 00AC86DB

Strings

&', xrefs: 00AC870E

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: ErrorLastgetsockname
String ID: &'
API String ID: 566540725-655172784
Opcode ID: cb62ba1c0ee88b9cf6e19a2f917d01a42aba74a216314027c0f8a384ab667a22
Instruction ID: 997824bd775d72f257c5635cad6d6a5337936e4044a8b25776c0ff6b49ab0c93
Opcode Fuzzy Hash: cb62ba1c0ee88b9cf6e19a2f917d01a42aba74a216314027c0f8a384ab667a22
Instruction Fuzzy Hash: C2215375A00208AFDB10DF78D955B8EB7F5FF48314F11C56AE918EB281DB34A9458B50

Function 00ACBCA4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ACBCA9

Part of subcall function 00ACC285: std::exception::exception.LIBCMT ref: 00ACC2B4

Part of subcall function 00ACCA3B: __EH_prolog.LIBCMT ref: 00ACCA40

Part of subcall function 00AD27B5: _malloc.LIBCMT ref: 00AD27CD

Part of subcall function 00ACC2E4: __EH_prolog.LIBCMT ref: 00ACC2E9

Strings

class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void), xrefs: 00ACBCDF
C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 00ACBCE6

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_alloc_>(void)
API String ID: 1953324306-1943798000
Opcode ID: 834d0ecbf04e8fbabe561e2cd93009683d4b8819afe0781bfb167501b728ed7c
Instruction ID: 69951f2c5e9ee1541ca05d3c9c4d711ef18167d17899107a6909dae1a2baca15
Opcode Fuzzy Hash: 834d0ecbf04e8fbabe561e2cd93009683d4b8819afe0781bfb167501b728ed7c
Instruction Fuzzy Hash: A521BF71D002489BDF18EFE9D959BEDBBB4EF54310F05411EF906AB281DB705A04CBA0

Function 00ACBD99 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00ACBD9E

Part of subcall function 00ACC35C: std::exception::exception.LIBCMT ref: 00ACC389

Part of subcall function 00ACCB72: __EH_prolog.LIBCMT ref: 00ACCB77

Part of subcall function 00AD27B5: _malloc.LIBCMT ref: 00AD27CD

Part of subcall function 00ACC3B9: __EH_prolog.LIBCMT ref: 00ACC3BE

Strings

class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void), xrefs: 00ACBDD4
C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp, xrefs: 00ACBDDB

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$_mallocstd::exception::exception
String ID: C:\boost_1_55_0\staging\include\boost-1_55\boost/exception/detail/exception_ptr.hpp$class boost::exception_ptr __cdecl boost::exception_detail::get_static_exception_object<struct boost::exception_detail::bad_exception_>(void)
API String ID: 1953324306-412195191
Opcode ID: dbe48a5abf9524098bb7438fed48b9a623133a44cea7f6b530995856c699ef21
Instruction ID: 019175dbdc148b9b756a734cf9e926412c26f22fe2ee403f110791004fc9380c
Opcode Fuzzy Hash: dbe48a5abf9524098bb7438fed48b9a623133a44cea7f6b530995856c699ef21
Instruction Fuzzy Hash: 9D21AB71D002489ADF04EFE5EA56BEEBBB4EF54700F05411DFA05AB392CB705A44CBA0

Function 6091407D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 60914096
sqlite3_value_numeric_type.SQLITE3 ref: 609140A2

Strings

, xrefs: 60914088

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction ID: a3c0f903ff645dd1c5a8146eaa2078e963ad6c1b8d1bbf61d5d4caeb1888773d
Opcode Fuzzy Hash: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction Fuzzy Hash: 19119EB0A0C6589BDF059F69C4D539A7BF6AF39308F0044E8D8D08B205E771CD94CB81

Function 60956040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60956065
sqlite3_stricmp.SQLITE3 ref: 6095607E

Strings

log, xrefs: 609560C0

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: log
API String ID: 912767213-2403297477
Opcode ID: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction ID: cbf508da25866b0a35bc2ca480d64d7c482f0664b0359b741109bd545b4f9ff5
Opcode Fuzzy Hash: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction Fuzzy Hash: FD11DAB07087048BE725AF66C49535EBBB3ABA1708F10C42CE4854B784C7BAC986DB42

Function 00AC3965 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC396A
std::runtime_error::runtime_error.LIBCPMT ref: 00AC39C1

Part of subcall function 00AC1410: std::exception::exception.LIBCMT ref: 00AC1428

Part of subcall function 00AC9613: __EH_prolog.LIBCMT ref: 00AC9618
Part of subcall function 00AC9613: Concurrency::cancellation_token::_FromImpl.LIBCPMT ref: 00AC9627
Part of subcall function 00AC9613: __CxxThrowException@8.LIBCMT ref: 00AC9646

Strings

Day of month is not valid for year, xrefs: 00AC39AC

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$Concurrency::cancellation_token::_Exception@8FromImplThrowstd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month is not valid for year
API String ID: 1404951899-1521898139
Opcode ID: 1e7b10d357122d6572f1df24c0400d2ac0ad05c214ac6a87063d8ef5885ee8d4
Instruction ID: cc8d3e07085ce9b41d2ee579bcc7d7caa5198871ed9efedf7234b8f2b2dbabba
Opcode Fuzzy Hash: 1e7b10d357122d6572f1df24c0400d2ac0ad05c214ac6a87063d8ef5885ee8d4
Instruction Fuzzy Hash: EF018C7A914249AACF05EFA5D906EEEB778EF14710F00841AF80497240EBB04B44C7A5

Function 60902148 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 60902167
sqlite3_strnicmp.SQLITE3 ref: 60902193

Strings

SQLITE_, xrefs: 6090215C

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: SQLITE_
API String ID: 1961171630-787686576
Opcode ID: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction ID: 6d5ef3c0fd507030b5e8170497320435726bf3f0db30f2d6f2734bcd7f756fb3
Opcode Fuzzy Hash: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction Fuzzy Hash: 2501D6B190C3505FD7419F29CC8075BBFFAEBA5258F10486DE89687212D374DC81D781

Function 6091A1B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 6091A1DB
sqlite3_value_blob.SQLITE3 ref: 6091A1FA

Strings

Invalid argument to rtreedepth(), xrefs: 6091A1E3

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytes
String ID: Invalid argument to rtreedepth()
API String ID: 1063208240-2843521569
Opcode ID: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction ID: c9489564a96cd83e586e3a08c251b8a8c74d553169181c25a19da25ffef599d7
Opcode Fuzzy Hash: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction Fuzzy Hash: 0FF0A4B2A0C2589BDB00AF2CC88255577A6FF24258F1045D9E9858F306EB34DDD5C7D1

Function 609561A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561D7

Part of subcall function 6092A43E: sqlite3_initialize.SQLITE3 ref: 6092A450
Part of subcall function 6092A43E: sqlite3_mutex_enter.SQLITE3 ref: 6092A466
Part of subcall function 6092A43E: sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
Part of subcall function 6092A43E: sqlite3_memory_used.SQLITE3 ref: 6092A4BA

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561EB

Strings

soft_heap_limit, xrefs: 609561F7

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_soft_heap_limit64$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_entersqlite3_mutex_leave
String ID: soft_heap_limit
API String ID: 1251656441-405162809
Opcode ID: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction ID: 8891d4bbc0f5aef5547f00e3070395c34840fc2012d087b050684f6162b0ba7d
Opcode Fuzzy Hash: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction Fuzzy Hash: C2014B71A083188BC710EF98D8417ADB7F2BFA5318F508629E8A49B394D730DC42CF41

Function 00ACA0F5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00ACEB0C
__CxxThrowException@8.LIBCMT ref: 00ACEB21

Part of subcall function 00AD27B5: _malloc.LIBCMT ref: 00AD27CD

Strings

bad allocation, xrefs: 00ACEB01

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw_mallocstd::exception::exception
String ID: bad allocation
API String ID: 4063778783-2104205924
Opcode ID: c69e05d5e6acabd8f06dacc4e41f0151936b2339e73cf1d7872ee74a3cf0cd83
Instruction ID: bb18c7c5659a5bb3004d93bde1ce786fcd8b08da505cc6fbf4c7cd7e93b2710f
Opcode Fuzzy Hash: c69e05d5e6acabd8f06dacc4e41f0151936b2339e73cf1d7872ee74a3cf0cd83
Instruction Fuzzy Hash: E0F0E97060030E679F18E7688946EAE73AC9B10354F10051AB912D2381EA70E9048592

Function 00AC3C16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC3C1B
std::bad_exception::bad_exception.LIBCMT ref: 00AC3C30

Part of subcall function 00AD14B7: std::exception::exception.LIBCMT ref: 00AD14C1

Part of subcall function 00AC964C: __EH_prolog.LIBCMT ref: 00AC9651
Part of subcall function 00AC964C: __CxxThrowException@8.LIBCMT ref: 00AC967A

Strings

bad cast, xrefs: 00AC3C28

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: c9c7f98d1625e6c627f46438f5f5b5aebbc5f05e968ac29730feff6fe8f5f8f9
Instruction ID: 560d06d3c9f066e4f7b122b15979ee050dffe5cc0a023eaa66e6b59853db2f18
Opcode Fuzzy Hash: c9c7f98d1625e6c627f46438f5f5b5aebbc5f05e968ac29730feff6fe8f5f8f9
Instruction Fuzzy Hash: 6CF0A0729001449BCB09EF58D545AEFB775EF62311F1041AEFD0A5B291CB729A0ACAD1

Function 60925208 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A
sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 60925263

Strings

NULL, xrefs: 60925213

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: sqlite3_log
String ID: NULL
API String ID: 632333372-324932091
Opcode ID: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction ID: 5a36de60e8574ea04015b231464f09686a41744340efbe7a8a869d8181b3dc96
Opcode Fuzzy Hash: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction Fuzzy Hash: BAF0A070238301DBD7102FA6E44230E7AEBABB0798F48C43C95A84F289D7B5C844CB63

Function 004026E1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 004026E1
GetModuleFileNameA.KERNEL32 ref: 00402AA9

Strings

EarnPackage, xrefs: 00402AB4

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: ExitFileModuleNameProcess
String ID: EarnPackage
API String ID: 778004563-1697690530
Opcode ID: 44945f0491549b872976c122389c1ed38a73bb8df8a4faf5fb413bfcbbbe4277
Instruction ID: 1a2112fc880cec60b442b8778f44676e892c1845e8fd3b8bd411d29b7b77b9ac
Opcode Fuzzy Hash: 44945f0491549b872976c122389c1ed38a73bb8df8a4faf5fb413bfcbbbe4277
Instruction Fuzzy Hash: 6CE0305560B681AAEB021B785A197A23F30DB47324B5500AB99936A1E3C57C840FA71F

Function 00AC3881 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC3886
std::runtime_error::runtime_error.LIBCPMT ref: 00AC38A5

Part of subcall function 00AC1410: std::exception::exception.LIBCMT ref: 00AC1428

Part of subcall function 00AC7981: _memmove.LIBCMT ref: 00AC79A1

Strings

Day of month value is out of range 1..31, xrefs: 00AC3894

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Day of month value is out of range 1..31
API String ID: 3258419250-1361117730
Opcode ID: 2f525759d60213f13d9c98b96dd9e317303f73c9cbc76ae8facef2690014e6a7
Instruction ID: d67346ed6cb19ce0a9fa7e30f4652b549e106f705e1800850eaf803b59eafa5c
Opcode Fuzzy Hash: 2f525759d60213f13d9c98b96dd9e317303f73c9cbc76ae8facef2690014e6a7
Instruction Fuzzy Hash: 02E092B2A401445BD715AB958912BDCB7B8DB18760F00095EE80267281DAF129048791

Function 00AC38CD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC38D2
std::runtime_error::runtime_error.LIBCPMT ref: 00AC38F1

Part of subcall function 00AC1410: std::exception::exception.LIBCMT ref: 00AC1428

Part of subcall function 00AC7981: _memmove.LIBCMT ref: 00AC79A1

Strings

Year is out of valid range: 1400..10000, xrefs: 00AC38E0

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Year is out of valid range: 1400..10000
API String ID: 3258419250-2344417016
Opcode ID: 8fc25d366273dfc6b47f51e678bc45ac327efdade76614eef28b346bb296eb42
Instruction ID: 5df8099a4e9c570c7049e7d0f8adc4ca03579577aa8f93daa50ee57e4f205152
Opcode Fuzzy Hash: 8fc25d366273dfc6b47f51e678bc45ac327efdade76614eef28b346bb296eb42
Instruction Fuzzy Hash: A3E0D872F501445BDB14EB958A26FDDB7B8DB18760F00055EF80267281DBF11904C790

Function 00AC3919 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC391E
std::runtime_error::runtime_error.LIBCPMT ref: 00AC393D

Part of subcall function 00AC1410: std::exception::exception.LIBCMT ref: 00AC1428

Part of subcall function 00AC7981: _memmove.LIBCMT ref: 00AC79A1

Strings

Month number is out of range 1..12, xrefs: 00AC392C

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog_memmovestd::exception::exceptionstd::runtime_error::runtime_error
String ID: Month number is out of range 1..12
API String ID: 3258419250-4198407886
Opcode ID: 912337ce544005335f215bd76a89036a1c5809eb8039ba251a18923b9ca9a328
Instruction ID: 5c948f2936a62ce0783500c30c39ce4ff6bf0851d899bec963a206e21a654b54
Opcode Fuzzy Hash: 912337ce544005335f215bd76a89036a1c5809eb8039ba251a18923b9ca9a328
Instruction Fuzzy Hash: 5BE0D872F401449BD724EB958916FEDB7B8DB18750F00055EF80267281DBF1190487D0

Function 00AC19C2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00AC19CC
GetLastError.KERNEL32 ref: 00AC19D9

Part of subcall function 00AC1712: __EH_prolog.LIBCMT ref: 00AC1717

Strings

tss, xrefs: 00AC19E8

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: AllocErrorH_prologLast
String ID: tss
API String ID: 249634027-1638339373
Opcode ID: ff8c04401cb3611184190762cdc71655b1f82d43c1a0e81b3ed529d74d6e69f3
Instruction ID: 49b800d3d82dd01a6d528d8270d24b54f5bd1ee20d401ba526d236e15f23b553
Opcode Fuzzy Hash: ff8c04401cb3611184190762cdc71655b1f82d43c1a0e81b3ed529d74d6e69f3
Instruction Fuzzy Hash: 12E08631E046105F8300BBB8FC4958EBBA49A41375F118B3EFCA9872D1FA3059418BD3

Function 00AC3BD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 00AC3BD8
std::bad_exception::bad_exception.LIBCMT ref: 00AC3BED

Part of subcall function 00AD14B7: std::exception::exception.LIBCMT ref: 00AD14C1

Part of subcall function 00AC964C: __EH_prolog.LIBCMT ref: 00AC9651
Part of subcall function 00AC964C: __CxxThrowException@8.LIBCMT ref: 00AC967A

Strings

bad cast, xrefs: 00AC3BE5

Memory Dump Source

Source File: 00000005.00000002.3885963671.0000000000AC1000.00000040.00001000.00020000.00000000.sdmp, Offset: 00AC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_ac1000_videominimizer32.jbxd

Yara matches

Similarity

API ID: H_prolog$Exception@8Throwstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad cast
API String ID: 1300498068-3145022300
Opcode ID: 1065bbe9c4806281ab42cadd36cb9e6fe1e43efac594777d8510997fcf2efc6d
Instruction ID: 8bca3ce1efedd9ea6eed98d19505f1a9476ec10dbe135d4c6f88f109420092d9
Opcode Fuzzy Hash: 1065bbe9c4806281ab42cadd36cb9e6fe1e43efac594777d8510997fcf2efc6d
Instruction Fuzzy Hash: 95E0DFB2900188EBCB04EF94C646BFDB770EF25301F0081ADA906433D1CB341E04CA81

Function 00404ED0 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,00000050,?,00000000,00404C98,?,?,?,00000100,?,00000000), ref: 00404EF8
HeapAlloc.KERNEL32(00000008,000041C4,?,00000000,00404C98,?,?,?,00000100,?,00000000), ref: 00404F2C
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004,?,00000000,00404C98,?,?,?,00000100,?,00000000), ref: 00404F46
HeapFree.KERNEL32(00000000,?,?,00000000,00404C98,?,?,?,00000100,?,00000000), ref: 00404F5D

Memory Dump Source

Source File: 00000005.00000002.3885338005.0000000000400000.00000040.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.3885338005.000000000040B000.00000040.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_videominimizer32.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: 6b864aa16289a7054ca829b62459d0cb7b30ac2b892c6e871623fa542d0f5f80
Instruction ID: 7ab702067bc111bda87cbae0b9ae7b94d8b737c30d2fa5aa791eae26a2686950
Opcode Fuzzy Hash: 6b864aa16289a7054ca829b62459d0cb7b30ac2b892c6e871623fa542d0f5f80
Instruction Fuzzy Hash: EA112BB0242602DFD7208F29EE85D22BBB5FB85720711473AE6A1F65F0D7719845CF18

Function 6096D4C0 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4DF
TlsGetValue.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4F5
GetLastError.KERNEL32(?,?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4FD
LeaveCriticalSection.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D520

Memory Dump Source

Source File: 00000005.00000002.3886691895.0000000060901000.00000020.00000001.01000000.0000000A.sdmp, Offset: 60900000, based on PE: true

Associated: 00000005.00000002.3886679835.0000000060900000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886731331.000000006096E000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886744175.000000006096F000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886758982.000000006097B000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886772417.000000006097D000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.3886785814.0000000060980000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_60900000_videominimizer32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction ID: 6dd43474153c21470d2d90641e64b96ed0da30414b2d41baa8b5e8831fa3fcb2
Opcode Fuzzy Hash: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction Fuzzy Hash: 9AF0F972A163104BEB10AF659CC1A5A7BFDEFB1218F100048FC6197354E770DC40D6A2

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ni2ghr9eUJ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\EarnPackage\EarnPackage.exe

C:\ProgramData\EarnPackage\sqlite3.dll

C:\ProgramData\ea1212it56.dat

C:\ProgramData\ea1212rc56.dat

C:\ProgramData\ea1212resa.dat

C:\Users\user\AppData\Local\Temp\is-BL2M9.tmp\Ni2ghr9eUJ.tmp

C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_iscrypt.dll

C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_setup64.tmp

C:\Users\user\AppData\Local\Temp\is-SGOAH.tmp\_isetup\_shfoldr.dll

C:\Users\user\AppData\Local\Video Minimizer 1.77\LTDIS13n.dll (copy)

C:\Users\user\AppData\Local\Video Minimizer 1.77\gdiplus.dll (copy)

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-2Q5CI.tmp

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-60ALK.tmp

C:\Users\user\AppData\Local\Video Minimizer 1.77\is-61IGP.tmp

Windows Analysis Report
Ni2ghr9eUJ.exe

Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Function 0040A0E7 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111
COMMON

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Function 0040A0D5 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre